CHAT_OUTPUT_BEGIN
COMMAND_ID=SUPPORT-260921-HOMELAB-BACKUP-GFS-POLICY-PROVENANCE-READONLY-1014R1
STATUS=OK
RC=0
HOST=pve01
MODE=read-only
COMPONENT=homelab-backup-gfs-policy-provenance
REFERENCE_REGISTER_CHECK=OK
REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66
ERROR_REGISTER_CHECK=OK
ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0
COMMAND_SHA256=b94505b908ce9c7a3a540f248a0e513d26e5cbf4aa0a29ac1ac024e6fe033e06
DUPLICATE_FAILED_COMMAND_BLOCKED=false
EXECUTION_STARTED=true
CHANGE_DECLARED=false
RESULT_CONTRACT_VALID=true
RESULT_CONTRACT_STATUS=NOT_APPLICABLE
RESULT_CONTRACT_ERROR=NONE
COMMAND_RC=0
CHANGES_MADE=false
ROLLBACK_STARTED=false
ROLLBACK_RESTORED=null
MUTATION_OUTCOME=NO_MUTATION
SANITIZED=yes
SECRETS_INCLUDED=no
PRIVATE_ADDRESSES_INCLUDED=no
RAW_EVIDENCE_SHA256=e077d30c007aba578a8977bb0b06012d97be867b66f19f423a341e5bd2fd3ee9
SANITIZED_OUTPUT_SHA256=f2ab043b82dfef2b66f1a3171fd8b52ac754315a299c1964b768219381e6b224
OUTPUT_BEGIN
WORKERS2_BACKUP_GFS_POLICY_PROVENANCE_BEGIN=1
COMMAND_ID=SUPPORT-260921-HOMELAB-BACKUP-GFS-POLICY-PROVENANCE-READONLY-1014R1
MODE=read-only
COMPONENT=homelab-backup-gfs-policy-provenance
HOST=pve01
UID=0
MUTATION_BOUNDARY=READ_ONLY_NO_FETCH_NO_RESET_NO_CHECKOUT_NO_WRITE_NO_SERVICE_ACTION_NO_BACKUP_NO_RESTORE_NO_RETENTION_NO_DELETE_NO_MAIL
GITEA_LIVE_MAIN=326622a4864fa9b5f43b69981733236bb42c4d7b	refs/heads/main
LOCAL_CANONICAL_HEAD=d5e2ef5639398a762283e47143c17b494f8ed579
LOCAL_CANONICAL_STATUS=["## main...origin/main [behind 90]"]
CURRENT_TARGETS_SHA256=6ecf034ca03b52a1e6beceeae81d86a623885462c095d50b133aea4048a4626e
CURRENT_GFS_SHA256=ea6526bec7d7591bef876799cecddff4849631a936edc9f593b47211fbad715c
CURRENT_HELPER_SHA256=6b7ec1ab3ee1c540a9113b5620c3b4b5a50de6536f3a069d31b2e1243f23bafa
CURRENT_GFS_POLICY={"capacity_guard_cloud_max_age_seconds":14400,"capacity_guard_max_free_fraction_milli":500,"capacity_guard_target_max_age_seconds":172800,"completed_periods_only":true,"critical_vm_logicals":["vm110","vm111","vm112","vm113","vm130","vm150","vm160","vm170","vm200"],"monthly_buckets":6,"policy_version":1,"schema":"homelab-backup-gfs-policy-v1","weekly_buckets":4}
CURRENT_FOCUS_TARGET_RECORDS=[{"id":"170","kind":"VM","lifecycle":"ACTIVE","logical_id":"vm170","owner":"pve01"},{"id":"171","kind":"VM","lifecycle":"ACTIVE","logical_id":"vm171","owner":"pve01"},{"id":"190","kind":"VM","lifecycle":"ACTIVE","logical_id":"vm190","owner":"pve03"},{"id":"9130","kind":"VM","lifecycle":"ACTIVE","logical_id":"vm9130","owner":"pve02"},{"id":"200","kind":"VM","lifecycle":"RETIRED_PRESERVE","logical_id":"vm200","owner":"pve03"}]
CURRENT_ACTIVE_VM_RECORDS=[{"id":"110","kind":"VM","lifecycle":"ACTIVE","logical_id":"vm110","owner":"pve01"},{"id":"111","kind":"VM","lifecycle":"ACTIVE","logical_id":"vm111","owner":"pve02"},{"id":"112","kind":"VM","lifecycle":"ACTIVE","logical_id":"vm112","owner":"pve01"},{"id":"113","kind":"VM","lifecycle":"ACTIVE","logical_id":"vm113","owner":"pve02"},{"id":"130","kind":"VM","lifecycle":"ACTIVE","logical_id":"vm130","owner":"pve03"},{"id":"150","kind":"VM","lifecycle":"ACTIVE","logical_id":"vm150","owner":"pve01"},{"id":"160","kind":"VM","lifecycle":"ACTIVE","logical_id":"vm160","owner":"pve02"},{"id":"170","kind":"VM","lifecycle":"ACTIVE","logical_id":"vm170","owner":"pve01"},{"id":"171","kind":"VM","lifecycle":"ACTIVE","logical_id":"vm171","owner":"pve01"},{"id":"190","kind":"VM","lifecycle":"ACTIVE","logical_id":"vm190","owner":"pve03"},{"id":"9130","kind":"VM","lifecycle":"ACTIVE","logical_id":"vm9130","owner":"pve02"}]
CURRENT_GFS_HELPER_SOURCE=[{"line":1,"sha256":"381f9bfc69d49d39040a7d5fc3197ce385019a2ba2de649622f841a8c658ed37","text":"#!/usr/bin/env python3"},{"line":2,"sha256":"1ae02ec1cd4c9dac380048198e06dc79529c2eba92521b8535b3bd508067cf57","text":"import datetime as dt, json, os, pathlib, sys"},{"line":3,"sha256":"0b2f61c78cffdbe744624672aa040b91936b703b54d74e6b9d6ada157b914bd9","text":"CFG=pathlib.Path(os.environ.get(\"HOMELAB_BACKUP_GFS_POLICY\",\"/etc/homelab-backup/gfs-retention.json\"))"},{"line":4,"sha256":"f73eaf5c141167f26d3cd9b0cdfca9b1cb34bc48e2a47efcfe8473d4148a89c4","text":"REG=pathlib.Path(os.environ.get(\"HOMELAB_BACKUP_TARGET_REGISTRY\",\"/etc/homelab-backup/targets.json\"))"},{"line":5,"sha256":"f04131237bc626b5251ce90774d915d600d772f2c2af2f010c9fff93195070fb","text":"def die(msg,rc=65):"},{"line":6,"sha256":"e244de494f9f5957272cc635563493da40b1603656561b4e779e2dee0b82c1df","text":"    print(f\"GFS_POLICY_ERROR={msg}\",file=sys.stderr); raise SystemExit(rc)"},{"line":7,"sha256":"f3c4210990205aaa264a2162b26d2af971820ea96f2124aeffa11ef6a3281abb","text":"def load():"},{"line":8,"sha256":"9ae38ff4a527be8dc4c600a07fa8a222f62a73c21723e421c7b5b7f8df4871ec","text":"    try: c=json.loads(CFG.read_text()); r=json.loads(REG.read_text())"},{"line":9,"sha256":"de9bd0a89197a3d5d95a9b9441ddd83e331c03ba6843df082f20e3382ac312bd","text":"    except Exception: die(\"READ_OR_JSON_INVALID\",66)"},{"line":10,"sha256":"af5a84ad7770e4ece43ae3269326494e85efa8c3381a98de63281b88fab9275f","text":"    if c.get(\"schema\")!=\"homelab-backup-gfs-policy-v1\" or c.get(\"policy_version\")!=1: die(\"SCHEMA_INVALID\",66)"},{"line":11,"sha256":"17d911bfd01a1f638cca468224effdf6f9cc7ee8511bd556cb236fbc64e3e7ff","text":"    if c.get(\"completed_periods_only\") is not True or c.get(\"weekly_buckets\")!=4 or c.get(\"monthly_buckets\")!=6 or c.get(\"capacity_guard_max_free_fraction_milli\")!=500 or c.get(\"capacity_guard_target_max_age_seconds\")!=172800 or c.get(\"capacity_guard_cloud_max_age_seconds\")!=14400: die(\"POLICY_INVALID\",66)"},{"line":12,"sha256":"880f2144e950185b2bed0118c1ba10498b909a176b421d285cb96573a204c855","text":"    crit=c.get(\"critical_vm_logicals\")"},{"line":13,"sha256":"c44f6760ffd70ef6bcdc3064327167b3f0e6a79ae984f364195f1b218c62502a","text":"    if not isinstance(crit,list) or len(crit)!=9 or len(set(crit))!=9: die(\"CRITICAL_SET_INVALID\",66)"},{"line":14,"sha256":"a7894fb8f64ddd7cfe49ce592ad92002276da503fb5d9e2ea630aa9712b3555d","text":"    rows={x.get(\"logical_id\"):x for x in r.get(\"targets\",[])}"},{"line":15,"sha256":"468d72e42a6080c1fadb0ee30e6a0432a0b8e6510295ecd5ab05da4a57619d2b","text":"    for logical in crit:"},{"line":16,"sha256":"4cfbb2143830d0ee32253e76a308a6053facb634ad12379652dd5672126e1423","text":"        rec=rows.get(logical)"},{"line":17,"sha256":"1a59b8ac77450c24932f51e77bb0e485edca8b0664f74f5bfa3983aa9ba009c5","text":"        if not rec or rec.get(\"kind\")!=\"VM\" or rec.get(\"lifecycle\")!=\"ACTIVE\": die(f\"CRITICAL_NOT_ACTIVE_VM_{logical}\",66)"},{"line":18,"sha256":"2391af46a82afada78b2cac5785acb491a9607758d8e5b0215dd5048536f05e9","text":"    return c,r"},{"line":19,"sha256":"5d5a9e1dba30f4139bea8ceaf10f4604cdee1b4fcf14bbc65e7e15a8c25406be","text":"def parse_utc(s):"},{"line":20,"sha256":"c94f2f6f372b7580bfa044adc2baa7338648791e5270602f26af1a770ac18f1d","text":"    try:"},{"line":21,"sha256":"4c4f8062a3f711b05acd10c311710f6edca7d5e61d47572da903574941637436","text":"        if s.endswith('Z'): s=s[:-1]+'+00:00'"},{"line":22,"sha256":"ebcaeecaac764fc494375167ec05387926040cd1b1f86a9a7ded557121a4d248","text":"        x=dt.datetime.fromisoformat(s)"},{"line":23,"sha256":"671a5775b877f908db6f7594dd88c552e4fb0b92ff8fd696da6e60332e5cdc96","text":"        if x.tzinfo is None: x=x.replace(tzinfo=dt.timezone.utc)"},{"line":24,"sha256":"bf6127223cf7bfe011a233f7cba3b0c36dd66cf6875c83bf446093d165c9b460","text":"        return x.astimezone(dt.timezone.utc)"},{"line":25,"sha256":"8881e222112813081648f36fbf9a93ae844befe7fc13574f32618fbc6864ad5e","text":"    except Exception: die(\"SEALED_TIME_INVALID\",66)"},{"line":26,"sha256":"80153e0dbfd9733b53bc24416ad7dbfcc58b76a9a05004f7b20d3755422819b6","text":"def now_utc():"},{"line":27,"sha256":"0a4e2ff27a2a6dbbf1f3c9ef409e9e8eb8ed33c2440a762b6ef741bd53847159","text":"    v=os.environ.get(\"HOMELAB_GFS_NOW_UTC\")"},{"line":28,"sha256":"b78d4cf61c1046cb3bf1cd38a9a690eba448ba8f74a43caf8153ed2fcce596aa","text":"    return parse_utc(v) if v else dt.datetime.now(dt.timezone.utc)"},{"line":29,"sha256":"dd158cd2c31d76b17577f0a5b61a8ad15198d4ef311d6293da2c853c456f579a","text":"def select(logical,c):"},{"line":30,"sha256":"4c9978e610851b78ae6d9f76e29b9021cb62944940640dc68ecc71dc41e2f378","text":"    if logical not in c[\"critical_vm_logicals\"]: return"},{"line":31,"sha256":"e5ca22640216c01ada82e3fe1a4f6a7340d9f090d6924d26af2962165f733479","text":"    now=now_utc(); cur_iso=now.isocalendar(); cur_week=(cur_iso.year,cur_iso.week); cur_month=(now.year,now.month)"},{"line":32,"sha256":"5c149f5d84df11ab050d1ab21e70b6259e8facc6d5ec60c8c6005400bdd9ccc1","text":"    weekly=[]; monthly=[]; seen_w=set(); seen_m=set()"},{"line":33,"sha256":"59327d23c7ca081af655c7d5b04945bebe2fc6f3b99701e8a74ca9b34377f7ea","text":"    for raw in sys.stdin:"},{"line":34,"sha256":"213114b8a9a37b4f3ee2eeceb6e97af98355516910d8202ab8afd46ae274758f","text":"        raw=raw.rstrip(\"\\n\")"},{"line":35,"sha256":"6a1e1488a785eec8fb55b4fc1f44631bd8b6ea11678dfa2d7e02960d8650e78a","text":"        if not raw: continue"},{"line":36,"sha256":"be2f77cc0f067d2f5a60237abe246edeafede529e452108e3e4dc12fb7caf7d8","text":"        parts=raw.split(\"\\t\")"},{"line":37,"sha256":"a45f3580b42a99579d8034ab4f140b8d8e13421e4481f9142d7c71b36aa460b3","text":"        if len(parts)!=2: die(\"SELECT_INPUT_INVALID\",66)"},{"line":38,"sha256":"a5fc301be3512ba06d705bffdcd8ade0a5a99f5dc7fb31d9d91f3c8d777e6711","text":"        gen,sealed=parts; when=parse_utc(sealed); iso=when.isocalendar(); wb=(iso.year,iso.week); mb=(when.year,when.month)"},{"line":39,"sha256":"3a95b6ce11458868739c37ad6b934f4f69ee821f18c4fc655e913742a8bd3d05","text":"        if wb!=cur_week and len(weekly)<c[\"weekly_buckets\"] and wb not in seen_w:"},{"line":40,"sha256":"f2c15e597c176ac1a7d21d08e9c7b709ddf23a58920f4002c307c05edd0d1dac","text":"            seen_w.add(wb); weekly.append((gen,f\"{wb[0]:04d}-W{wb[1]:02d}\"))"},{"line":41,"sha256":"990e69478777e97050fe763208d180aa24b8d67ead01f156e2cb8f5ba5401c03","text":"        if mb!=cur_month and len(monthly)<c[\"monthly_buckets\"] and mb not in seen_m:"},{"line":42,"sha256":"6e37db2dd72a6a2a3df60cf0e96c6d3c797b36b36f4b9512d608c89645232346","text":"            seen_m.add(mb); monthly.append((gen,f\"{mb[0]:04d}-{mb[1]:02d}\"))"},{"line":43,"sha256":"1ccbfecf7d671261a24d4a38525610ccd67402f9a0919f83c9847b824c14b30c","text":"        if len(weekly)>=c[\"weekly_buckets\"] and len(monthly)>=c[\"monthly_buckets\"]: break"},{"line":44,"sha256":"8ddd05307b16bdb65e27ed4daaa771bff5c79cef98f456936e8fe5a1702258be","text":"    for gen,b in weekly: print(f\"WEEKLY\\t{gen}\\t{b}\")"},{"line":45,"sha256":"1117b07f51ec1fecccdde8595f3f4c22d1468fb33b1bee17fb70df87e24a3a14","text":"    for gen,b in monthly: print(f\"MONTHLY\\t{gen}\\t{b}\")"},{"line":46,"sha256":"2c4c5b0ebed3de9b574a3757903571ebf0dcaec6764f9f8d245ce0740a619321","text":"def main():"},{"line":47,"sha256":"2e9d94c216c96ae92be8bd40bbc6b5c42d98b3fcb05f82560214dfde0420fb78","text":"    c,_=load(); args=sys.argv[1:]"},{"line":48,"sha256":"0a7ee6ef3c083194f0004d25d05a420f3d4b36231bdbbb86faefe3df3e22bfb5","text":"    if args==[\"validate\"]: print(\"GFS_POLICY=OK\"); return"},{"line":49,"sha256":"c61eee89554bc74f8ccab7518825e202e69d626bd7385132da86752e4e997187","text":"    if args==[\"critical-logicals\"]:"},{"line":50,"sha256":"a6db40d91e1d862c8ca704051a4bd342a8dc443673314f5713b926709a5369d5","text":"        print(\"\\n\".join(c[\"critical_vm_logicals\"])); return"},{"line":51,"sha256":"41e05ff5ca7a41dadee3e5d88a28a843d3d0a8c48c382142b386aebf2b9b55be","text":"    if args==[\"weekly-buckets\"]: print(c[\"weekly_buckets\"]); return"},{"line":52,"sha256":"7187022be500b823309292b134f1d87a2148def6a60db7ec4450e3a470e10eac","text":"    if args==[\"monthly-buckets\"]: print(c[\"monthly_buckets\"]); return"},{"line":53,"sha256":"bec70750c2fa1733ce3829a85169999d3a0f90eb879021467c16e88683851999","text":"    if args==[\"capacity-guard-milli\"]: print(c[\"capacity_guard_max_free_fraction_milli\"]); return"},{"line":54,"sha256":"9b69cba2b5792004710d50ad75c02583c68431d7d928faee8d29925dbdafa785","text":"    if len(args)==2 and args[0]==\"is-critical\": raise SystemExit(0 if args[1] in c[\"critical_vm_logicals\"] else 1)"},{"line":55,"sha256":"71d43698776179042a415280644aa3987e6e40705f158004c92f114e7e277f20","text":"    if len(args)==2 and args[0]==\"select\": select(args[1],c); return"},{"line":56,"sha256":"d433299e4cf4c166c21214a737fef7efe1f6a18ce192a29f8585209aa8764ef7","text":"    die(\"USAGE\",64)"},{"line":57,"sha256":"a1ae3f2c1fc6c3b5630b100a862bf29dbad2a67122e692d574bea38439e10d0c","text":"if __name__==\"__main__\": main()"}]
HISTORICAL_BRANCH_PROVENANCE=[{"branch":"cr-2026-0072-gfs-retention","exists":true,"grep_count":407,"grep_lines":["HEAD:changes/CR-2026-0005/plan.md:10:8. \u041f\u043e\u0441\u043b\u0435 \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0433\u043e CI \u0438 review \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c lifecycle \u0447\u0435\u0440\u0435\u0437 `homelab-admin`.","HEAD:changes/CR-2026-0006/plan.json:20:    \"homelab-admin-lifecycle\"","HEAD:changes/CR-2026-0007/plan.json:21:    \"homelab-admin-lifecycle\"","HEAD:changes/CR-2026-0012/plan.json:9:  \"lifecycle\": [","HEAD:changes/CR-2026-0030/implementation.md:9:The first controlled apply stopped before capture with `HEALTH_STATE_MISSING`. The v2 task had a v2 state namespace but still referenced the v1 health file and retained hardcoded v1 logical-id literals in lifecycle phases. The correction gives v2 its own `/var/lib/homelab-health/control-bootstrap-v2-cloud-quorum.json` health file and changes all active phase logical-id checks/evidence to `control-bootstrap-v2`. The v1 health/state remain immutable and no failed-apply rollback is required because no generation or cloud mutation occurred.","HEAD:changes/CR-2026-0030/tests.md:6:- failed #401 state directory may exist but must contain zero generation JSON files before lifecycle resume;","HEAD:changes/CR-2026-0031/risk.md:4:Scheduler contention during the 12-target Cloud-A backfill may still stop an apply with rc75, but this no longer creates a dead-end lifecycle state: a subsequent controlled apply can resume from partially installed worker/probe bytes and already-written evidence without recapturing or writing cloud data.","HEAD:changes/CR-2026-0032/README.md:5:This change installs a single canonical audit surface for the current 12 VM/CT and 7 APP backup targets plus CONTROL, cloud health, current payload cleanup, scheduler/lock/process state, staging capacity, escrow presence, retention lifecycle and DR proof boundaries.","HEAD:changes/CR-2026-0035/implementation.md:5:The controlled apply creates CT200 on pve03 using the pinned Debian 13 template, 4 vCPU, 6144 MiB RAM, 1024 MiB swap, 40 GiB local-lvm rootfs, unprivileged mode and nesting. It proves boot and DNS, performs an initial vm200 cloud-quorum backup with restore-validation using the candidate worker before changing live backup runtime, then enrolls vm200 in the canonical VM queue/probe/worker/audit/retention runtime on pve01/pve02/pve03 as required.","HEAD:changes/CR-2026-0035/risk.md:11:- first vm200 SEALED backup and restore evidence before live enrollment;","HEAD:changes/CR-2026-0035/risk.md:13:- rollback preserves any already sealed vm200 cloud generation/evidence rather than deleting recovery data;","HEAD:changes/CR-2026-0035/tests.md:14:- Regression: retention candidate requires SSH stdin isolation and live plan must emit vm200 after hotfix.","HEAD:changes/CR-2026-0035/tests.md:15:- Live hotfix proof requires read-only candidate/post-install retention plans to include remote-owned VMIDs and `KEEP|logical=vm200|...|reason=POLICY_NEWEST_2`.","HEAD:changes/CR-2026-0036/implementation.md:50:- Auth-hotfix verify re-stages the pinned offline selftest before remote verification and removes the transient pve03 stage afterward; this closes the apply-to-verify staging lifecycle defect observed in run 20260812T113300Z-2937839-verify.","HEAD:changes/CR-2026-0049/source-provenance.tsv:4:new-script\ttasks/pve03-r8152-rx-ring-lifecycle-repair-v1/assets/homelab-pve03-r8152-rx-ring\td896dce2f9abdebc5f507fd63e4ef6d1d666452c0263469d3dab4d14a6b229af","HEAD:changes/CR-2026-0049/task-package.sha256:1:d896dce2f9abdebc5f507fd63e4ef6d1d666452c0263469d3dab4d14a6b229af  tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/assets/homelab-pve03-r8152-rx-ring","HEAD:changes/CR-2026-0049/task-package.sha256:2:1d773fb2a9a5fdd198569d8d04d65c4bfc9ce98109fed4148b6e46e50d874778  tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/assets/pve03-r8152-lifecycle-helper.sh","HEAD:changes/CR-2026-0049/task-package.sha256:3:50abd763a56d6da15d003474b4e59410dd2fb0d06c82acee762fb93e458a779d  tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/apply.sh","HEAD:changes/CR-2026-0049/task-package.sha256:4:b8e7df6de169b35b53c51764822faecc40b76767505244fbc5b72ef4dc852771  tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/dry-run.sh","HEAD:changes/CR-2026-0049/task-package.sha256:5:1f2c9da85a67737f86fca0ba41d02e2ed5bd0c75f8ebeffac6784c7f94b06aa3  tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/preflight.sh","HEAD:changes/CR-2026-0049/task-package.sha256:6:c34294d41a3d2ef1033ae674790976043174c1b7269b02bf5738891d8a614aa6  tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/prepare.sh","HEAD:changes/CR-2026-0049/task-package.sha256:7:ee1cd4487210ee9c90bdaf8e17809aaf6e17b1b9419746fcf3ae1557be4c659b  tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/rollback.sh","HEAD:changes/CR-2026-0049/task-package.sha256:8:8b1abc57f61fb46e51aa4b7a90d138dc92bbe1dfec210c4a5a952d3e9ad608a5  tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/seal.sh","HEAD:changes/CR-2026-0049/task-package.sha256:9:1f8916517c7480d63f5e2cb0ee208133583975e4aed7f63c7859d62ef1fb92d6  tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/verify.sh","HEAD:changes/CR-2026-0049/task-package.sha256:10:dd8768072688c206043e23d3ce787feb6a74e696aa7c2595f8679371ba24b930  tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/task.json","HEAD:changes/CR-2026-0049/task-package.sha256:11:c3b5f59dcd22b0f931e7cefd89749d562434396e19ae25aba01f0e116bcdb373  tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/tools/runtime-lib.sh","HEAD:changes/CR-2026-0049/task-package.sha256:12:7118284724c4fb8c21dddd6373adfa7569e2d027ec004a279d85a201b019e8a4  tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/tools/test_contract.py","HEAD:changes/CR-2026-0054/implementation.md:7:The future homelab-admin lifecycle is audit-runtime-only. It stages exact old audit bytes for rollback and does not modify retention runtime, APP/VM queues, dispatcher, systemd schedules, cloud generations, guest state, legacy moderator payload or CONTROL generations.","HEAD:changes/CR-2026-0054/tests.md:15:Expected source result: all PASS/GREEN. Validation only; no homelab-admin lifecycle phase is executed in the source-only scope.","HEAD:changes/CR-2026-0057/implementation.md:5:The CR0057 branch is not statically self-pinned in `source-recovery.tsv`, because a final source commit cannot contain its own future commit hash. Instead CR0054/CR0056 refs are statically pinned, the CR0057 worktree must be clean, and the lifecycle dynamically requires the exact current CR0057 branch HEAD to exist in the all-refs Git bundle. Apply is resume-safe if the quorum transport has already deleted the local archive at `DELETE_AUTHORIZED` or completed `SEALED`.","HEAD:changes/CR-2026-0057/tests.md:3:Required gates: package SHA, bash syntax, in-memory Python compile, CR0057 unittest, task contract test, repository full suite with temporary `PYTHONPYCACHEPREFIX`, `git diff --check`, and real `homelab-admin validate`. Production lifecycle is executed only after all source gates are green.","HEAD:changes/CR-2026-0060/implementation.md:3:Replace only the retention runtime. Preserve CR0055 age normalization and CR0056 resume ordering. `remote_generation_present` captures successful `rclone lsf` output first and aborts rc 69 on list failure. Canary post-purge verification uses the same fail-closed principle while listing the stable remote root. The hotfix lifecycle never calls `scheduled` or `canary`.","HEAD:changes/CR-2026-0060/tests.md:3:Manifest, bash syntax, homelab-admin lint, read-only plan and Python contract. Dynamic stubbed-rclone tests prove present rc=0, absent rc=1, and list failure rc=69. Static checks preserve CR0055 plan normalization and CR0056 transaction resume, and prove lifecycle apply/rollback do not invoke scheduled/canary/rclone writes.","HEAD:changes/CR-2026-0064/implementation.md:3:Add an optional exact pinned-delete lifecycle contract to canonical `scheduled`. With no pin environment the timer path is byte-semantically unchanged. With both pin file and SHA supplied, the runtime validates DELETE plus canonical transaction identities at PRELOCK, recalculates and validates again after acquiring backup locks but before transaction resume, then validates after resume before any new delete loop. Foreign transactions, unexpected PROTECT, plan drift, duplicate identities, wrong state SHA or malformed pin input fail closed. The hotfix lifecycle itself never invokes scheduled or canary.","HEAD:changes/CR-2026-0064/risk.md:3:Primary risk is changing the canonical retention runtime. Mitigation: exact CR0060 preimage SHA, deterministic approved diff, empty transaction journal requirement, five backup locks for runtime replacement, rollback snapshot, synthetic positive/negative pin lifecycle tests, and no destructive invocation in this change. Rollback is allowed only while the journal remains empty.","HEAD:changes/CR-2026-0064/tests.md:8:- pinned PLANNED and DONE transaction lifecycle acceptance","HEAD:changes/CR-2026-0068/implementation.md:16:The bootstrap lifecycle is monotonic and idempotent. Supported install states are ABSENT, ACCESS_READY, and ONLINE_UNSEALED. Existing scoped access is reused; no second token is generated. Access validation uses the issue API family only. Bootstrap creates state before full live assertion. Future command outcomes are never predicted in source; the dynamic ledger is backfilled at apply time.","HEAD:changes/CR-2026-0070/implementation.md:3:Install `/etc/homelab-backup/targets.json` plus `/usr/local/libexec/homelab-backup-target-registry` as the declarative lifecycle source. Replace five current APP/audit/retention runtimes so active VM/APP inventory, owner mapping, APP logical/source metadata, retention keep policy, retired-preserve lifecycle, and systemd expected-state checks come from the registry.","HEAD:changes/CR-2026-0070/implementation.md:5:The retired `app-skladchik-moderator-assistant` is explicit `RETIRED_PRESERVE`: it is not schedulable and retention cannot select it for DELETE. Five historical monitoring timers are explicit `ABSENT` and are healthy only as `not-found/inactive`. No systemd unit, backup, retention GC, cloud object, or guest is mutated by this CR.","HEAD:changes/CR-2026-0070/package.sha256:7:315da18fe0b49fd434e95c908aff552646411577199e4c9e9f31dde970206de5  tasks/backup-target-lifecycle-registry-v1/assets/approved-diffs/homelab-app-cloud-quorum-freshness-probe.diff","HEAD:changes/CR-2026-0070/package.sha256:8:47996e7ac4696db1e3f28f5f39c0dd00abd6f083188098c90c463a40b4502b4c  tasks/backup-target-lifecycle-registry-v1/assets/approved-diffs/homelab-app-cloud-quorum-queue.diff","HEAD:changes/CR-2026-0070/package.sha256:9:6cddcd77dfb1d1a4df9093940ecfd0050262d755512546dd6b8f0089b4149379  tasks/backup-target-lifecycle-registry-v1/assets/approved-diffs/homelab-app-cloud-quorum-worker.diff","HEAD:changes/CR-2026-0070/package.sha256:10:c0339ab239e4377076b1030efd666dbf0da17effd4607e8752aa91e1a003ef95  tasks/backup-target-lifecycle-registry-v1/assets/approved-diffs/homelab-backup-audit.diff","HEAD:changes/CR-2026-0070/package.sha256:11:cd25aa43186302c1ed99fc9762aecff3c49d4dbb247b78fae99242d27ad292eb  tasks/backup-target-lifecycle-registry-v1/assets/approved-diffs/homelab-backup-retention-gc.diff","HEAD:changes/CR-2026-0070/package.sha256:12:e5a0874e9168672aa7dd9d4196b160d25e28341263c6be6838688a028bce37e2  tasks/backup-target-lifecycle-registry-v1/assets/backup-target-registry.json","HEAD:changes/CR-2026-0070/package.sha256:13:2e77c17df19a29084e71af094831e44649f88a6d8d9147844aff54da8301112a  tasks/backup-target-lifecycle-registry-v1/assets/homelab-app-cloud-quorum-freshness-probe","HEAD:changes/CR-2026-0070/package.sha256:14:93905d993cd7552d2141c3e554743be36a72f7cb419cdc3db165d563dd9fa57d  tasks/backup-target-lifecycle-registry-v1/assets/homelab-app-cloud-quorum-queue","HEAD:changes/CR-2026-0070/package.sha256:15:bdacec92dd033fc83bdf45b87362d079f4663d954cc9f0375a76791a4601b76b  tasks/backup-target-lifecycle-registry-v1/assets/homelab-app-cloud-quorum-worker","HEAD:changes/CR-2026-0070/package.sha256:16:4827a3eec23595c2a4d0ae17e91dcd9604102db73c38de9061531223dd132902  tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-audit","HEAD:changes/CR-2026-0070/package.sha256:17:5698c4b03cde557ed103f7f9c51bec17a4ff969ab96a1cb89a7be4ce8e810437  tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-retention-gc","HEAD:changes/CR-2026-0070/package.sha256:18:94ee1e17257b9e64ce951b50cfe20db218e18f2f8aa1b964acd04befaf4fcb2e  tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-target-registry","HEAD:changes/CR-2026-0070/package.sha256:19:380fb826e09b757fd6ebfa9d2b2da7243466c3147909cfa3d2c5231e39d4101d  tasks/backup-target-lifecycle-registry-v1/phases/apply.sh","HEAD:changes/CR-2026-0070/package.sha256:20:3e0c78c3600f1b714682ea5bf2298b255635d925fe5372ba56094161dc058d65  tasks/backup-target-lifecycle-registry-v1/phases/dry-run.sh","HEAD:changes/CR-2026-0070/package.sha256:21:8b3eee5fa157ba3e48e8aab895208efe4130061855c81848a1f82f689e2b4e96  tasks/backup-target-lifecycle-registry-v1/phases/preflight.sh","HEAD:changes/CR-2026-0070/package.sha256:22:46e9c5e85796e3fdfc559be96d60dfd64d772a722b00045015b259ecf5ef2988  tasks/backup-target-lifecycle-registry-v1/phases/prepare.sh","HEAD:changes/CR-2026-0070/package.sha256:23:dad64c5a20eacc7656b2c88f6e8e0b1659630ba1055a39a7d40cd6682854f4ea  tasks/backup-target-lifecycle-registry-v1/phases/rollback.sh","HEAD:changes/CR-2026-0070/package.sha256:24:c09615e5d4956b1078dbf56a5d0afd2fe2f037bd5ff2cbf8e6fac947609ea09b  tasks/backup-target-lifecycle-registry-v1/phases/seal.sh","HEAD:changes/CR-2026-0070/package.sha256:25:c39682d0502cea8e03e07c7624a9c1ccbb073cae498094c1cc8275c4ee3b6545  tasks/backup-target-lifecycle-registry-v1/phases/verify.sh","HEAD:changes/CR-2026-0070/package.sha256:26:0842a4888a2a198dc6ef6864c43d3133b9f7959928f54f9d938abf370ca3802b  tasks/backup-target-lifecycle-registry-v1/task.json","HEAD:changes/CR-2026-0070/package.sha256:27:03e0b829100962b02c32058a9f6bae7243566b4e9c3388a096e4ed9be6a2cbf3  tasks/backup-target-lifecycle-registry-v1/tools/runtime-lib.sh","HEAD:changes/CR-2026-0070/package.sha256:28:4c34665873e4cbe9dda384d1d137b260ddffb536347591b4f52021eb3acc38d6  tasks/backup-target-lifecycle-registry-v1/tools/test_contract.py","HEAD:changes/CR-2026-0070/package.sha256:29:14c7dff3961627f6ecd205da28eb606db87b764464be70e00354603821f59005  tests/test_cr_2026_0070_target_lifecycle_registry.py","HEAD:changes/CR-2026-0070/tests.md:7:- explicit `RETIRED_PRESERVE` semantics;","HEAD:changes/CR-2026-0071/implementation.md:8:`install_one` now declares locals first, assigns inputs separately, then derives `tmp`. CMD-897 failed before the first `install` call, so lifecycle resumes from exact OLD with the existing rollback baseline.","HEAD:changes/CR-2026-0071/tests.md:11:- lifecycle pins exact preimage, predecessor seals, registry, timer state, monotonic install and rollback.","HEAD:changes/CR-2026-0072/package.sha256:7:a1548ace3148e2eb441d88a51c39a907b1fadb266ab2893df88a62fb56c2d502  tasks/backup-gfs-retention-v1/assets/approved-diffs/homelab-backup-retention-gc.diff","HEAD:changes/CR-2026-0072/package.sha256:8:ea6526bec7d7591bef876799cecddff4849631a936edc9f593b47211fbad715c  tasks/backup-gfs-retention-v1/assets/gfs-retention.json","HEAD:changes/CR-2026-0072/package.sha256:9:6b7ec1ab3ee1c540a9113b5620c3b4b5a50de6536f3a069d31b2e1243f23bafa  tasks/backup-gfs-retention-v1/assets/homelab-backup-gfs-policy","HEAD:changes/CR-2026-0072/package.sha256:10:4bc3ba9bcb0dfd7d0497104e2b41d11e82a32f9567cd511ee5302fefdb3699a5  tasks/backup-gfs-retention-v1/assets/homelab-backup-retention-gc","HEAD:changes/CR-2026-0072/package.sha256:11:1e7eeec3c314c78c8085c04d4acf083e7f68beacdb0565ccae32fd9ebdc1773b  tasks/backup-gfs-retention-v1/phases/apply.sh","HEAD:changes/CR-2026-0072/package.sha256:12:79ea9be32836a30f2fe02cf51e9ecea4e950c71c09a3b86ee7b29bcef6fb09e7  tasks/backup-gfs-retention-v1/phases/dry-run.sh","HEAD:changes/CR-2026-0072/package.sha256:13:2aa749a57f0d3769b0252093659cd1f4c330054e4ba23b8b87a52528481b2ff9  tasks/backup-gfs-retention-v1/phases/preflight.sh","HEAD:changes/CR-2026-0072/package.sha256:14:5000125087aaa4b1e9db2b40a331b4c32d4838f616579ca698984b57ca423191  tasks/backup-gfs-retention-v1/phases/prepare.sh","HEAD:changes/CR-2026-0072/package.sha256:15:f0e7ff8c7d1b402bfb12a1f395aa7b7583898480f3a7cc563e2ba00d5367d966  tasks/backup-gfs-retention-v1/phases/rollback.sh","HEAD:changes/CR-2026-0072/package.sha256:16:a98a10c737bdcf33f820f1f9c9858b821f8d7a29094237a47301087a19774f3f  tasks/backup-gfs-retention-v1/phases/seal.sh","HEAD:changes/CR-2026-0072/package.sha256:17:9c15680750983437ad56679bd6be60e260c778fb4c2f4a0f6afcbd47c65fb266  tasks/backup-gfs-retention-v1/phases/verify.sh","HEAD:changes/CR-2026-0072/package.sha256:18:cddef5fb6c9ca667fd198b777a1118ebefdbd177d6ccfa6544798abd8a20bc06  tasks/backup-gfs-retention-v1/task.json","HEAD:changes/CR-2026-0072/package.sha256:19:c40a1ef0555263219fb0a78b7dffffd10435818dd313438faee8eaad14b9f6c6  tasks/backup-gfs-retention-v1/tools/capacity_guard.py","HEAD:changes/CR-2026-0072/package.sha256:20:5fb5bae9b59f4de1c6ffde7a28462877dcb3c352453b449612dbd47ad0963e82  tasks/backup-gfs-retention-v1/tools/runtime-lib.sh","HEAD:changes/CR-2026-0072/package.sha256:21:1afb2e72ac627bc1767642866d03485c27bc7723e50950d9864250d715cbaf93  tasks/backup-gfs-retention-v1/tools/test_contract.py","HEAD:docs/superpowers/plans/2026-08-12-vm170-apps-b-retirement-implementation.md:60:- `tasks/vm170-selected-app-retirement-v1/phases/{preflight,prepare,dry-run,apply,verify,rollback,seal}.sh` \u2014 standard lifecycle.","HEAD:docs/superpowers/plans/2026-08-12-vm170-apps-b-retirement-implementation.md:351:Delete ignored `*.pyc` and empty `__pycache__` directories first. Run `PYTHONDONTWRITEBYTECODE=1 python3 -m pytest -q tests`. The known suite may recreate the CR0029 lifecycle `.pyc`; record that classification, remove it after the successful run, and require zero remaining `*.pyc` before commit.","HEAD:docs/superpowers/plans/2026-08-13-backup-control-coverage-hardening-implementation.md:524:- [ ] **Step 4: Create lifecycle phases**","HEAD:docs/superpowers/plans/2026-08-13-control-refresh-implementation.md:9:**Tech Stack:** Bash, Python 3, jq, git bundle, tar/gzip, sha256sum, rclone, `homelab-admin` schema v2 controlled lifecycle, Python `unittest`.","HEAD:docs/superpowers/plans/2026-08-13-control-refresh-implementation.md:27:- The generated ops bundle must contain the CR0057 source branch at the exact CR0057 source HEAD used for the lifecycle.","HEAD:docs/superpowers/plans/2026-08-13-control-refresh-implementation.md:41:- Every lifecycle phase is a separate operator command; do not combine `prepare`, `dry-run`, `apply`, `verify`, or `seal`.","HEAD:docs/superpowers/plans/2026-08-13-control-refresh-implementation.md:49:- `tasks/backup-control-refresh-v1/task.json` \u2014 controlled-task contract, source-of-truth pins, reads/writes, lifecycle phase map, runtime matrix and no-change assertions.","HEAD:docs/superpowers/plans/2026-08-13-control-refresh-implementation.md:67:- `changes/CR-2026-0057/implementation.md` \u2014 implemented design and lifecycle behavior.","HEAD:docs/superpowers/plans/2026-08-13-control-refresh-implementation.md:69:- `changes/CR-2026-0057/tests.md` \u2014 exact tests and expected lifecycle gates.","HEAD:docs/superpowers/plans/2026-08-13-control-refresh-implementation.md:298:- [ ] **Step 1: Add failing lifecycle contract tests**","HEAD:docs/superpowers/plans/2026-08-13-control-refresh-implementation.md:325:Exact lifecycle:","HEAD:docs/superpowers/plans/2026-08-13-control-refresh-implementation.md:344:Expected: all green; no lifecycle phase has been run.","HEAD:docs/superpowers/plans/2026-08-13-control-refresh-implementation.md:350:git commit -m \"feat(CR-2026-0057): add CONTROL refresh lifecycle\"","HEAD:docs/superpowers/plans/2026-08-13-control-refresh-implementation.md:367:- Produces: auditable CR0057 source package ready for controlled lifecycle.","HEAD:docs/superpowers/plans/2026-08-13-legacy-backup-target-retirement-implementation.md:9:**Tech Stack:** Bash, Python 3, jq, sha256sum, systemd read-only inspection, `homelab-admin` schema v2 controlled lifecycle, Python `unittest`.","HEAD:docs/superpowers/plans/2026-08-13-legacy-backup-target-retirement-implementation.md:29:- MODERATOR-CR0035 generation `vm200-pve03-20260812T050910Z` is historical evidence only and MUST NOT be a CR0058 freshness pin.","HEAD:docs/superpowers/plans/2026-08-13-legacy-backup-target-retirement-implementation.md:31:- Latest read-only witness before source construction (#837): generation `vm200-pve03-20260813T013518Z`, restore-evidence SHA256 `d4824c806b573c2ba430772ee3da019227d69a16a97e45a5c9ef6b2270e09c0c`. This is diagnostic provenance, not a static lifecycle pin.","HEAD:docs/superpowers/plans/2026-08-13-legacy-backup-target-retirement-implementation.md:124:Declare exact reads/writes, five runtime mutation paths, lifecycle phases, new seal path `/var/lib/homelab-admin/seals/legacy-backup-target-retirement-v1.json`, no-change assertions, runtime matrix, source-of-truth pins and CT200 replacement evidence.","HEAD:docs/superpowers/plans/2026-08-13-legacy-backup-target-retirement-implementation.md:203:- [ ] **Step 1: Add failing lifecycle tests**","HEAD:docs/superpowers/plans/2026-08-13-legacy-backup-target-retirement-implementation.md:221:- [ ] **Step 3: Implement lifecycle**","HEAD:docs/superpowers/plans/2026-08-13-legacy-backup-target-retirement-implementation.md:278:git commit -m \"feat(CR-2026-0058): add controlled legacy backup target retirement lifecycle\"","HEAD:docs/superpowers/plans/2026-08-13-legacy-backup-target-retirement-implementation.md:318:- [ ] **Step 4: Exercise lifecycle in fake/runtime harness**","HEAD:docs/superpowers/specs/2026-08-12-vm170-apps-b-retirement-design.md:283:- apply-to-verify phase artifact lifecycle;","HEAD:docs/superpowers/specs/2026-08-13-backup-control-coverage-hardening-design.md:242:- use `homelab-admin` controlled lifecycle only;","HEAD:docs/superpowers/specs/2026-08-13-control-refresh-design.md:101:- full controlled lifecycle completes through seal;","HEAD:docs/superpowers/specs/2026-08-13-legacy-backup-target-retirement-design.md:16:- MODERATOR-CR0035 historically proved generation `vm200-pve03-20260812T050910Z`; that value is historical evidence, not a CR0058 freshness pin.","HEAD:docs/superpowers/specs/2026-08-13-legacy-backup-target-retirement-design.md:18:- Latest read-only observation before source construction (#837) was generation `vm200-pve03-20260813T013518Z`, evidence SHA256 `d4824c806b573c2ba430772ee3da019227d69a16a97e45a5c9ef6b2270e09c0c`; this is a witness, not a static lifecycle pin.","HEAD:docs/superpowers/specs/2026-08-13-legacy-backup-target-retirement-design.md:198:- fake/runtime lifecycle exercise for preflight through seal;","HEAD:errors/regression-cases.json:483:      \"prevention\": \"Install one validated target registry; lifecycle-aware runtimes consume it and source integrity tests reject hard-coded active target arrays.\",","HEAD:errors/regression-cases.json:485:      \"source\": \"CR0070 target lifecycle registry\",","HEAD:errors/regression-cases.json:490:      \"prevention\": \"Registry declares retired logicals; retention enumerates them explicitly and emits RETIRED_PRESERVE KEEP decisions with zero DELETE candidates.\",","HEAD:errors/regression-cases.json:491:      \"root_cause\": \"Retention had no explicit RETIRED_PRESERVE lifecycle state.\",","HEAD:errors/regression-cases.json:498:      \"root_cause\": \"Monitoring compared raw unit presence rather than actual state to desired lifecycle state.\",","HEAD:errors/regression-cases.json:540:      \"source\": \"CR0071 first-run lifecycle\",","HEAD:observed/source-snapshots/dependency-map-latest.tsv:11:npmplus-edge\t192.168.50.24\tcritical\tnpmplus-edge\tok\thomelab-pve01-app-npmplus-edge-20260715T012136Z\tedge-vm,dns,backup\tok","HEAD:tasks/backup-control-coverage-hardening-v1/assets/homelab-backup-audit:398:lifecycle_status=OPEN","HEAD:tasks/backup-control-coverage-hardening-v1/assets/homelab-backup-audit:399:if [[ -s \"$SITE_DR_SEAL\" && ! -L \"$SITE_DR_SEAL\" ]] && [[ \"$(sha256sum \"$SITE_DR_SEAL\" | awk '{print $1}')\" == \"$SITE_DR_SEAL_SHA\" ]] && jq -e '.status==\"SEALED\" and .change_id==\"DR-2026-FINAL\" and .full_site_dr_proven==true and .qemu_boot_restore_proven==true and .ct_boot_restore_proven==true and .provider_worm_proven==false and .provider_worm_skipped_by_policy==true' \"$SITE_DR_SEAL\" >/dev/null; then dr_proof_status=PROVEN; global_dr_proven=YES; lifecycle_status=CLOSED_PROVEN; fi","HEAD:tasks/backup-control-coverage-hardening-v1/assets/homelab-backup-audit:408:printf 'SUMMARY|AUDIT_STATUS=OK|BACKUP_STATUS=%s|DR_PROOF_STATUS=%s|CONTROL_FRESHNESS=%s|LIFECYCLE_STATUS=%s|VM_COUNT=%s|APP_COUNT=%s|FRESH=%s|STALE=%s|RESUME=%s|UNVERIFIED=%s|CONTROL_STATE=%s|CLOUD_OK=%s|SCHEDULER_OK=%s|SOURCE_OK=%s|SOURCE_DRIFT=%s|STAGING_BAD=%s|STAGING_WARN=%s|PAYLOAD_LEAKS=%s|RETENTION_STATUS=%s|GLOBAL_DR_PROVEN=%s\\n' \"$backup_status\" \"$dr_proof_status\" \"$control_status\" \"$lifecycle_status\" \"$vm_seen\" \"$app_seen\" \"$fresh\" \"$stale\" \"$resume\" \"$unverified\" \"$control_status\" \"$cloud_ok\" \"$scheduler_ok\" \"$source_ok\" \"$source_drift\" \"$staging_bad\" \"$staging_warn\" \"$payload_leaks\" \"$retention_status\" \"$global_dr_proven\"","HEAD:tasks/backup-control-coverage-hardening-v1/assets/homelab-backup-audit:413:  jq -n --arg task \"$TASK_ID\" --arg change \"$CHANGE_ID\" --arg at \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\" --arg backup \"$backup_status\" --arg control \"$control_status\" --arg dr \"$dr_proof_status\" --arg lifecycle \"$lifecycle_status\" --arg escrow \"$escrow_status\" --arg staging \"$staging_status\" --arg retention \"$retention_status\" --argjson historical \"$historical_gc_proven\" --argjson owner_gc \"$owner_aware_gc_proven\" --argjson staging_bad \"$staging_bad\" --argjson staging_warn \"$staging_warn\" --argjson vm_count \"$vm_seen\" --argjson app_count \"$app_seen\" --argjson fresh \"$fresh\" --argjson stale \"$stale\" --argjson resume \"$resume\" --argjson unverified \"$unverified\" --argjson cloud_ok \"$cloud_ok\" --argjson scheduler_ok \"$scheduler_ok\" --argjson source_ok \"$source_ok\" --argjson source_drift \"$source_drift\" --argjson payload_leaks \"$payload_leaks\" '{schema:\"homelab-backup-unified-audit-v1\",task_id:$task,change_id:$change,updated_at_utc:$at,audit_status:\"OK\",backup_status:$backup,dr_readiness:$dr,dr_proof_status:$dr,control_freshness:$control,lifecycle_status:$lifecycle,vm_count:$vm_count,app_count:$app_count,fresh_count:$fresh,stale_count:$stale,resume_count:$resume,unverified_count:$unverified,cloud_ok_count:$cloud_ok,scheduler_ok_count:$scheduler_ok,source_ok_count:$source_ok,source_drift_count:$source_drift,payload_leaks:$payload_leaks,control_status:$control,control_source_coverage:\"NOT_MACHINE_PROVEN\",staging_status:$staging,staging_bad_count:$staging_bad,staging_warn_count:$staging_warn,staging_node_count:3,escrow_status:$escrow,retention_status:$retention,historical_gc_proven:$historical,owner_aware_gc_proven:$owner_gc,provider_worm_proven:false,provider_worm_skipped_by_policy:true,clean_machine_bootstrap_proven:($dr==\"PROVEN\"),qemu_boot_restore_proven:($dr==\"PROVEN\"),ct_boot_restore_proven:($dr==\"PROVEN\"),full_site_dr_proven:($dr==\"PROVEN\")}' >\"$tmp\"","HEAD:tasks/backup-control-final-generation-v1/assets/runtime/homelab-backup-audit:407:  jq -n --arg task \"$TASK_ID\" --arg change \"$CHANGE_ID\" --arg at \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\" --arg backup \"$backup_status\" --arg control \"$control_status\" --arg escrow \"$escrow_status\" --arg staging \"$staging_status\" --arg retention \"$retention_status\" --argjson historical \"$historical_gc_proven\" --argjson owner_gc \"$owner_aware_gc_proven\" --argjson staging_bad \"$staging_bad\" --argjson staging_warn \"$staging_warn\" --argjson vm_count \"$vm_seen\" --argjson app_count \"$app_seen\" --argjson fresh \"$fresh\" --argjson stale \"$stale\" --argjson resume \"$resume\" --argjson unverified \"$unverified\" --argjson cloud_ok \"$cloud_ok\" --argjson scheduler_ok \"$scheduler_ok\" --argjson source_ok \"$source_ok\" --argjson source_drift \"$source_drift\" --argjson payload_leaks \"$payload_leaks\" '{schema:\"homelab-backup-unified-audit-v1\",task_id:$task,change_id:$change,updated_at_utc:$at,audit_status:\"OK\",backup_status:$backup,dr_readiness:\"NOT_PROVEN\",lifecycle_status:\"OPEN\",vm_count:$vm_count,app_count:$app_count,fresh_count:$fresh,stale_count:$stale,resume_count:$resume,unverified_count:$unverified,cloud_ok_count:$cloud_ok,scheduler_ok_count:$scheduler_ok,source_ok_count:$source_ok,source_drift_count:$source_drift,payload_leaks:$payload_leaks,control_status:$control,control_source_coverage:\"NOT_MACHINE_PROVEN\",staging_status:$staging,staging_bad_count:$staging_bad,staging_warn_count:$staging_warn,staging_node_count:3,escrow_status:$escrow,retention_status:$retention,historical_gc_proven:$historical,owner_aware_gc_proven:$owner_gc,provider_worm_proven:false,provider_worm_skipped_by_policy:true,clean_machine_bootstrap_proven:false,qemu_boot_restore_proven:false,full_site_dr_proven:false}' >\"$tmp\"","HEAD:tasks/backup-control-refresh-post-legacy-retirement-v1/assets/runtime/homelab-backup-audit:398:lifecycle_status=OPEN","HEAD:tasks/backup-control-refresh-post-legacy-retirement-v1/assets/runtime/homelab-backup-audit:399:if [[ -s \"$SITE_DR_SEAL\" && ! -L \"$SITE_DR_SEAL\" ]] && [[ \"$(sha256sum \"$SITE_DR_SEAL\" | awk '{print $1}')\" == \"$SITE_DR_SEAL_SHA\" ]] && jq -e '.status==\"SEALED\" and .change_id==\"DR-2026-FINAL\" and .full_site_dr_proven==true and .qemu_boot_restore_proven==true and .ct_boot_restore_proven==true and .provider_worm_proven==false and .provider_worm_skipped_by_policy==true' \"$SITE_DR_SEAL\" >/dev/null; then dr_proof_status=PROVEN; global_dr_proven=YES; lifecycle_status=CLOSED_PROVEN; fi","HEAD:tasks/backup-control-refresh-post-legacy-retirement-v1/assets/runtime/homelab-backup-audit:408:printf 'SUMMARY|AUDIT_STATUS=OK|BACKUP_STATUS=%s|DR_PROOF_STATUS=%s|CONTROL_FRESHNESS=%s|LIFECYCLE_STATUS=%s|VM_COUNT=%s|APP_COUNT=%s|FRESH=%s|STALE=%s|RESUME=%s|UNVERIFIED=%s|CONTROL_STATE=%s|CLOUD_OK=%s|SCHEDULER_OK=%s|SOURCE_OK=%s|SOURCE_DRIFT=%s|STAGING_BAD=%s|STAGING_WARN=%s|PAYLOAD_LEAKS=%s|RETENTION_STATUS=%s|GLOBAL_DR_PROVEN=%s\\n' \"$backup_status\" \"$dr_proof_status\" \"$control_status\" \"$lifecycle_status\" \"$vm_seen\" \"$app_seen\" \"$fresh\" \"$stale\" \"$resume\" \"$unverified\" \"$control_status\" \"$cloud_ok\" \"$scheduler_ok\" \"$source_ok\" \"$source_drift\" \"$staging_bad\" \"$staging_warn\" \"$payload_leaks\" \"$retention_status\" \"$global_dr_proven\"","HEAD:tasks/backup-control-refresh-post-legacy-retirement-v1/assets/runtime/homelab-backup-audit:413:  jq -n --arg task \"$TASK_ID\" --arg change \"$CHANGE_ID\" --arg at \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\" --arg backup \"$backup_status\" --arg control \"$control_status\" --arg dr \"$dr_proof_status\" --arg lifecycle \"$lifecycle_status\" --arg escrow \"$escrow_status\" --arg staging \"$staging_status\" --arg retention \"$retention_status\" --argjson historical \"$historical_gc_proven\" --argjson owner_gc \"$owner_aware_gc_proven\" --argjson staging_bad \"$staging_bad\" --argjson staging_warn \"$staging_warn\" --argjson vm_count \"$vm_seen\" --argjson app_count \"$app_seen\" --argjson fresh \"$fresh\" --argjson stale \"$stale\" --argjson resume \"$resume\" --argjson unverified \"$unverified\" --argjson cloud_ok \"$cloud_ok\" --argjson scheduler_ok \"$scheduler_ok\" --argjson source_ok \"$source_ok\" --argjson source_drift \"$source_drift\" --argjson payload_leaks \"$payload_leaks\" '{schema:\"homelab-backup-unified-audit-v1\",task_id:$task,change_id:$change,updated_at_utc:$at,audit_status:\"OK\",backup_status:$backup,dr_readiness:$dr,dr_proof_status:$dr,control_freshness:$control,lifecycle_status:$lifecycle,vm_count:$vm_count,app_count:$app_count,fresh_count:$fresh,stale_count:$stale,resume_count:$resume,unverified_count:$unverified,cloud_ok_count:$cloud_ok,scheduler_ok_count:$scheduler_ok,source_ok_count:$source_ok,source_drift_count:$source_drift,payload_leaks:$payload_leaks,control_status:$control,control_source_coverage:\"NOT_MACHINE_PROVEN\",staging_status:$staging,staging_bad_count:$staging_bad,staging_warn_count:$staging_warn,staging_node_count:3,escrow_status:$escrow,retention_status:$retention,historical_gc_proven:$historical,owner_aware_gc_proven:$owner_gc,provider_worm_proven:false,provider_worm_skipped_by_policy:true,clean_machine_bootstrap_proven:($dr==\"PROVEN\"),qemu_boot_restore_proven:($dr==\"PROVEN\"),ct_boot_restore_proven:($dr==\"PROVEN\"),full_site_dr_proven:($dr==\"PROVEN\")}' >\"$tmp\"","HEAD:tasks/backup-control-refresh-post-legacy-retirement-v1/assets/runtime/homelab-backup-retention-gc:39:    vm130|vm190|vm200) printf 'pve03\\n' ;;","HEAD:tasks/backup-control-refresh-post-legacy-retirement-v1/task.json:178:    \"source_fingerprint_pinned_across_lifecycle\": true,","HEAD:tasks/backup-control-refresh-post-legacy-retirement-v1/task.json:179:    \"source_head_dynamic_at_lifecycle\": true,","HEAD:tasks/backup-control-refresh-post-legacy-retirement-v1/tools/test_contract.py:10:assert t['source_of_truth']['desired_head']=='fe76fd13eb164ebb09706074edaf1185e0d347b0' and t['source_of_truth']['source_fingerprint_pinned_across_lifecycle'] is True","HEAD:tasks/backup-control-refresh-v1/assets/runtime/homelab-backup-audit:398:lifecycle_status=OPEN","HEAD:tasks/backup-control-refresh-v1/assets/runtime/homelab-backup-audit:399:if [[ -s \"$SITE_DR_SEAL\" && ! -L \"$SITE_DR_SEAL\" ]] && [[ \"$(sha256sum \"$SITE_DR_SEAL\" | awk '{print $1}')\" == \"$SITE_DR_SEAL_SHA\" ]] && jq -e '.status==\"SEALED\" and .change_id==\"DR-2026-FINAL\" and .full_site_dr_proven==true and .qemu_boot_restore_proven==true and .ct_boot_restore_proven==true and .provider_worm_proven==false and .provider_worm_skipped_by_policy==true' \"$SITE_DR_SEAL\" >/dev/null; then dr_proof_status=PROVEN; global_dr_proven=YES; lifecycle_status=CLOSED_PROVEN; fi","HEAD:tasks/backup-control-refresh-v1/assets/runtime/homelab-backup-audit:408:printf 'SUMMARY|AUDIT_STATUS=OK|BACKUP_STATUS=%s|DR_PROOF_STATUS=%s|CONTROL_FRESHNESS=%s|LIFECYCLE_STATUS=%s|VM_COUNT=%s|APP_COUNT=%s|FRESH=%s|STALE=%s|RESUME=%s|UNVERIFIED=%s|CONTROL_STATE=%s|CLOUD_OK=%s|SCHEDULER_OK=%s|SOURCE_OK=%s|SOURCE_DRIFT=%s|STAGING_BAD=%s|STAGING_WARN=%s|PAYLOAD_LEAKS=%s|RETENTION_STATUS=%s|GLOBAL_DR_PROVEN=%s\\n' \"$backup_status\" \"$dr_proof_status\" \"$control_status\" \"$lifecycle_status\" \"$vm_seen\" \"$app_seen\" \"$fresh\" \"$stale\" \"$resume\" \"$unverified\" \"$control_status\" \"$cloud_ok\" \"$scheduler_ok\" \"$source_ok\" \"$source_drift\" \"$staging_bad\" \"$staging_warn\" \"$payload_leaks\" \"$retention_status\" \"$global_dr_proven\"","HEAD:tasks/backup-control-refresh-v1/assets/runtime/homelab-backup-audit:413:  jq -n --arg task \"$TASK_ID\" --arg change \"$CHANGE_ID\" --arg at \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\" --arg backup \"$backup_status\" --arg control \"$control_status\" --arg dr \"$dr_proof_status\" --arg lifecycle \"$lifecycle_status\" --arg escrow \"$escrow_status\" --arg staging \"$staging_status\" --arg retention \"$retention_status\" --argjson historical \"$historical_gc_proven\" --argjson owner_gc \"$owner_aware_gc_proven\" --argjson staging_bad \"$staging_bad\" --argjson staging_warn \"$staging_warn\" --argjson vm_count \"$vm_seen\" --argjson app_count \"$app_seen\" --argjson fresh \"$fresh\" --argjson stale \"$stale\" --argjson resume \"$resume\" --argjson unverified \"$unverified\" --argjson cloud_ok \"$cloud_ok\" --argjson scheduler_ok \"$scheduler_ok\" --argjson source_ok \"$source_ok\" --argjson source_drift \"$source_drift\" --argjson payload_leaks \"$payload_leaks\" '{schema:\"homelab-backup-unified-audit-v1\",task_id:$task,change_id:$change,updated_at_utc:$at,audit_status:\"OK\",backup_status:$backup,dr_readiness:$dr,dr_proof_status:$dr,control_freshness:$control,lifecycle_status:$lifecycle,vm_count:$vm_count,app_count:$app_count,fresh_count:$fresh,stale_count:$stale,resume_count:$resume,unverified_count:$unverified,cloud_ok_count:$cloud_ok,scheduler_ok_count:$scheduler_ok,source_ok_count:$source_ok,source_drift_count:$source_drift,payload_leaks:$payload_leaks,control_status:$control,control_source_coverage:\"NOT_MACHINE_PROVEN\",staging_status:$staging,staging_bad_count:$staging_bad,staging_warn_count:$staging_warn,staging_node_count:3,escrow_status:$escrow,retention_status:$retention,historical_gc_proven:$historical,owner_aware_gc_proven:$owner_gc,provider_worm_proven:false,provider_worm_skipped_by_policy:true,clean_machine_bootstrap_proven:($dr==\"PROVEN\"),qemu_boot_restore_proven:($dr==\"PROVEN\"),ct_boot_restore_proven:($dr==\"PROVEN\"),full_site_dr_proven:($dr==\"PROVEN\")}' >\"$tmp\"","HEAD:tasks/backup-control-refresh-v1/assets/runtime/homelab-backup-retention-gc:39:    vm130|vm190|vm200) printf 'pve03\\n' ;;","HEAD:tasks/backup-control-refresh-v1/task.json:171:    \"source_head_dynamic_at_lifecycle\": true,","HEAD:tasks/backup-gfs-retention-v1/assets/approved-diffs/homelab-backup-retention-gc.diff:4:+GFS_HELPER=\"${HOMELAB_BACKUP_GFS_POLICY_HELPER:-/usr/local/libexec/homelab-backup-gfs-policy}\"","HEAD:tasks/backup-gfs-retention-v1/assets/approved-diffs/homelab-backup-retention-gc.diff:6:+GFS_POLICY=\"${HOMELAB_BACKUP_GFS_POLICY:-/etc/homelab-backup/gfs-retention.json}\"","HEAD:tasks/backup-gfs-retention-v1/assets/approved-diffs/homelab-backup-retention-gc.diff:13:+GFS_CRITICAL_COUNT=\"$(HOMELAB_BACKUP_GFS_POLICY=\"$GFS_POLICY\" \"$GFS_HELPER\" critical-logicals | wc -l)\"","HEAD:tasks/backup-gfs-retention-v1/assets/approved-diffs/homelab-backup-retention-gc.diff:41:-  local now logical node keep lifecycle open_count file json schema lid gen status sha sealed_at epoch age idx candidates=0 protected=0 kept=0","HEAD:tasks/backup-gfs-retention-v1/assets/approved-diffs/homelab-backup-retention-gc.diff:42:+  local now logical node keep lifecycle open_count file json schema lid gen status sha sealed_at epoch age idx tx gfs_bucket candidates=0 protected=0 kept=0 gfs_kept=0","HEAD:tasks/backup-gfs-retention-v1/assets/approved-diffs/homelab-backup-retention-gc.diff:60:+  jq -n --arg task \"$TASK_ID\" --arg change \"$CHANGE_ID\" --arg at \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\" --argjson canary \"$canary_proven\" --argjson hist \"$hist\" --argjson candidates \"${candidates:-0}\" --argjson protected \"${protected:-0}\" --argjson kept \"${kept:-0}\" --argjson gfs_kept \"${gfs_kept:-0}\" --argjson deleted \"$deleted\" --argjson gfs_critical \"$GFS_CRITICAL_COUNT\" --argjson gfs_weekly \"$GFS_WEEKLY\" --argjson gfs_monthly \"$GFS_MONTHLY\" '{schema:\"homelab-backup-retention-v1\",status:\"OK\",task_id:$task,change_id:$change,updated_at_utc:$at,policy:{vm_keep:2,app_keep:7,control_keep:4,min_delete_age_seconds:86400,gfs:{enabled:true,critical_vm_count:$gfs_critical,weekly_completed_buckets:$gfs_weekly,monthly_completed_buckets:$gfs_monthly,completed_periods_only:true}},owner_aware_gc_proven:true,destructive_canary_proven:$canary,historical_gc_proven:$hist,last_plan:{delete_candidates:$candidates,protected:$protected,kept:$kept,gfs_kept:$gfs_kept},last_run_deleted:$deleted,legacy_namespaces_protected:[\"hb\",\"pve01\",\"control-bootstrap\"],provider_worm_proven:false}' >\"$tmp\"","HEAD:tasks/backup-gfs-retention-v1/assets/gfs-retention.json:6:  \"critical_vm_logicals\": [","HEAD:tasks/backup-gfs-retention-v1/assets/gfs-retention.json:15:    \"vm200\"","HEAD:tasks/backup-gfs-retention-v1/assets/gfs-retention.json:17:  \"monthly_buckets\": 6,","HEAD:tasks/backup-gfs-retention-v1/assets/gfs-retention.json:19:  \"schema\": \"homelab-backup-gfs-policy-v1\",","HEAD:tasks/backup-gfs-retention-v1/assets/gfs-retention.json:20:  \"weekly_buckets\": 4","HEAD:tasks/backup-gfs-retention-v1/assets/homelab-backup-gfs-policy:3:CFG=pathlib.Path(os.environ.get(\"HOMELAB_BACKUP_GFS_POLICY\",\"/etc/homelab-backup/gfs-retention.json\"))","HEAD:tasks/backup-gfs-retention-v1/assets/homelab-backup-gfs-policy:10:    if c.get(\"schema\")!=\"homelab-backup-gfs-policy-v1\" or c.get(\"policy_version\")!=1: die(\"SCHEMA_INVALID\",66)","HEAD:tasks/backup-gfs-retention-v1/assets/homelab-backup-gfs-policy:11:    if c.get(\"completed_periods_only\") is not True or c.get(\"weekly_buckets\")!=4 or c.get(\"monthly_buckets\")!=6 or c.get(\"capacity_guard_max_free_fraction_milli\")!=500 or c.get(\"capacity_guard_target_max_age_seconds\")!=172800 or c.get(\"capacity_guard_cloud_max_age_seconds\")!=14400: die(\"POLICY_INVALID\",66)","HEAD:tasks/backup-gfs-retention-v1/assets/homelab-backup-gfs-policy:12:    crit=c.get(\"critical_vm_logicals\")","HEAD:tasks/backup-gfs-retention-v1/assets/homelab-backup-gfs-policy:17:        if not rec or rec.get(\"kind\")!=\"VM\" or rec.get(\"lifecycle\")!=\"ACTIVE\": die(f\"CRITICAL_NOT_ACTIVE_VM_{logical}\",66)","HEAD:tasks/backup-gfs-retention-v1/assets/homelab-backup-gfs-policy:30:    if logical not in c[\"critical_vm_logicals\"]: return","HEAD:tasks/backup-gfs-retention-v1/assets/homelab-backup-gfs-policy:39:        if wb!=cur_week and len(weekly)<c[\"weekly_buckets\"] and wb not in seen_w:","HEAD:tasks/backup-gfs-retention-v1/assets/homelab-backup-gfs-policy:41:        if mb!=cur_month and len(monthly)<c[\"monthly_buckets\"] and mb not in seen_m:","HEAD:tasks/backup-gfs-retention-v1/assets/homelab-backup-gfs-policy:43:        if len(weekly)>=c[\"weekly_buckets\"] and len(monthly)>=c[\"monthly_buckets\"]: break","HEAD:tasks/backup-gfs-retention-v1/assets/homelab-backup-gfs-policy:49:    if args==[\"critical-logicals\"]:","HEAD:tasks/backup-gfs-retention-v1/assets/homelab-backup-gfs-policy:50:        print(\"\\n\".join(c[\"critical_vm_logicals\"])); return","HEAD:tasks/backup-gfs-retention-v1/assets/homelab-backup-gfs-policy:51:    if args==[\"weekly-buckets\"]: print(c[\"weekly_buckets\"]); return","HEAD:tasks/backup-gfs-retention-v1/assets/homelab-backup-gfs-policy:52:    if args==[\"monthly-buckets\"]: print(c[\"monthly_buckets\"]); return","HEAD:tasks/backup-gfs-retention-v1/assets/homelab-backup-gfs-policy:54:    if len(args)==2 and args[0]==\"is-critical\": raise SystemExit(0 if args[1] in c[\"critical_vm_logicals\"] else 1)","HEAD:tasks/backup-gfs-retention-v1/assets/homelab-backup-retention-gc:23:GFS_HELPER=\"${HOMELAB_BACKUP_GFS_POLICY_HELPER:-/usr/local/libexec/homelab-backup-gfs-policy}\"","HEAD:tasks/backup-gfs-retention-v1/assets/homelab-backup-retention-gc:25:GFS_POLICY=\"${HOMELAB_BACKUP_GFS_POLICY:-/etc/homelab-backup/gfs-retention.json}\"","HEAD:tasks/backup-gfs-retention-v1/assets/homelab-backup-retention-gc:35:GFS_CRITICAL_COUNT=\"$(HOMELAB_BACKUP_GFS_POLICY=\"$GFS_POLICY\" \"$GFS_HELPER\" critical-logicals | wc -l)\"","HEAD:tasks/backup-gfs-retention-v1/assets/homelab-backup-retention-gc:240:  local now logical node keep lifecycle open_count file json schema lid gen status sha sealed_at epoch age idx tx gfs_bucket candidates=0 protected=0 kept=0 gfs_kept=0","HEAD:tasks/backup-gfs-retention-v1/assets/homelab-backup-retention-gc:245:    lifecycle=\"$(\"$REGISTRY_HELPER\" lifecycle \"$logical\")\" || die \"LIFECYCLE_UNKNOWN_$logical\"","HEAD:tasks/backup-gfs-retention-v1/assets/homelab-backup-retention-gc:246:    if [[ \"$lifecycle\" == ACTIVE ]]; then keep=\"$(keep_for \"$logical\")\" || die \"KEEP_POLICY_UNKNOWN_$logical\"; else keep=0; fi","HEAD:tasks/backup-gfs-retention-v1/assets/homelab-backup-retention-gc:276:    if [[ \"$lifecycle\" == RETIRED_PRESERVE ]]; then","HEAD:tasks/backup-gfs-retention-v1/assets/homelab-backup-retention-gc:277:      while IFS=$'\\t' read -r gen file sha age node sealed_at; do printf 'KEEP|logical=%s|generation=%s|owner=%s|reason=RETIRED_PRESERVE\\n' \"$logical\" \"$gen\" \"$node\"; kept=$((kept+1)); done < <(LC_ALL=C sort -r \"$TMPROOT/$logical.rows\")","HEAD:tasks/backup-gfs-retention-v1/assets/homelab-backup-retention-gc:418:  jq -n --arg task \"$TASK_ID\" --arg change \"$CHANGE_ID\" --arg at \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\" --argjson canary \"$canary_proven\" --argjson hist \"$hist\" --argjson candidates \"${candidates:-0}\" --argjson protected \"${protected:-0}\" --argjson kept \"${kept:-0}\" --argjson gfs_kept \"${gfs_kept:-0}\" --argjson deleted \"$deleted\" --argjson gfs_critical \"$GFS_CRITICAL_COUNT\" --argjson gfs_weekly \"$GFS_WEEKLY\" --argjson gfs_monthly \"$GFS_MONTHLY\" '{schema:\"homelab-backup-retention-v1\",status:\"OK\",task_id:$task,change_id:$change,updated_at_utc:$at,policy:{vm_keep:2,app_keep:7,control_keep:4,min_delete_age_seconds:86400,gfs:{enabled:true,critical_vm_count:$gfs_critical,weekly_completed_buckets:$gfs_weekly,monthly_completed_buckets:$gfs_monthly,completed_periods_only:true}},owner_aware_gc_proven:true,destructive_canary_proven:$canary,historical_gc_proven:$hist,last_plan:{delete_candidates:$candidates,protected:$protected,kept:$kept,gfs_kept:$gfs_kept},last_run_deleted:$deleted,legacy_namespaces_protected:[\"hb\",\"pve01\",\"control-bootstrap\"],provider_worm_proven:false}' >\"$tmp\"","HEAD:tasks/backup-gfs-retention-v1/phases/seal.sh:9:tmp=\"${SEAL}.new.$$\"; install -d -m 0755 \"$(dirname \"$SEAL\")\"; jq -n --arg head \"$HEAD\" '{status:\"SEALED\",change_id:\"CR-2026-0072\",task_id:\"backup-gfs-retention-v1\",source_head:$head,gfs_enabled:true,critical_vm_count:9,weekly_completed_buckets:4,monthly_completed_buckets:6,completed_periods_only:true,capacity_guard:true,capacity_basis:\"RECENT_MAX_PER_TARGET\",capacity_target_max_age_seconds:172800,capacity_cloud_max_age_seconds:14400,new_delete_candidates:false,retention_scheduled:false,cloud_writes:false,cloud_deletes:false,systemd_changed:false}' >\"$tmp\"; chmod 0644 \"$tmp\"; chown root:root \"$tmp\"; mv -f -- \"$tmp\" \"$SEAL\"; jq -n --arg sha \"$(sha256sum \"$SEAL\"|awk '{print $1}')\" '{status:\"OK\",seal_sha256:$sha}' >\"$HOMELAB_RUN_DIR/seal.json\"; printf 'SEAL_STATUS=OK|CR0072=SEALED|TASK_SEAL_SHA256=%s\\n' \"$(sha256sum \"$SEAL\"|awk '{print $1}')\"","HEAD:tasks/backup-gfs-retention-v1/phases/verify.sh:8:jq -n '{status:\"OK\",root_cause_count:0,gfs_active:true,critical_vm_count:9,weekly_completed_buckets:4,monthly_completed_buckets:6,completed_periods_only:true,retention_scheduled:false,cloud_writes:false}' >\"$HOMELAB_RUN_DIR/verify.json\"","HEAD:tasks/backup-gfs-retention-v1/task.json:39:      \"path\": \"/var/lib/homelab-admin/seals/backup-gfs-retention-v1.json\",","HEAD:tasks/backup-gfs-retention-v1/task.json:48:    \"/mnt/staging/homelab-admin-rollback/backup-gfs-retention-v1\",","HEAD:tasks/backup-gfs-retention-v1/task.json:49:    \"/etc/homelab-backup/gfs-retention.json\",","HEAD:tasks/backup-gfs-retention-v1/task.json:50:    \"/usr/local/libexec/homelab-backup-gfs-policy\",","HEAD:tasks/backup-gfs-retention-v1/task.json:52:    \"/var/lib/homelab-admin/seals/backup-gfs-retention-v1.json\"","HEAD:tasks/backup-gfs-retention-v1/task.json:75:    \"assets/homelab-backup-gfs-policy\",","HEAD:tasks/backup-gfs-retention-v1/task.json:86:    \"/var/lib/homelab-admin/seals/backup-target-lifecycle-registry-v1.json\",","HEAD:tasks/backup-gfs-retention-v1/task.json:91:    \"command\": \"HOMELAB_CONTROLLED_APPLY_CONFIRM=backup-gfs-retention-v1 /opt/homelab-admin/bin/homelab-admin run TASK_DIR rollback\",","HEAD:tasks/backup-gfs-retention-v1/task.json:125:    \"critical_vm_count\": 9,","HEAD:tasks/backup-gfs-retention-v1/task.json:137:  \"task_id\": \"backup-gfs-retention-v1\",","HEAD:tasks/backup-gfs-retention-v1/task.json:149:    \"/mnt/staging/homelab-admin-rollback/backup-gfs-retention-v1\",","HEAD:tasks/backup-gfs-retention-v1/task.json:150:    \"/etc/homelab-backup/gfs-retention.json\",","HEAD:tasks/backup-gfs-retention-v1/task.json:151:    \"/usr/local/libexec/homelab-backup-gfs-policy\",","HEAD:tasks/backup-gfs-retention-v1/task.json:153:    \"/var/lib/homelab-admin/seals/backup-gfs-retention-v1.json\"","HEAD:tasks/backup-gfs-retention-v1/tools/capacity_guard.py:44:    req={\"weekly_buckets\":4,\"monthly_buckets\":6,\"capacity_guard_max_free_fraction_milli\":500,\"capacity_guard_target_max_age_seconds\":172800,\"capacity_guard_cloud_max_age_seconds\":14400}","HEAD:tasks/backup-gfs-retention-v1/tools/capacity_guard.py:46:    crit=p.get(\"critical_vm_logicals\")","HEAD:tasks/backup-gfs-retention-v1/tools/capacity_guard.py:67:    total=sum(chosen[x] for x in crit); buckets=p[\"weekly_buckets\"]+p[\"monthly_buckets\"]; extra=total*buckets; frac=p[\"capacity_guard_max_free_fraction_milli\"]","HEAD:tasks/backup-gfs-retention-v1/tools/runtime-lib.sh:3:TASK_ID=backup-gfs-retention-v1","HEAD:tasks/backup-gfs-retention-v1/tools/runtime-lib.sh:8:GFS_HELPER=/usr/local/libexec/homelab-backup-gfs-policy","HEAD:tasks/backup-gfs-retention-v1/tools/runtime-lib.sh:9:GFS_POLICY=/etc/homelab-backup/gfs-retention.json","HEAD:tasks/backup-gfs-retention-v1/tools/runtime-lib.sh:15:TASK_LOCK=/run/lock/homelab-backup-gfs-retention-cr0072.lock","HEAD:tasks/backup-gfs-retention-v1/tools/runtime-lib.sh:21:CR0070_SEAL=/var/lib/homelab-admin/seals/backup-target-lifecycle-registry-v1.json","HEAD:tasks/backup-gfs-retention-v1/tools/runtime-lib.sh:36:assert_source_clean(){ local r; r=\"$(cd \"$HOMELAB_TASK_DIR/../..\" && pwd -P)\"; [[ \"$(git -C \"$r\" branch --show-current)\" == cr-2026-0072-gfs-retention ]] || die SOURCE_BRANCH_INVALID 66; [[ -z \"$(git -C \"$r\" status --porcelain=v1 --untracked-files=all)\" ]] || die SOURCE_WORKTREE_DIRTY 66; }","HEAD:tasks/backup-gfs-retention-v1/tools/runtime-lib.sh:40:assert_assets(){ assert_regular \"$HOMELAB_TASK_DIR/assets/homelab-backup-retention-gc\"; [[ \"$(sha \"$HOMELAB_TASK_DIR/assets/homelab-backup-retention-gc\")\" == \"$NEW_RETENTION_SHA\" ]] || die RETENTION_ASSET_SHA_DRIFT; bash -n \"$HOMELAB_TASK_DIR/assets/homelab-backup-retention-gc\"; assert_regular \"$HOMELAB_TASK_DIR/assets/homelab-backup-gfs-policy\"; [[ \"$(sha \"$HOMELAB_TASK_DIR/assets/homelab-backup-gfs-policy\")\" == \"$GFS_HELPER_SHA\" ]] || die GFS_HELPER_ASSET_SHA_DRIFT; python3 -B -c 'import pathlib; compile(pathlib.Path(\"'\"$HOMELAB_TASK_DIR/assets/homelab-backup-gfs-policy\"'\").read_text(),\"gfs\",\"exec\")'; assert_regular \"$HOMELAB_TASK_DIR/assets/gfs-retention.json\"; [[ \"$(sha \"$HOMELAB_TASK_DIR/assets/gfs-retention.json\")\" == \"$GFS_POLICY_SHA\" ]] || die GFS_POLICY_ASSET_SHA_DRIFT; HOMELAB_BACKUP_GFS_POLICY=\"$HOMELAB_TASK_DIR/assets/gfs-retention.json\" HOMELAB_BACKUP_TARGET_REGISTRY=\"$REGISTRY\" \"$HOMELAB_TASK_DIR/assets/homelab-backup-gfs-policy\" validate >/dev/null || die GFS_POLICY_ASSET_INVALID; assert_regular \"$CAPACITY_TOOL\"; [[ \"$(sha \"$CAPACITY_TOOL\")\" == \"$CAPACITY_TOOL_SHA\" ]] || die CAPACITY_TOOL_SHA_DRIFT; python3 -B -c 'import pathlib; compile(pathlib.Path(\"'\"$CAPACITY_TOOL\"'\").read_text(),\"capacity\",\"exec\")'; }","HEAD:tasks/backup-gfs-retention-v1/tools/runtime-lib.sh:46:candidate_plan(){ local out=\"$1\"; HOMELAB_BACKUP_GFS_POLICY_HELPER=\"$HOMELAB_TASK_DIR/assets/homelab-backup-gfs-policy\" HOMELAB_BACKUP_GFS_POLICY=\"$HOMELAB_TASK_DIR/assets/gfs-retention.json\" \"$HOMELAB_TASK_DIR/assets/homelab-backup-retention-gc\" plan >\"$out\"; }","HEAD:tasks/backup-gfs-retention-v1/tools/runtime-lib.sh:48:assert_capacity_guard(){ local stage=\"${1:-CHECK}\" out code; assert_regular \"$OBS_HISTORY\"; if out=\"$(PYTHONDONTWRITEBYTECODE=1 python3 -B \"$CAPACITY_TOOL\" \"$OBS_HISTORY\" \"$HOMELAB_TASK_DIR/assets/gfs-retention.json\" 2>&1)\"; then printf '%s|stage=%s\\n' \"$out\" \"$stage\"; else code=\"$(awk -F= '$1==\"GFS_CAPACITY_GUARD_ERROR\"{print $2}' <<<\"$out\" | tail -n 1)\"; [[ -n \"$code\" ]] || code=GFS_CAPACITY_GUARD_TOOL_FAILED; die \"$code\" 66; fi; }","HEAD:tasks/backup-gfs-retention-v1/tools/runtime-lib.sh:53:install_candidates(){ install -d -m 0755 /etc/homelab-backup; install_one \"$HOMELAB_TASK_DIR/assets/gfs-retention.json\" \"$GFS_POLICY\" 0644; install_one \"$HOMELAB_TASK_DIR/assets/homelab-backup-gfs-policy\" \"$GFS_HELPER\" 0755; install_one \"$HOMELAB_TASK_DIR/assets/homelab-backup-retention-gc\" \"$RETENTION\" 0750; }","HEAD:tasks/backup-gfs-retention-v1/tools/test_contract.py:6:assert task['task_id']=='backup-gfs-retention-v1' and task['source_of_truth']['change_id']=='CR-2026-0072'","HEAD:tasks/backup-gfs-retention-v1/tools/test_contract.py:7:pol=json.loads((T/'assets/gfs-retention.json').read_text())","HEAD:tasks/backup-gfs-retention-v1/tools/test_contract.py:8:assert pol['weekly_buckets']==4 and pol['monthly_buckets']==6 and pol['completed_periods_only'] is True","HEAD:tasks/backup-gfs-retention-v1/tools/test_contract.py:9:assert len(pol['critical_vm_logicals'])==9 and pol['capacity_guard_max_free_fraction_milli']==500","HEAD:tasks/backup-gfs-retention-v1/tools/test_contract.py:14:assert 'REMOTE_SET_MISMATCH' in ret and 'LOCKED_PRE_RESUME' in ret and 'LOCKED_POST_RESUME' in ret and 'RETIRED_PRESERVE' in ret","HEAD:tasks/backup-gfs-retention-v1/tools/test_contract.py:24:helper_sha=sha(T/'assets/homelab-backup-gfs-policy')","HEAD:tasks/backup-gfs-retention-v1/tools/test_contract.py:25:policy_sha=sha(T/'assets/gfs-retention.json')","HEAD:tasks/backup-observability-risk-forecast-v1/assets/approved-diffs/homelab-backup-audit.diff:81:-printf 'SUMMARY|AUDIT_STATUS=OK|BACKUP_STATUS=%s|DR_PROOF_STATUS=%s|CONTROL_FRESHNESS=%s|LIFECYCLE_STATUS=%s|VM_COUNT=%s|APP_COUNT=%s|FRESH=%s|STALE=%s|RESUME=%s|UNVERIFIED=%s|CONTROL_STATE=%s|CLOUD_OK=%s|SCHEDULER_OK=%s|SOURCE_OK=%s|SOURCE_DRIFT=%s|STAGING_BAD=%s|STAGING_WARN=%s|PAYLOAD_LEAKS=%s|RETENTION_STATUS=%s|GLOBAL_DR_PROVEN=%s\\n' \"$backup_status\" \"$dr_proof_status\" \"$control_status\" \"$lifecycle_status\" \"$vm_seen\" \"$app_seen\" \"$fresh\" \"$stale\" \"$resume\" \"$unverified\" \"$control_status\" \"$cloud_ok\" \"$scheduler_ok\" \"$source_ok\" \"$source_drift\" \"$staging_bad\" \"$staging_warn\" \"$payload_leaks\" \"$retention_status\" \"$global_dr_proven\"","HEAD:tasks/backup-observability-risk-forecast-v1/assets/approved-diffs/homelab-backup-audit.diff:102:+printf 'SUMMARY|AUDIT_STATUS=OK|BACKUP_STATUS=%s|RISK_SEVERITY=%s|RISK_REASONS=%s|DR_PROOF_STATUS=%s|CONTROL_FRESHNESS=%s|LIFECYCLE_STATUS=%s|VM_COUNT=%s|APP_COUNT=%s|FRESH=%s|STALE=%s|RESUME=%s|UNVERIFIED=%s|CONTROL_STATE=%s|CLOUD_OK=%s|SCHEDULER_OK=%s|SOURCE_OK=%s|SOURCE_DRIFT=%s|STAGING_BAD=%s|STAGING_WARN=%s|PAYLOAD_LEAKS=%s|RETENTION_STATUS=%s|OBSERVABILITY=%s|SIZE_ANOMALIES=%s|CAPACITY=%s|GLOBAL_DR_PROVEN=%s\\n' \"$backup_status\" \"$risk_severity\" \"$risk_reasons\" \"$dr_proof_status\" \"$control_status\" \"$lifecycle_status\" \"$vm_seen\" \"$app_seen\" \"$fresh\" \"$stale\" \"$resume\" \"$unverified\" \"$control_status\" \"$cloud_ok\" \"$scheduler_ok\" \"$source_ok\" \"$source_drift\" \"$staging_bad\" \"$staging_warn\" \"$payload_leaks\" \"$retention_status\" \"$observability_status\" \"$size_anomaly_count\" \"$capacity_status\" \"$global_dr_proven\"","HEAD:tasks/backup-observability-risk-forecast-v1/assets/approved-diffs/homelab-backup-audit.diff:104:-  jq -n --arg task \"$TASK_ID\" --arg change \"$CHANGE_ID\" --arg at \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\" --arg backup \"$backup_status\" --arg control \"$control_status\" --arg dr \"$dr_proof_status\" --arg lifecycle \"$lifecycle_status\" --arg escrow \"$escrow_status\" --arg staging \"$staging_status\" --arg retention \"$retention_status\" --argjson historical \"$historical_gc_proven\" --argjson owner_gc \"$owner_aware_gc_proven\" --argjson staging_bad \"$staging_bad\" --argjson staging_warn \"$staging_warn\" --argjson vm_count \"$vm_seen\" --argjson app_count \"$app_seen\" --argjson fresh \"$fresh\" --argjson stale \"$stale\" --argjson resume \"$resume\" --argjson unverified \"$unverified\" --argjson cloud_ok \"$cloud_ok\" --argjson scheduler_ok \"$scheduler_ok\" --argjson source_ok \"$source_ok\" --argjson source_drift \"$source_drift\" --argjson payload_leaks \"$payload_leaks\" '{schema:\"homelab-backup-unified-audit-v1\",task_id:$task,change_id:$change,updated_at_utc:$at,audit_status:\"OK\",backup_status:$backup,dr_readiness:$dr,dr_proof_status:$dr,control_freshness:$control,lifecycle_status:$lifecycle,vm_count:$vm_count,app_count:$app_count,fresh_count:$fresh,stale_count:$stale,resume_count:$resume,unverified_count:$unverified,cloud_ok_count:$cloud_ok,scheduler_ok_count:$scheduler_ok,source_ok_count:$source_ok,source_drift_count:$source_drift,payload_leaks:$payload_leaks,control_status:$control,control_source_coverage:\"NOT_MACHINE_PROVEN\",staging_status:$staging,staging_bad_count:$staging_bad,staging_warn_count:$staging_warn,staging_node_count:3,escrow_status:$escrow,retention_status:$retention,historical_gc_proven:$historical,owner_aware_gc_proven:$owner_gc,provider_worm_proven:false,provider_worm_skipped_by_policy:true,clean_machine_bootstrap_proven:($dr==\"PROVEN\"),qemu_boot_restore_proven:($dr==\"PROVEN\"),ct_boot_restore_proven:($dr==\"PROVEN\"),full_site_dr_proven:($dr==\"PROVEN\")}' >\"$tmp\"","HEAD:tasks/backup-observability-risk-forecast-v1/assets/approved-diffs/homelab-backup-audit.diff:105:+  jq -n --arg task \"$TASK_ID\" --arg change \"$CHANGE_ID\" --arg at \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\" --arg backup \"$backup_status\" --arg risk \"$risk_severity\" --arg reasons \"$risk_reasons\" --arg control \"$control_status\" --arg dr \"$dr_proof_status\" --arg lifecycle \"$lifecycle_status\" --arg escrow \"$escrow_status\" --arg staging \"$staging_status\" --arg retention \"$retention_status\" --arg observability \"$observability_status\" --arg capacity \"$capacity_status\" --argjson historical \"$historical_gc_proven\" --argjson owner_gc \"$owner_aware_gc_proven\" --argjson staging_bad \"$staging_bad\" --argjson staging_warn \"$staging_warn\" --argjson vm_count \"$vm_seen\" --argjson app_count \"$app_seen\" --argjson fresh \"$fresh\" --argjson stale \"$stale\" --argjson resume \"$resume\" --argjson unverified \"$unverified\" --argjson cloud_ok \"$cloud_ok\" --argjson scheduler_ok \"$scheduler_ok\" --argjson source_ok \"$source_ok\" --argjson source_drift \"$source_drift\" --argjson payload_leaks \"$payload_leaks\" --argjson size_anomaly_count \"$size_anomaly_count\" --argjson size_learning_count \"$size_learning_count\" --argjson worst_used \"$capacity_worst_used_percent\" --argjson worst_days80 \"$capacity_worst_days_to_80\" --argjson history_count \"$history_snapshot_count\" '{schema:\"homelab-backup-unified-audit-v1\",task_id:$task,change_id:$change,updated_at_utc:$at,audit_status:\"OK\",backup_status:$backup,risk_severity:$risk,risk_reasons:(if $reasons==\"NONE\" then [] else ($reasons|split(\",\")) end),dr_readiness:$dr,dr_proof_status:$dr,control_freshness:$control,lifecycle_status:$lifecycle,vm_count:$vm_count,app_count:$app_count,fresh_count:$fresh,stale_count:$stale,resume_count:$resume,unverified_count:$unverified,cloud_ok_count:$cloud_ok,scheduler_ok_count:$scheduler_ok,source_ok_count:$source_ok,source_drift_count:$source_drift,payload_leaks:$payload_leaks,control_status:$control,control_source_coverage:\"NOT_MACHINE_PROVEN\",staging_status:$staging,staging_bad_count:$staging_bad,staging_warn_count:$staging_warn,staging_node_count:3,escrow_status:$escrow,retention_status:$retention,historical_gc_proven:$historical,owner_aware_gc_proven:$owner_gc,observability_status:$observability,size_anomaly_count:$size_anomaly_count,size_learning_count:$size_learning_count,capacity_status:$capacity,capacity_worst_used_percent:$worst_used,capacity_worst_days_to_80:$worst_days80,observability_history_snapshot_count:$history_count,provider_worm_proven:false,provider_worm_skipped_by_policy:true,clean_machine_bootstrap_proven:($dr==\"PROVEN\"),qemu_boot_restore_proven:($dr==\"PROVEN\"),ct_boot_restore_proven:($dr==\"PROVEN\"),full_site_dr_proven:($dr==\"PROVEN\")}' >\"$tmp\"","HEAD:tasks/backup-observability-risk-forecast-v1/assets/homelab-backup-audit:457:lifecycle_status=OPEN","HEAD:tasks/backup-observability-risk-forecast-v1/assets/homelab-backup-audit:458:if [[ -s \"$SITE_DR_SEAL\" && ! -L \"$SITE_DR_SEAL\" ]] && [[ \"$(sha256sum \"$SITE_DR_SEAL\" | awk '{print $1}')\" == \"$SITE_DR_SEAL_SHA\" ]] && jq -e '.status==\"SEALED\" and .change_id==\"DR-2026-FINAL\" and .full_site_dr_proven==true and .qemu_boot_restore_proven==true and .ct_boot_restore_proven==true and .provider_worm_proven==false and .provider_worm_skipped_by_policy==true' \"$SITE_DR_SEAL\" >/dev/null; then dr_proof_status=PROVEN; global_dr_proven=YES; lifecycle_status=CLOSED_PROVEN; fi","HEAD:tasks/backup-observability-risk-forecast-v1/assets/homelab-backup-audit:487:printf 'SUMMARY|AUDIT_STATUS=OK|BACKUP_STATUS=%s|RISK_SEVERITY=%s|RISK_REASONS=%s|DR_PROOF_STATUS=%s|CONTROL_FRESHNESS=%s|LIFECYCLE_STATUS=%s|VM_COUNT=%s|APP_COUNT=%s|FRESH=%s|STALE=%s|RESUME=%s|UNVERIFIED=%s|CONTROL_STATE=%s|CLOUD_OK=%s|SCHEDULER_OK=%s|SOURCE_OK=%s|SOURCE_DRIFT=%s|STAGING_BAD=%s|STAGING_WARN=%s|PAYLOAD_LEAKS=%s|RETENTION_STATUS=%s|OBSERVABILITY=%s|SIZE_ANOMALIES=%s|CAPACITY=%s|GLOBAL_DR_PROVEN=%s\\n' \"$backup_status\" \"$risk_severity\" \"$risk_reasons\" \"$dr_proof_status\" \"$control_status\" \"$lifecycle_status\" \"$vm_seen\" \"$app_seen\" \"$fresh\" \"$stale\" \"$resume\" \"$unverified\" \"$control_status\" \"$cloud_ok\" \"$scheduler_ok\" \"$source_ok\" \"$source_drift\" \"$staging_bad\" \"$staging_warn\" \"$payload_leaks\" \"$retention_status\" \"$observability_status\" \"$size_anomaly_count\" \"$capacity_status\" \"$global_dr_proven\"","HEAD:tasks/backup-observability-risk-forecast-v1/assets/homelab-backup-audit:492:  jq -n --arg task \"$TASK_ID\" --arg change \"$CHANGE_ID\" --arg at \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\" --arg backup \"$backup_status\" --arg risk \"$risk_severity\" --arg reasons \"$risk_reasons\" --arg control \"$control_status\" --arg dr \"$dr_proof_status\" --arg lifecycle \"$lifecycle_status\" --arg escrow \"$escrow_status\" --arg staging \"$staging_status\" --arg retention \"$retention_status\" --arg observability \"$observability_status\" --arg capacity \"$capacity_status\" --argjson historical \"$historical_gc_proven\" --argjson owner_gc \"$owner_aware_gc_proven\" --argjson staging_bad \"$staging_bad\" --argjson staging_warn \"$staging_warn\" --argjson vm_count \"$vm_seen\" --argjson app_count \"$app_seen\" --argjson fresh \"$fresh\" --argjson stale \"$stale\" --argjson resume \"$resume\" --argjson unverified \"$unverified\" --argjson cloud_ok \"$cloud_ok\" --argjson scheduler_ok \"$scheduler_ok\" --argjson source_ok \"$source_ok\" --argjson source_drift \"$source_drift\" --argjson payload_leaks \"$payload_leaks\" --argjson size_anomaly_count \"$size_anomaly_count\" --argjson size_learning_count \"$size_learning_count\" --argjson worst_used \"$capacity_worst_used_percent\" --argjson worst_days80 \"$capacity_worst_days_to_80\" --argjson history_count \"$history_snapshot_count\" '{schema:\"homelab-backup-unified-audit-v1\",task_id:$task,change_id:$change,updated_at_utc:$at,audit_status:\"OK\",backup_status:$backup,risk_severity:$risk,risk_reasons:(if $reasons==\"NONE\" then [] else ($reasons|split(\",\")) end),dr_readiness:$dr,dr_proof_status:$dr,control_freshness:$control,lifecycle_status:$lifecycle,vm_count:$vm_count,app_count:$app_count,fresh_count:$fresh,stale_count:$stale,resume_count:$resume,unverified_count:$unverified,cloud_ok_count:$cloud_ok,scheduler_ok_count:$scheduler_ok,source_ok_count:$source_ok,source_drift_count:$source_drift,payload_leaks:$payload_leaks,control_status:$control,control_source_coverage:\"NOT_MACHINE_PROVEN\",staging_status:$staging,staging_bad_count:$staging_bad,staging_warn_count:$staging_warn,staging_node_count:3,escrow_status:$escrow,retention_status:$retention,historical_gc_proven:$historical,owner_aware_gc_proven:$owner_gc,observability_status:$observability,size_anomaly_count:$size_anomaly_count,size_learning_count:$size_learning_count,capacity_status:$capacity,capacity_worst_used_percent:$worst_used,capacity_worst_days_to_80:$worst_days80,observability_history_snapshot_count:$history_count,provider_worm_proven:false,provider_worm_skipped_by_policy:true,clean_machine_bootstrap_proven:($dr==\"PROVEN\"),qemu_boot_restore_proven:($dr==\"PROVEN\"),ct_boot_restore_proven:($dr==\"PROVEN\"),full_site_dr_proven:($dr==\"PROVEN\")}' >\"$tmp\"","HEAD:tasks/backup-observability-risk-forecast-v1/task.json:17:    \"/var/lib/homelab-admin/seals/backup-target-lifecycle-registry-v1.json\",","HEAD:tasks/backup-observability-risk-forecast-v1/tools/runtime-lib.sh:21:CR0070_SEAL=/var/lib/homelab-admin/seals/backup-target-lifecycle-registry-v1.json","HEAD:tasks/backup-retention-dynamic-pinned-prune-mailru-cleanup-v1/assets/orchestrator:120:  case \"$logical\" in vm110|vm112|vm150|vm170|vm171) owner=pve01;; vm111|vm113|vm160|vm180|vm9130) owner=pve02;; vm130|vm190|vm200) owner=pve03;; *) fail \"TX_LOGICAL_UNEXPECTED_$logical\";; esac","HEAD:tasks/backup-retention-dynamic-pinned-prune-mailru-cleanup-v1/task.json:108:      \"compile\": \"bash -n phases/assets; homelab-admin lint/validate; Python contract test; fake lifecycle harness\"","HEAD:tasks/backup-retention-pinned-scheduled-scope-hotfix-v1/assets/homelab-backup-retention-gc:39:    vm130|vm190|vm200) printf 'pve03\\n' ;;","HEAD:tasks/backup-retention-pinned-scheduled-scope-hotfix-v1/task.json:53:      \"verification\": \"candidate plan read-only plus synthetic pinned-scope lifecycle tests; no scheduled/canary\"","HEAD:tasks/backup-retention-pinned-scheduled-scope-hotfix-v1/task.json:93:    \"no scheduled or canary action is invoked by this hotfix lifecycle\",","HEAD:tasks/backup-retention-pinned-scheduled-scope-hotfix-v1/task.json:94:    \"transaction journal remains empty throughout hotfix lifecycle\",","HEAD:tasks/backup-retention-pinned-scheduled-scope-hotfix-v1/task.json:103:    \"reason\": \"eliminate pre-scheduled TOCTOU by validating exact pinned delete/transaction lifecycle before lock, under backup locks before resume, and after resume before deletion\",","HEAD:tasks/backup-retention-plan-stability-hotfix-v1/assets/homelab-backup-retention-gc:39:    vm130|vm190|vm200) printf 'pve03\\n' ;;","HEAD:tasks/backup-retention-plan-stability-hotfix-v1/tools/runtime-lib.sh:20:assert_plan(){ local p=\"$1\"; [[ -s \"$p\" && ! -L \"$p\" ]] || die PLAN_MISSING; grep -Fq 'CONTRACT|task=backup-retention-safe-gc-v1|policy=OWNER_AWARE_SAFE_GC' \"$p\" || die PLAN_CONTRACT_MISSING; grep -Eq '^KEEP\\|logical=vm200\\|generation=vm200-pve03-[0-9]{8}T[0-9]{6}Z\\|owner=pve03\\|reason=POLICY_NEWEST_2$' \"$p\" || die PLAN_VM200_KEEP_MISSING; awk -F'[=|]' '/^DELETE\\|/{l=\"\"; for(i=1;i<=NF;i++)if($i==\"logical\")l=$(i+1); if(l!~/^vm[0-9]+$/)bad=1} END{exit bad}' \"$p\" || die NON_VM_DELETE_CANDIDATE; }","HEAD:tasks/backup-retention-remote-list-failclosed-hotfix-v1/assets/homelab-backup-retention-gc:39:    vm130|vm190|vm200) printf 'pve03\\n' ;;","HEAD:tasks/backup-retention-remote-stdin-hotfix-v1/assets/homelab-backup-retention-gc:38:    vm130|vm190|vm200) printf 'pve03\\n' ;;","HEAD:tasks/backup-retention-remote-stdin-hotfix-v1/phases/apply.sh:31:  jq -e '.status==\"OK\" and .root_cause_count==0 and .runtime_replaced==true and .new_sha==\"d5e70fca273e67ec272ea44f73558e28fb707902a09e96497a5fb7cecf4e3336\" and .vm200_planned==true and .gc_started==false and .cloud_writes==false' \"$FAILED/apply.json\" >/dev/null || die FAILED_APPLY_EVIDENCE_INVALID","HEAD:tasks/backup-retention-remote-stdin-hotfix-v1/phases/apply.sh:38:jq -n --argjson resumed \"$resumed\" '{status:\"OK\",root_cause_count:0,production_changed:true,runtime_replaced:true,resumed_existing_runtime:$resumed,recovered_failed_apply_run:(if $resumed then \"20260812T054054Z-1692543-apply\" else null end),old_sha:\"7a6f51f4fb360b31b53dcdd16a296670ae35bdad45a3ef8ff5ebd09d3982d518\",new_sha:\"d5e70fca273e67ec272ea44f73558e28fb707902a09e96497a5fb7cecf4e3336\",vm200_planned:true,gc_started:false,cloud_writes:false}' > \"$HOMELAB_RUN_DIR/apply.json\"","HEAD:tasks/backup-retention-remote-stdin-hotfix-v1/phases/dry-run.sh:13:jq -n '{status:\"OK\",root_cause_count:0,production_changed:false,candidate_plan_complete:true,vm200_planned:true,cloud_reads:true,cloud_writes:false,gc_started:false}' > \"$HOMELAB_RUN_DIR/dry-run.json\"","HEAD:tasks/backup-retention-remote-stdin-hotfix-v1/phases/seal.sh:9:jq -e '.status==\"OK\" and .runtime_verified==true and .remote_logicals_visible==true and .vm200_keep_verified==true and .gc_started==false and .cloud_writes==false' \"$V\" >/dev/null || die VERIFY_EVIDENCE_INVALID","HEAD:tasks/backup-retention-remote-stdin-hotfix-v1/phases/seal.sh:10:mkdir -p \"$(dirname \"$SEAL\")\"; tmp=\"${SEAL}.new.$$\"; jq -n --arg task \"$TASK_ID\" --arg change \"$CHANGE_ID\" --arg at \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\" --arg sha \"$NEW_SHA\" '{status:\"SEALED\",task_id:$task,change_id:$change,sealed_at_utc:$at,runtime_sha256:$sha,remote_stdin_isolated:true,vm200_retention_plan_proven:true,gc_executed:false,cloud_writes:false}' > \"$tmp\"; chmod 0644 \"$tmp\"; mv -f -- \"$tmp\" \"$SEAL\"; SS=\"$(sha \"$SEAL\")\"; jq -n --arg status OK --arg seal \"$SEAL\" --arg sha \"$SS\" '{status:$status,root_cause_count:0,production_changed:true,task_seal:$seal,task_seal_sha256:$sha,cloud_writes:false,gc_started:false}' > \"$HOMELAB_RUN_DIR/seal.json\"; echo \"SEAL_STATUS=OK|RETENTION_STDIN_ISOLATED=YES|VM200_PLAN_PROVEN=YES|GC_STARTED=NO|TASK_SEAL_SHA256=$SS\"","HEAD:tasks/backup-retention-remote-stdin-hotfix-v1/phases/verify.sh:11:test ! -e /var/lib/homelab-backup/retention-safe-gc/transactions/vm200","HEAD:tasks/backup-retention-remote-stdin-hotfix-v1/phases/verify.sh:12:jq -n '{status:\"OK\",root_cause_count:0,production_changed:true,runtime_verified:true,remote_logicals_visible:true,vm200_keep_verified:true,gc_started:false,cloud_writes:false}' > \"$HOMELAB_RUN_DIR/verify.json\"","HEAD:tasks/backup-retention-remote-stdin-hotfix-v1/task.json:49:      \"verification\": \"candidate read-only plan includes remote-owned vm200\"","HEAD:tasks/backup-retention-remote-stdin-hotfix-v1/task.json:59:      \"verification\": \"new runtime plan includes remote-owned VMs and vm200 is retained\"","HEAD:tasks/backup-retention-remote-stdin-hotfix-v1/task.json:101:    \"failure_evidence\": \"CR0035 verify plan stopped after first vm111 state and omitted vm200\",","HEAD:tasks/backup-retention-remote-stdin-hotfix-v1/task.json:102:    \"proof_requirement\": \"candidate and installed plan must contain remote-owned vm200 as POLICY_NEWEST_2 while GC remains unexecuted\",","HEAD:tasks/backup-retention-remote-stdin-hotfix-v1/tools/runtime-lib.sh:17:assert_plan(){ local p=\"$1\"; [[ -s \"$p\" && ! -L \"$p\" ]] || die PLAN_MISSING; grep -Fq 'CONTRACT|task=backup-retention-safe-gc-v1|policy=OWNER_AWARE_SAFE_GC' \"$p\" || die PLAN_CONTRACT_MISSING; for l in vm111 vm113 vm130 vm160 vm180 vm190 vm9130 vm200; do awk -v l=\"$l\" -F'|' '$1==\"KEEP\" || $1==\"PROTECT\" || $1==\"DELETE\" || $1==\"RETIRED\" {for(i=1;i<=NF;i++) if($i==\"logical=\" l){found=1}} END{exit !found}' \"$p\" || die \"PLAN_REMOTE_LOGICAL_MISSING_${l}\"; done; grep -Eq '^KEEP\\|logical=vm200\\|generation=vm200-pve03-[0-9]{8}T[0-9]{6}Z\\|owner=pve03\\|reason=POLICY_NEWEST_2$' \"$p\" || die PLAN_VM200_KEEP_MISSING; }","HEAD:tasks/backup-retention-remote-stdin-hotfix-v1/tools/test_contract.py:8:assert \"vm130|vm190|vm200) printf 'pve03\\\\n' ;;\" in asset","HEAD:tasks/backup-retention-safe-gc-v1/assets/homelab-backup-audit:407:  jq -n --arg task \"$TASK_ID\" --arg change \"$CHANGE_ID\" --arg at \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\" --arg backup \"$backup_status\" --arg control \"$control_status\" --arg escrow \"$escrow_status\" --arg staging \"$staging_status\" --arg retention \"$retention_status\" --argjson historical \"$historical_gc_proven\" --argjson owner_gc \"$owner_aware_gc_proven\" --argjson staging_bad \"$staging_bad\" --argjson staging_warn \"$staging_warn\" --argjson vm_count \"$vm_seen\" --argjson app_count \"$app_seen\" --argjson fresh \"$fresh\" --argjson stale \"$stale\" --argjson resume \"$resume\" --argjson unverified \"$unverified\" --argjson cloud_ok \"$cloud_ok\" --argjson scheduler_ok \"$scheduler_ok\" --argjson source_ok \"$source_ok\" --argjson source_drift \"$source_drift\" --argjson payload_leaks \"$payload_leaks\" '{schema:\"homelab-backup-unified-audit-v1\",task_id:$task,change_id:$change,updated_at_utc:$at,audit_status:\"OK\",backup_status:$backup,dr_readiness:\"NOT_PROVEN\",lifecycle_status:\"OPEN\",vm_count:$vm_count,app_count:$app_count,fresh_count:$fresh,stale_count:$stale,resume_count:$resume,unverified_count:$unverified,cloud_ok_count:$cloud_ok,scheduler_ok_count:$scheduler_ok,source_ok_count:$source_ok,source_drift_count:$source_drift,payload_leaks:$payload_leaks,control_status:$control,control_source_coverage:\"NOT_MACHINE_PROVEN\",staging_status:$staging,staging_bad_count:$staging_bad,staging_warn_count:$staging_warn,staging_node_count:3,escrow_status:$escrow,retention_status:$retention,historical_gc_proven:$historical,owner_aware_gc_proven:$owner_gc,provider_worm_proven:false,provider_worm_skipped_by_policy:true,clean_machine_bootstrap_proven:false,qemu_boot_restore_proven:false,full_site_dr_proven:false}' >\"$tmp\"","HEAD:tasks/backup-retention-transaction-resume-hotfix-v1/assets/homelab-backup-retention-gc:39:    vm130|vm190|vm200) printf 'pve03\\n' ;;","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/approved-diffs/homelab-backup-retention-gc.diff:24:-    vm130|vm190|vm200) printf 'pve03\\n' ;;","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/approved-diffs/homelab-backup-retention-gc.diff:51:+  local now logical node keep lifecycle open_count file json schema lid gen status sha sealed_at epoch age idx candidates=0 protected=0 kept=0","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/approved-diffs/homelab-backup-retention-gc.diff:54:+    lifecycle=\"$(\"$REGISTRY_HELPER\" lifecycle \"$logical\")\" || die \"LIFECYCLE_UNKNOWN_$logical\"","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/approved-diffs/homelab-backup-retention-gc.diff:55:+    if [[ \"$lifecycle\" == ACTIVE ]]; then keep=\"$(keep_for \"$logical\")\" || die \"KEEP_POLICY_UNKNOWN_$logical\"; else keep=0; fi","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/approved-diffs/homelab-backup-retention-gc.diff:59:+    if [[ \"$lifecycle\" == RETIRED_PRESERVE ]]; then","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/approved-diffs/homelab-backup-retention-gc.diff:60:+      while IFS=$'\\t' read -r gen file sha age node sealed_at; do printf 'KEEP|logical=%s|generation=%s|owner=%s|reason=RETIRED_PRESERVE\\n' \"$logical\" \"$gen\" \"$node\"; kept=$((kept+1)); done < <(LC_ALL=C sort -r \"$TMPROOT/$logical.rows\")","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/backup-target-registry.json:9:    {\"kind\":\"VM\",\"id\":\"110\",\"logical_id\":\"vm110\",\"owner\":\"pve01\",\"lifecycle\":\"ACTIVE\"},","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/backup-target-registry.json:10:    {\"kind\":\"VM\",\"id\":\"111\",\"logical_id\":\"vm111\",\"owner\":\"pve02\",\"lifecycle\":\"ACTIVE\"},","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/backup-target-registry.json:11:    {\"kind\":\"VM\",\"id\":\"112\",\"logical_id\":\"vm112\",\"owner\":\"pve01\",\"lifecycle\":\"ACTIVE\"},","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/backup-target-registry.json:12:    {\"kind\":\"VM\",\"id\":\"113\",\"logical_id\":\"vm113\",\"owner\":\"pve02\",\"lifecycle\":\"ACTIVE\"},","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/backup-target-registry.json:13:    {\"kind\":\"VM\",\"id\":\"130\",\"logical_id\":\"vm130\",\"owner\":\"pve03\",\"lifecycle\":\"ACTIVE\"},","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/backup-target-registry.json:14:    {\"kind\":\"VM\",\"id\":\"150\",\"logical_id\":\"vm150\",\"owner\":\"pve01\",\"lifecycle\":\"ACTIVE\"},","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/backup-target-registry.json:15:    {\"kind\":\"VM\",\"id\":\"160\",\"logical_id\":\"vm160\",\"owner\":\"pve02\",\"lifecycle\":\"ACTIVE\"},","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/backup-target-registry.json:16:    {\"kind\":\"VM\",\"id\":\"170\",\"logical_id\":\"vm170\",\"owner\":\"pve01\",\"lifecycle\":\"ACTIVE\"},","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/backup-target-registry.json:17:    {\"kind\":\"VM\",\"id\":\"171\",\"logical_id\":\"vm171\",\"owner\":\"pve01\",\"lifecycle\":\"ACTIVE\"},","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/backup-target-registry.json:18:    {\"kind\":\"VM\",\"id\":\"180\",\"logical_id\":\"vm180\",\"owner\":\"pve02\",\"lifecycle\":\"ACTIVE\"},","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/backup-target-registry.json:19:    {\"kind\":\"VM\",\"id\":\"190\",\"logical_id\":\"vm190\",\"owner\":\"pve03\",\"lifecycle\":\"ACTIVE\"},","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/backup-target-registry.json:20:    {\"kind\":\"VM\",\"id\":\"9130\",\"logical_id\":\"vm9130\",\"owner\":\"pve02\",\"lifecycle\":\"ACTIVE\"},","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/backup-target-registry.json:21:    {\"kind\":\"VM\",\"id\":\"200\",\"logical_id\":\"vm200\",\"owner\":\"pve03\",\"lifecycle\":\"ACTIVE\"},","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/backup-target-registry.json:22:    {\"kind\":\"APP\",\"id\":\"memos\",\"logical_id\":\"app-memos\",\"owner\":\"pve01\",\"source_host\":\"[PRIVATE_IP]\",\"lifecycle\":\"ACTIVE\",\"migrate\":false},","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/backup-target-registry.json:23:    {\"kind\":\"APP\",\"id\":\"filebrowser\",\"logical_id\":\"app-filebrowser\",\"owner\":\"pve01\",\"source_host\":\"[PRIVATE_IP]\",\"lifecycle\":\"ACTIVE\",\"migrate\":true},","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/backup-target-registry.json:24:    {\"kind\":\"APP\",\"id\":\"skladchik-reports-monitor\",\"logical_id\":\"app-skladchik-reports-monitor\",\"owner\":\"pve01\",\"source_host\":\"[PRIVATE_IP]\",\"lifecycle\":\"ACTIVE\",\"migrate\":true},","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/backup-target-registry.json:25:    {\"kind\":\"APP\",\"id\":\"immich\",\"logical_id\":\"app-immich\",\"owner\":\"pve01\",\"source_host\":\"[PRIVATE_IP]\",\"lifecycle\":\"ACTIVE\",\"migrate\":true},","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/backup-target-registry.json:26:    {\"kind\":\"APP\",\"id\":\"hbarhub\",\"logical_id\":\"app-hbarhub\",\"owner\":\"pve01\",\"source_host\":\"[PRIVATE_IP]\",\"lifecycle\":\"ACTIVE\",\"migrate\":true},","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/backup-target-registry.json:27:    {\"kind\":\"APP\",\"id\":\"scrutiny\",\"logical_id\":\"app-scrutiny\",\"owner\":\"pve01\",\"source_host\":\"pve01\",\"lifecycle\":\"ACTIVE\",\"migrate\":true},","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/backup-target-registry.json:28:    {\"kind\":\"APP\",\"id\":\"skladchik-moderator-assistant\",\"logical_id\":\"app-skladchik-moderator-assistant\",\"owner\":\"pve01\",\"lifecycle\":\"RETIRED_PRESERVE\",\"migrate\":false},","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/backup-target-registry.json:29:    {\"kind\":\"CONTROL\",\"id\":\"control-bootstrap-v2\",\"logical_id\":\"control-bootstrap-v2\",\"owner\":\"pve01\",\"lifecycle\":\"ACTIVE\"}","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-audit:400:lifecycle_status=OPEN","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-audit:401:if [[ -s \"$SITE_DR_SEAL\" && ! -L \"$SITE_DR_SEAL\" ]] && [[ \"$(sha256sum \"$SITE_DR_SEAL\" | awk '{print $1}')\" == \"$SITE_DR_SEAL_SHA\" ]] && jq -e '.status==\"SEALED\" and .change_id==\"DR-2026-FINAL\" and .full_site_dr_proven==true and .qemu_boot_restore_proven==true and .ct_boot_restore_proven==true and .provider_worm_proven==false and .provider_worm_skipped_by_policy==true' \"$SITE_DR_SEAL\" >/dev/null; then dr_proof_status=PROVEN; global_dr_proven=YES; lifecycle_status=CLOSED_PROVEN; fi","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-audit:410:printf 'SUMMARY|AUDIT_STATUS=OK|BACKUP_STATUS=%s|DR_PROOF_STATUS=%s|CONTROL_FRESHNESS=%s|LIFECYCLE_STATUS=%s|VM_COUNT=%s|APP_COUNT=%s|FRESH=%s|STALE=%s|RESUME=%s|UNVERIFIED=%s|CONTROL_STATE=%s|CLOUD_OK=%s|SCHEDULER_OK=%s|SOURCE_OK=%s|SOURCE_DRIFT=%s|STAGING_BAD=%s|STAGING_WARN=%s|PAYLOAD_LEAKS=%s|RETENTION_STATUS=%s|GLOBAL_DR_PROVEN=%s\\n' \"$backup_status\" \"$dr_proof_status\" \"$control_status\" \"$lifecycle_status\" \"$vm_seen\" \"$app_seen\" \"$fresh\" \"$stale\" \"$resume\" \"$unverified\" \"$control_status\" \"$cloud_ok\" \"$scheduler_ok\" \"$source_ok\" \"$source_drift\" \"$staging_bad\" \"$staging_warn\" \"$payload_leaks\" \"$retention_status\" \"$global_dr_proven\"","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-audit:415:  jq -n --arg task \"$TASK_ID\" --arg change \"$CHANGE_ID\" --arg at \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\" --arg backup \"$backup_status\" --arg control \"$control_status\" --arg dr \"$dr_proof_status\" --arg lifecycle \"$lifecycle_status\" --arg escrow \"$escrow_status\" --arg staging \"$staging_status\" --arg retention \"$retention_status\" --argjson historical \"$historical_gc_proven\" --argjson owner_gc \"$owner_aware_gc_proven\" --argjson staging_bad \"$staging_bad\" --argjson staging_warn \"$staging_warn\" --argjson vm_count \"$vm_seen\" --argjson app_count \"$app_seen\" --argjson fresh \"$fresh\" --argjson stale \"$stale\" --argjson resume \"$resume\" --argjson unverified \"$unverified\" --argjson cloud_ok \"$cloud_ok\" --argjson scheduler_ok \"$scheduler_ok\" --argjson source_ok \"$source_ok\" --argjson source_drift \"$source_drift\" --argjson payload_leaks \"$payload_leaks\" '{schema:\"homelab-backup-unified-audit-v1\",task_id:$task,change_id:$change,updated_at_utc:$at,audit_status:\"OK\",backup_status:$backup,dr_readiness:$dr,dr_proof_status:$dr,control_freshness:$control,lifecycle_status:$lifecycle,vm_count:$vm_count,app_count:$app_count,fresh_count:$fresh,stale_count:$stale,resume_count:$resume,unverified_count:$unverified,cloud_ok_count:$cloud_ok,scheduler_ok_count:$scheduler_ok,source_ok_count:$source_ok,source_drift_count:$source_drift,payload_leaks:$payload_leaks,control_status:$control,control_source_coverage:\"NOT_MACHINE_PROVEN\",staging_status:$staging,staging_bad_count:$staging_bad,staging_warn_count:$staging_warn,staging_node_count:3,escrow_status:$escrow,retention_status:$retention,historical_gc_proven:$historical,owner_aware_gc_proven:$owner_gc,provider_worm_proven:false,provider_worm_skipped_by_policy:true,clean_machine_bootstrap_proven:($dr==\"PROVEN\"),qemu_boot_restore_proven:($dr==\"PROVEN\"),ct_boot_restore_proven:($dr==\"PROVEN\"),full_site_dr_proven:($dr==\"PROVEN\")}' >\"$tmp\"","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-retention-gc:208:  local now logical node keep lifecycle open_count file json schema lid gen status sha sealed_at epoch age idx candidates=0 protected=0 kept=0","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-retention-gc:213:    lifecycle=\"$(\"$REGISTRY_HELPER\" lifecycle \"$logical\")\" || die \"LIFECYCLE_UNKNOWN_$logical\"","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-retention-gc:214:    if [[ \"$lifecycle\" == ACTIVE ]]; then keep=\"$(keep_for \"$logical\")\" || die \"KEEP_POLICY_UNKNOWN_$logical\"; else keep=0; fi","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-retention-gc:244:    if [[ \"$lifecycle\" == RETIRED_PRESERVE ]]; then","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-retention-gc:245:      while IFS=$'\\t' read -r gen file sha age node sealed_at; do printf 'KEEP|logical=%s|generation=%s|owner=%s|reason=RETIRED_PRESERVE\\n' \"$logical\" \"$gen\" \"$node\"; kept=$((kept+1)); done < <(LC_ALL=C sort -r \"$TMPROOT/$logical.rows\")","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-target-registry:17:    ([.targets[]|select(.kind==\"VM\" and .lifecycle==\"ACTIVE\")]|length)==13 and","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-target-registry:18:    ([.targets[]|select(.kind==\"APP\" and .lifecycle==\"ACTIVE\")]|length)==6 and","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-target-registry:19:    ([.targets[]|select(.kind==\"APP\" and .lifecycle==\"RETIRED_PRESERVE\")]|length)==1 and","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-target-registry:20:    ([.targets[]|select(.kind==\"CONTROL\" and .lifecycle==\"ACTIVE\")]|length)==1 and","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-target-registry:21:    ([.targets[]|select((.kind!=\"VM\" and .kind!=\"APP\" and .kind!=\"CONTROL\") or (.lifecycle!=\"ACTIVE\" and .lifecycle!=\"RETIRED_PRESERVE\"))]|length)==0 and","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-target-registry:27:rows(){ validate; jq -r '.targets[]|[.kind,.id,.logical_id,.owner,.lifecycle,(.source_host//\"\"),((.migrate//false)|tostring)]|@tsv' \"$REGISTRY\"; }","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-target-registry:32:  active-vm-ids) [[ \"$#\" == 1 ]] || die USAGE 64; validate; jq -r '.targets[]|select(.kind==\"VM\" and .lifecycle==\"ACTIVE\")|.id' \"$REGISTRY\" ;;","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-target-registry:33:  active-app-ids) [[ \"$#\" == 1 ]] || die USAGE 64; validate; jq -r '.targets[]|select(.kind==\"APP\" and .lifecycle==\"ACTIVE\")|.id' \"$REGISTRY\" ;;","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-target-registry:34:  migrate-app-ids) [[ \"$#\" == 1 ]] || die USAGE 64; validate; jq -r '.targets[]|select(.kind==\"APP\" and .lifecycle==\"ACTIVE\" and .migrate==true)|.id' \"$REGISTRY\" ;;","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-target-registry:35:  app-active) [[ \"$#\" == 2 ]] || die USAGE 64; find_by_id APP \"$2\" | jq -e '.lifecycle==\"ACTIVE\"' >/dev/null ;;","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-target-registry:36:  app-logical) [[ \"$#\" == 2 ]] || die USAGE 64; find_by_id APP \"$2\" | jq -er 'select(.lifecycle==\"ACTIVE\")|.logical_id' ;;","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-target-registry:37:  app-source-host) [[ \"$#\" == 2 ]] || die USAGE 64; find_by_id APP \"$2\" | jq -er 'select(.lifecycle==\"ACTIVE\")|.source_host' ;;","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-target-registry:39:  lifecycle) [[ \"$#\" == 2 ]] || die USAGE 64; find_by_logical \"$2\" | jq -er '.lifecycle' ;;","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-target-registry:40:  retention-logicals) [[ \"$#\" == 1 ]] || die USAGE 64; validate; jq -r '.targets[]|select(.lifecycle==\"ACTIVE\" or .lifecycle==\"RETIRED_PRESERVE\")|.logical_id' \"$REGISTRY\" ;;","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-target-registry:41:  retention-keep) [[ \"$#\" == 2 ]] || die USAGE 64; rec=\"$(find_by_logical \"$2\")\"; life=\"$(jq -r '.lifecycle' <<<\"$rec\")\"; [[ \"$life\" == ACTIVE ]] || die RETENTION_KEEP_NOT_ACTIVE 64; kind=\"$(jq -r '.kind' <<<\"$rec\")\"; jq -er --arg k \"$kind\" '.policies.retention_keep[$k]' \"$REGISTRY\" ;;","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-target-registry:46:  *) die USAGE_validate_active-vm-ids_active-app-ids_migrate-app-ids_app-active_app-logical_app-source-host_logical-owner_lifecycle_retention-logicals_retention-keep_policy-keep_freshness-seconds_systemd-expectations_rows 64 ;;","HEAD:tasks/backup-target-lifecycle-registry-v1/phases/apply.sh:21:grep -q '^KEEP|logical=app-skladchik-moderator-assistant|.*reason=RETIRED_PRESERVE' \"$installed_plan\" || rollback_after_mutation RETIRED_PRESERVE_NOT_EXPLICIT 70","HEAD:tasks/backup-target-lifecycle-registry-v1/phases/apply.sh:24:printf 'APPLY_STATUS=OK|REGISTRY=INSTALLED|FILES=7|VM=13|APP=6|RETIRED_PRESERVE=1|GC_STARTED=NO|BACKUP_STARTED=NO\\n'","HEAD:tasks/backup-target-lifecycle-registry-v1/phases/dry-run.sh:12:printf 'DRY_RUN_STATUS=OK|VM=13|APP=6|RETIRED_PRESERVE=1|EXPECTED_ABSENT=5|DELETE_SET=UNCHANGED|PRODUCTION_CHANGED=NO\\n'","HEAD:tasks/backup-target-lifecycle-registry-v1/phases/preflight.sh:10:printf 'PREFLIGHT_STATUS=OK|PREIMAGES=5|REGISTRY=ABSENT|DELETE_SET=UNCHANGED|RETIRED_PRESERVE=YES|PRODUCTION_CHANGED=NO\\n'","HEAD:tasks/backup-target-lifecycle-registry-v1/phases/seal.sh:10:if [[ -e \"$SEAL\" ]]; then assert_regular \"$SEAL\"; jq -e --arg h \"$head\" '.status==\"SEALED\" and .change_id==\"CR-2026-0070\" and .task_id==\"backup-target-lifecycle-registry-v1\" and .source_head==$h and .active_vm_count==13 and .active_app_count==6 and .retired_preserve_count==1 and .expected_absent_timers==5 and .retention_delete_set_preserved==true and .systemd_changed==false' \"$SEAL\" >/dev/null || die EXISTING_SEAL_INVALID 75; else tmp=\"${SEAL}.new.$$\"; jq -n --arg h \"$head\" --arg at \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\" --arg registry \"$REGISTRY_SHA\" --arg helper \"$HELPER_SHA\" '{status:\"SEALED\",task_id:\"backup-target-lifecycle-registry-v1\",change_id:\"CR-2026-0070\",sealed_at_utc:$at,source_head:$h,production_changed:true,target_registry_schema:\"homelab-backup-target-registry-v1\",target_registry_sha256:$registry,target_registry_helper_sha256:$helper,active_vm_count:13,active_app_count:6,retired_preserve_count:1,expected_absent_timers:5,retention_delete_set_preserved:true,retired_target_delete_candidates:0,systemd_changed:false,backup_started:false,retention_gc_started:false,cloud_writes:false,rollback_after_seal_allowed:false}' >\"$tmp\"; chmod 0644 \"$tmp\"; mv -f \"$tmp\" \"$SEAL\"; fi","HEAD:tasks/backup-target-lifecycle-registry-v1/phases/verify.sh:9:plan=\"$HOMELAB_RUN_DIR/retention.plan\"; /usr/local/sbin/homelab-backup-retention-gc plan >\"$plan\"; ! grep '^DELETE|logical=app-skladchik-moderator-assistant|' \"$plan\" >/dev/null || die RETIRED_TARGET_DELETE_CANDIDATE; grep -q '^KEEP|logical=app-skladchik-moderator-assistant|.*reason=RETIRED_PRESERVE' \"$plan\" || die RETIRED_PRESERVE_NOT_EXPLICIT","HEAD:tasks/backup-target-lifecycle-registry-v1/task.json:3:  \"task_id\": \"backup-target-lifecycle-registry-v1\",","HEAD:tasks/backup-target-lifecycle-registry-v1/task.json:35:    \"/mnt/staging/homelab-admin-rollback/backup-target-lifecycle-registry-v1\",","HEAD:tasks/backup-target-lifecycle-registry-v1/task.json:43:    \"/var/lib/homelab-admin/seals/backup-target-lifecycle-registry-v1.json\"","HEAD:tasks/backup-target-lifecycle-registry-v1/task.json:46:    \"/mnt/staging/homelab-admin-rollback/backup-target-lifecycle-registry-v1\",","HEAD:tasks/backup-target-lifecycle-registry-v1/task.json:54:    \"/var/lib/homelab-admin/seals/backup-target-lifecycle-registry-v1.json\"","HEAD:tasks/backup-target-lifecycle-registry-v1/task.json:90:      \"verification\": \"CR0070 source identity and canonical lifecycle registry invariants\"","HEAD:tasks/backup-target-lifecycle-registry-v1/task.json:93:      \"path\": \"/var/lib/homelab-admin/seals/backup-target-lifecycle-registry-v1.json\",","HEAD:tasks/backup-target-lifecycle-registry-v1/task.json:116:    \"command\": \"HOMELAB_CONTROLLED_APPLY_CONFIRM=backup-target-lifecycle-registry-v1 /opt/homelab-admin/bin/homelab-admin run TASK_DIR rollback\",","HEAD:tasks/backup-target-lifecycle-registry-v1/tools/runtime-lib.sh:3:TASK_ID=backup-target-lifecycle-registry-v1","HEAD:tasks/backup-target-lifecycle-registry-v1/tools/runtime-lib.sh:16:TASK_LOCK=/run/lock/homelab-backup-target-lifecycle-registry.lock","HEAD:tasks/backup-target-lifecycle-registry-v1/tools/runtime-lib.sh:37:assert_source_clean(){ local r; r=\"$(cd \"$HOMELAB_TASK_DIR/../..\" && pwd -P)\"; [[ \"$(git -C \"$r\" branch --show-current)\" == cr-2026-0070-backup-target-lifecycle-registry ]] || die SOURCE_BRANCH_INVALID 66; [[ -z \"$(git -C \"$r\" status --porcelain=v1 --untracked-files=all)\" ]] || die SOURCE_WORKTREE_DIRTY 66; }","HEAD:tasks/backup-target-lifecycle-registry-v1/tools/runtime-lib.sh:51:compare_delete_sets(){ local dir oldp newp; dir=\"${1:-$HOMELAB_RUN_DIR}\"; oldp=\"$dir/retention-old.plan\"; newp=\"$dir/retention-candidate.plan\"; /usr/local/sbin/homelab-backup-retention-gc plan >\"$oldp\"; HOMELAB_BACKUP_TARGET_REGISTRY=\"$HOMELAB_TASK_DIR/assets/backup-target-registry.json\" HOMELAB_BACKUP_TARGET_REGISTRY_HELPER=\"$HOMELAB_TASK_DIR/assets/homelab-backup-target-registry\" \"$HOMELAB_TASK_DIR/assets/homelab-backup-retention-gc\" plan >\"$newp\"; cmp -s <(normalize_delete \"$oldp\") <(normalize_delete \"$newp\") || die RETENTION_DELETE_SET_CHANGED 66; ! grep '^DELETE|logical=app-skladchik-moderator-assistant|' \"$newp\" >/dev/null || die RETIRED_TARGET_DELETE_CANDIDATE 66; grep -q '^KEEP|logical=app-skladchik-moderator-assistant|.*reason=RETIRED_PRESERVE' \"$newp\" || die RETIRED_PRESERVE_NOT_EXPLICIT 66; }","HEAD:tasks/backup-target-lifecycle-registry-v1/tools/test_contract.py:6:assert task['schema_version']==2 and task['task_id']=='backup-target-lifecycle-registry-v1' and task['production_change'] is True","HEAD:tasks/backup-target-lifecycle-registry-v1/tools/test_contract.py:12:active_vm=[x for x in reg['targets'] if x['kind']=='VM' and x['lifecycle']=='ACTIVE']","HEAD:tasks/backup-target-lifecycle-registry-v1/tools/test_contract.py:13:active_app=[x for x in reg['targets'] if x['kind']=='APP' and x['lifecycle']=='ACTIVE']","HEAD:tasks/backup-target-lifecycle-registry-v1/tools/test_contract.py:14:retired=[x for x in reg['targets'] if x['lifecycle']=='RETIRED_PRESERVE']","HEAD:tasks/backup-target-lifecycle-registry-v1/tools/test_contract.py:24:assert subprocess.check_output([str(helper),'lifecycle','app-skladchik-moderator-assistant'],env=env,text=True).strip()=='RETIRED_PRESERVE'","HEAD:tasks/backup-target-lifecycle-registry-v1/tools/test_contract.py:37:assert 'reason=RETIRED_PRESERVE' in ret and 'retired_preserve=PROTECT' in ret","HEAD:tasks/backup-unified-monitoring-v1/README.md:5:The monitor separates execution health (`AUDIT_STATUS`), current backup data-plane state (`BACKUP_STATUS`), lifecycle gaps (`LIFECYCLE_STATUS`) and site-DR proof (`DR_READINESS`). It does not start backups, restore guests, mutate cloud objects, or claim retention/WORM/clean-machine/QEMU-boot/full-site-DR proof.","HEAD:tasks/backup-unified-monitoring-v1/assets/homelab-backup-audit:396:  jq -n --arg task \"$TASK_ID\" --arg change \"$CHANGE_ID\" --arg at \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\" --arg backup \"$backup_status\" --arg control \"$control_status\" --arg escrow \"$escrow_status\" --arg staging \"$staging_status\" --argjson staging_bad \"$staging_bad\" --argjson staging_warn \"$staging_warn\" --argjson vm_count \"$vm_seen\" --argjson app_count \"$app_seen\" --argjson fresh \"$fresh\" --argjson stale \"$stale\" --argjson resume \"$resume\" --argjson unverified \"$unverified\" --argjson cloud_ok \"$cloud_ok\" --argjson scheduler_ok \"$scheduler_ok\" --argjson source_ok \"$source_ok\" --argjson source_drift \"$source_drift\" --argjson payload_leaks \"$payload_leaks\" '{schema:\"homelab-backup-unified-audit-v1\",task_id:$task,change_id:$change,updated_at_utc:$at,audit_status:\"OK\",backup_status:$backup,dr_readiness:\"NOT_PROVEN\",lifecycle_status:\"OPEN\",vm_count:$vm_count,app_count:$app_count,fresh_count:$fresh,stale_count:$stale,resume_count:$resume,unverified_count:$unverified,cloud_ok_count:$cloud_ok,scheduler_ok_count:$scheduler_ok,source_ok_count:$source_ok,source_drift_count:$source_drift,payload_leaks:$payload_leaks,control_status:$control,control_source_coverage:\"NOT_MACHINE_PROVEN\",staging_status:$staging,staging_bad_count:$staging_bad,staging_warn_count:$staging_warn,staging_node_count:3,escrow_status:$escrow,retention_status:\"OPEN_NOT_IMPLEMENTED\",historical_gc_proven:false,provider_worm_proven:false,provider_worm_skipped_by_policy:true,clean_machine_bootstrap_proven:false,qemu_boot_restore_proven:false,full_site_dr_proven:false}' >\"$tmp\"","HEAD:tasks/gitea-execution-journal-v1/assets/bootstrap-history.json:31:      \"summary\": \"Probe CR lifecycle and anonymous private-repo visibility.\",","HEAD:tasks/gitea-execution-journal-v1/task.json:98:    \"verification\": \"rollback is only a pre-access contingency; once scoped access exists, lifecycle is monotonic resume/ensure; after seal rollback is forbidden\"","HEAD:tasks/homelab-safety-foundation-v1/task.json:63:    \"no Git fetch or push performed by lifecycle\"","HEAD:tasks/legacy-backup-target-retirement-v1/assets/homelab-backup-audit:398:lifecycle_status=OPEN","HEAD:tasks/legacy-backup-target-retirement-v1/assets/homelab-backup-audit:399:if [[ -s \"$SITE_DR_SEAL\" && ! -L \"$SITE_DR_SEAL\" ]] && [[ \"$(sha256sum \"$SITE_DR_SEAL\" | awk '{print $1}')\" == \"$SITE_DR_SEAL_SHA\" ]] && jq -e '.status==\"SEALED\" and .change_id==\"DR-2026-FINAL\" and .full_site_dr_proven==true and .qemu_boot_restore_proven==true and .ct_boot_restore_proven==true and .provider_worm_proven==false and .provider_worm_skipped_by_policy==true' \"$SITE_DR_SEAL\" >/dev/null; then dr_proof_status=PROVEN; global_dr_proven=YES; lifecycle_status=CLOSED_PROVEN; fi","HEAD:tasks/legacy-backup-target-retirement-v1/assets/homelab-backup-audit:408:printf 'SUMMARY|AUDIT_STATUS=OK|BACKUP_STATUS=%s|DR_PROOF_STATUS=%s|CONTROL_FRESHNESS=%s|LIFECYCLE_STATUS=%s|VM_COUNT=%s|APP_COUNT=%s|FRESH=%s|STALE=%s|RESUME=%s|UNVERIFIED=%s|CONTROL_STATE=%s|CLOUD_OK=%s|SCHEDULER_OK=%s|SOURCE_OK=%s|SOURCE_DRIFT=%s|STAGING_BAD=%s|STAGING_WARN=%s|PAYLOAD_LEAKS=%s|RETENTION_STATUS=%s|GLOBAL_DR_PROVEN=%s\\n' \"$backup_status\" \"$dr_proof_status\" \"$control_status\" \"$lifecycle_status\" \"$vm_seen\" \"$app_seen\" \"$fresh\" \"$stale\" \"$resume\" \"$unverified\" \"$control_status\" \"$cloud_ok\" \"$scheduler_ok\" \"$source_ok\" \"$source_drift\" \"$staging_bad\" \"$staging_warn\" \"$payload_leaks\" \"$retention_status\" \"$global_dr_proven\"","HEAD:tasks/legacy-backup-target-retirement-v1/assets/homelab-backup-audit:413:  jq -n --arg task \"$TASK_ID\" --arg change \"$CHANGE_ID\" --arg at \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\" --arg backup \"$backup_status\" --arg control \"$control_status\" --arg dr \"$dr_proof_status\" --arg lifecycle \"$lifecycle_status\" --arg escrow \"$escrow_status\" --arg staging \"$staging_status\" --arg retention \"$retention_status\" --argjson historical \"$historical_gc_proven\" --argjson owner_gc \"$owner_aware_gc_proven\" --argjson staging_bad \"$staging_bad\" --argjson staging_warn \"$staging_warn\" --argjson vm_count \"$vm_seen\" --argjson app_count \"$app_seen\" --argjson fresh \"$fresh\" --argjson stale \"$stale\" --argjson resume \"$resume\" --argjson unverified \"$unverified\" --argjson cloud_ok \"$cloud_ok\" --argjson scheduler_ok \"$scheduler_ok\" --argjson source_ok \"$source_ok\" --argjson source_drift \"$source_drift\" --argjson payload_leaks \"$payload_leaks\" '{schema:\"homelab-backup-unified-audit-v1\",task_id:$task,change_id:$change,updated_at_utc:$at,audit_status:\"OK\",backup_status:$backup,dr_readiness:$dr,dr_proof_status:$dr,control_freshness:$control,lifecycle_status:$lifecycle,vm_count:$vm_count,app_count:$app_count,fresh_count:$fresh,stale_count:$stale,resume_count:$resume,unverified_count:$unverified,cloud_ok_count:$cloud_ok,scheduler_ok_count:$scheduler_ok,source_ok_count:$source_ok,source_drift_count:$source_drift,payload_leaks:$payload_leaks,control_status:$control,control_source_coverage:\"NOT_MACHINE_PROVEN\",staging_status:$staging,staging_bad_count:$staging_bad,staging_warn_count:$staging_warn,staging_node_count:3,escrow_status:$escrow,retention_status:$retention,historical_gc_proven:$historical,owner_aware_gc_proven:$owner_gc,provider_worm_proven:false,provider_worm_skipped_by_policy:true,clean_machine_bootstrap_proven:($dr==\"PROVEN\"),qemu_boot_restore_proven:($dr==\"PROVEN\"),ct_boot_restore_proven:($dr==\"PROVEN\"),full_site_dr_proven:($dr==\"PROVEN\")}' >\"$tmp\"","HEAD:tasks/legacy-backup-target-retirement-v1/assets/homelab-backup-retention-gc:39:    vm130|vm190|vm200) printf 'pve03\\n' ;;","HEAD:tasks/legacy-backup-target-retirement-v1/tools/runtime-lib.sh:67:assert_ct200_proven(){ local owner out dec gen state ev sha_out remote_sha; resolve_ct200_owner; owner=\"$CT200_OWNER\"; sha_out=\"$(node_exec \"$owner\" sha256sum \"$VM_PROBE\")\" || die CT200_VM_PROBE_SHA_READ_FAILED 69; remote_sha=\"$(awk 'NR==1{print $1}' <<<\"$sha_out\")\"; [[ \"$remote_sha\" =~ ^[0-9a-f]{64}$ ]] || die CT200_VM_PROBE_SHA_FORMAT_INVALID 66; [[ \"$remote_sha\" == \"$VM_PROBE_SHA\" ]] || die CT200_VM_PROBE_SHA_DRIFT 66; out=\"$(node_exec \"$owner\" \"$VM_PROBE\" decision 200)\" || die CT200_FRESHNESS_PROBE_FAILED 69; dec=\"$(awk -F= '$1==\"DECISION\"{v=$2} END{print v}' <<<\"$out\")\"; gen=\"$(awk -F= '$1==\"GENERATION\"{v=$2} END{print v}' <<<\"$out\")\"; state=\"$(awk -F= '$1==\"STATE_FILE\"{v=$2} END{print v}' <<<\"$out\")\"; ev=\"$(awk -F= '$1==\"RESTORE_EVIDENCE\"{v=$2} END{print v}' <<<\"$out\")\"; [[ \"$dec\" == SEALED_PROVEN ]] || die CT200_NOT_SEALED_PROVEN 66; [[ \"$gen\" =~ ^vm200-${owner}-[0-9]{8}T[0-9]{6}Z$ ]] || die CT200_GENERATION_INVALID 66; [[ \"$state\" == \"/var/lib/homelab-backup/cloud-quorum/vm200/$gen.json\" ]] || die CT200_STATE_PATH_INVALID 66; [[ \"$ev\" == \"/var/lib/homelab-backup/vm-restore-validation/vm200/$gen.json\" ]] || die CT200_EVIDENCE_PATH_INVALID 66; node_exec \"$owner\" jq -e --arg l vm200 --arg g \"$gen\" --arg s \"$state\" '.schema==\"homelab-vm-restore-validation-v1\" and .logical_id==$l and .generation==$g and .transport_state==\"SEALED\" and .transport_state_file==$s and .restore_source==\"Cloud A\" and .parts_manifest_verified==true and .payload_sha256_verified==true and .payload_decompression_verified==true and .proxmox_config_extract_verified==true and .archive_recovery_readback_verified==true and .bounded_staging==true and .full_local_payload_written==false and .full_restore_proven==false and .result==\"OK\"' \"$ev\" >/dev/null || die CT200_RESTORE_EVIDENCE_INVALID 66; CT200_OWNER=\"$owner\"; CT200_GENERATION=\"$gen\"; CT200_STATE=\"$state\"; CT200_EVIDENCE=\"$ev\"; }","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/assets/pve03-r8152-lifecycle-helper.sh:5:TASK_ID=pve03-r8152-rx-ring-lifecycle-repair-v1","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/assets/pve03-r8152-lifecycle-helper.sh:14:STAGE=/var/lib/homelab-admin/staging/pve03-r8152-rx-ring-lifecycle-repair-v1","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/assets/pve03-r8152-lifecycle-helper.sh:160:  jq -n --arg before_link \"$before_link\" --arg after_link \"$after_link\" --argjson before_rx \"$before_rx\" --argjson after_rx \"$after_rx\" '{status:\"OK\",production_changed:true,lifecycle_repaired:true,script_replaced:true,service_definition_changed:false,rx_ring_changed:false,before_rx:$before_rx,after_rx:$after_rx,before_link:$before_link,after_link:$after_link,service_result:\"success\",service_active:\"active\",service_substate:\"exited\",link_is_failure_gate:false,link_diagnostic_preserved:true,automatic_rollback_triggered:false}' >\"$RESULT\"","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/assets/pve03-r8152-lifecycle-helper.sh:174:  jq -n --arg link \"$link\" --arg quorate \"$quorate\" --argjson current_rx \"$currx\" --argjson nodes \"$nodes\" '{status:\"OK\",production_changed:true,lifecycle_repaired:true,new_script_active:true,service_definition_changed:false,current_rx:$current_rx,rx_ring_changed:false,link_detected:$link,quorate:$quorate,nodes:$nodes,service_result:\"success\",service_active:\"active\",service_substate:\"exited\",link_is_failure_gate:false,link_diagnostic_preserved:true,rollback_payload_retained:true}' >\"$RESULT\"","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/apply.sh:17:jq -e '.status==\"OK\" and .production_changed==true and .lifecycle_repaired==true and .script_replaced==true and .service_definition_changed==false and .rx_ring_changed==false and .before_rx==4096 and .after_rx==4096 and .service_result==\"success\" and .service_active==\"active\" and .service_substate==\"exited\" and .link_is_failure_gate==false and .link_diagnostic_preserved==true and .automatic_rollback_triggered==false' <<<\"$R\" >/dev/null","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/apply.sh:19:jq -n --argjson remote \"$R\" '{status:\"OK\",root_cause_count:0,production_changed:true,pve03_changed:true,lifecycle_repaired:true,remote_result:$remote,canary_seal_unchanged:true,service_definition_changed:false,rx_ring_changed:false,network_restart_executed:false,vmbr0_changed:false}' >\"$HOMELAB_RUN_DIR/apply.json\"","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/dry-run.sh:16:jq -n '{status:\"OK\",root_cause_count:0,production_changed:false,pve03_changed:false,lifecycle_repair_planned:true,script_replace_planned:true,service_definition_change_planned:false,current_rx:4096,target_rx:4096,rx_change_planned:false,link_failure_gate_remove_planned:true,link_diagnostic_preserve_planned:true,network_restart_planned:false}' >\"$HOMELAB_RUN_DIR/dry-run.json\"","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/prepare.sh:11:asset_helper=\"$HOMELAB_TASK_DIR/assets/pve03-r8152-lifecycle-helper.sh\"","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/seal.sh:16:jq -e '.status==\"OK\" and .lifecycle_repaired==true and .remote_result.current_rx==4096 and .remote_result.service_result==\"success\" and .remote_result.link_is_failure_gate==false and .service_definition_changed==false and .rx_ring_changed==false and .canary_seal_unchanged==true and .network_restart_executed==false and .vmbr0_changed==false and .rollback_payload_retained==true' \"$V\" >/dev/null","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/seal.sh:20:jq -n --arg task \"$TASK_ID\" --arg change \"$CHANGE_ID\" --arg sealed \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\" --arg old \"$OLD_SCRIPT_SHA\" --arg new \"$NEW_SCRIPT_SHA\" --arg unit \"$OLD_SERVICE_SHA\" --arg canary \"$CANARY_SHA\" --arg stage \"$REMOTE_STAGE\" --argjson remote \"$R\" '{status:\"SEALED\",task_id:$task,change_id:$change,sealed_at_utc:$sealed,production_changed:true,pve03_changed:true,lifecycle_repaired:true,service_sha256:$unit,old_script_sha256:$old,new_script_sha256:$new,interface:\"nic1\",driver:\"r8152\",target_rx:4096,current_rx:4096,rx_ring_changed:false,service_definition_changed:false,service_result:\"success\",service_active:\"active\",service_substate:\"exited\",link_is_failure_gate:false,link_diagnostic_preserved:true,network_restart_executed:false,vmbr0_changed:false,canary_seal_sha256:$canary,canary_seal_unchanged:true,rollback_payload_retained:true,remote_rollback_stage:$stage,remote_verify:$remote}' >\"$tmp\"","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/seal.sh:24:jq -n --arg sha \"$ss\" '{status:\"OK\",root_cause_count:0,production_changed:true,lifecycle_repaired:true,task_seal_sha256:$sha}' >\"$HOMELAB_RUN_DIR/seal.json\"","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/verify.sh:16:jq -e '.status==\"OK\" and .lifecycle_repaired==true and .new_script_active==true and .service_definition_changed==false and .current_rx==4096 and .rx_ring_changed==false and .link_detected==\"yes\" and .quorate==\"Yes\" and .nodes==3 and .service_result==\"success\" and .service_active==\"active\" and .service_substate==\"exited\" and .link_is_failure_gate==false and .link_diagnostic_preserved==true and .rollback_payload_retained==true' <<<\"$R\" >/dev/null","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/verify.sh:18:jq -e '.status==\"OK\" and .lifecycle_repaired==true and .remote_result.rx_ring_changed==false and .service_definition_changed==false and .canary_seal_unchanged==true and .network_restart_executed==false and .vmbr0_changed==false' \"$A\" >/dev/null","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/verify.sh:20:jq -n --argjson remote \"$R\" '{status:\"OK\",root_cause_count:0,production_changed:true,pve03_changed:true,lifecycle_repaired:true,remote_result:$remote,canary_seal_unchanged:true,service_definition_changed:false,rx_ring_changed:false,network_restart_executed:false,vmbr0_changed:false,rollback_payload_retained:true}' >\"$HOMELAB_RUN_DIR/verify.json\"","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/task.json:3:  \"task_id\": \"pve03-r8152-rx-ring-lifecycle-repair-v1\",","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/task.json:26:    \"ssh:root@[PRIVATE_IP]:/var/lib/homelab-admin/staging/pve03-r8152-rx-ring-lifecycle-repair-v1\",","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/task.json:29:    \"/var/lib/homelab-admin/seals/pve03-r8152-rx-ring-lifecycle-repair-v1.json\"","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/task.json:32:    \"ssh:root@[PRIVATE_IP]:/var/lib/homelab-admin/staging/pve03-r8152-rx-ring-lifecycle-repair-v1\",","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/task.json:35:    \"/var/lib/homelab-admin/seals/pve03-r8152-rx-ring-lifecycle-repair-v1.json\"","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/task.json:71:      \"verification\": \"lifecycle repair sealed with exact source hashes, RX unchanged and CR0015 canary seal unchanged\"","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/task.json:87:    \"command\": \"HOMELAB_CONTROLLED_APPLY_CONFIRM=pve03-r8152-rx-ring-lifecycle-repair-v1 /opt/homelab-admin/bin/homelab-admin run TASK_DIR rollback\",","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/task.json:128:    \"assets/pve03-r8152-lifecycle-helper.sh\"","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/tools/runtime-lib.sh:2:TASK_ID=pve03-r8152-rx-ring-lifecycle-repair-v1","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/tools/runtime-lib.sh:5:REMOTE_STAGE=/var/lib/homelab-admin/staging/pve03-r8152-rx-ring-lifecycle-repair-v1","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/tools/runtime-lib.sh:6:REMOTE_HELPER=$REMOTE_STAGE/pve03-r8152-lifecycle-helper.sh","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/tools/runtime-lib.sh:17:SEAL=/var/lib/homelab-admin/seals/pve03-r8152-rx-ring-lifecycle-repair-v1.json","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/tools/runtime-lib.sh:25:assert_remote_stage(){ local a h n; a=\"$HOMELAB_TASK_DIR/assets/pve03-r8152-lifecycle-helper.sh\"; n=\"$HOMELAB_TASK_DIR/assets/homelab-pve03-r8152-rx-ring\"; h=\"$(ssh \"${SSH_BASE[@]}\" \"$REMOTE_HOST\" /usr/bin/sha256sum \"$REMOTE_HELPER\" | awk '{print $1}')\"; [[ \"$h\" == \"$(sha \"$a\")\" ]] || die REMOTE_HELPER_SHA_BAD; h=\"$(ssh \"${SSH_BASE[@]}\" \"$REMOTE_HOST\" /usr/bin/sha256sum \"$REMOTE_NEW\" | awk '{print $1}')\"; [[ \"$h\" == \"$NEW_SCRIPT_SHA\" && \"$h\" == \"$(sha \"$n\")\" ]] || die REMOTE_NEW_SHA_BAD; ssh \"${SSH_BASE[@]}\" \"$REMOTE_HOST\" /usr/bin/test -s \"$REMOTE_STAGE/baseline.json\" || die REMOTE_BASELINE_MISSING; }","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/tools/test_contract.py:6:helper=(T/\"assets/pve03-r8152-lifecycle-helper.sh\").read_text(encoding=\"utf-8\")","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/tools/test_contract.py:17:subprocess.run([\"bash\",\"-n\",str(T/\"assets/pve03-r8152-lifecycle-helper.sh\")],check=True)","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/tools/test_contract.py:21:assert task[\"task_id\"]==\"pve03-r8152-rx-ring-lifecycle-repair-v1\"","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/assets/homelab-backup-audit:407:  jq -n --arg task \"$TASK_ID\" --arg change \"$CHANGE_ID\" --arg at \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\" --arg backup \"$backup_status\" --arg control \"$control_status\" --arg escrow \"$escrow_status\" --arg staging \"$staging_status\" --arg retention \"$retention_status\" --argjson historical \"$historical_gc_proven\" --argjson owner_gc \"$owner_aware_gc_proven\" --argjson staging_bad \"$staging_bad\" --argjson staging_warn \"$staging_warn\" --argjson vm_count \"$vm_seen\" --argjson app_count \"$app_seen\" --argjson fresh \"$fresh\" --argjson stale \"$stale\" --argjson resume \"$resume\" --argjson unverified \"$unverified\" --argjson cloud_ok \"$cloud_ok\" --argjson scheduler_ok \"$scheduler_ok\" --argjson source_ok \"$source_ok\" --argjson source_drift \"$source_drift\" --argjson payload_leaks \"$payload_leaks\" '{schema:\"homelab-backup-unified-audit-v1\",task_id:$task,change_id:$change,updated_at_utc:$at,audit_status:\"OK\",backup_status:$backup,dr_readiness:\"NOT_PROVEN\",lifecycle_status:\"OPEN\",vm_count:$vm_count,app_count:$app_count,fresh_count:$fresh,stale_count:$stale,resume_count:$resume,unverified_count:$unverified,cloud_ok_count:$cloud_ok,scheduler_ok_count:$scheduler_ok,source_ok_count:$source_ok,source_drift_count:$source_drift,payload_leaks:$payload_leaks,control_status:$control,control_source_coverage:\"NOT_MACHINE_PROVEN\",staging_status:$staging,staging_bad_count:$staging_bad,staging_warn_count:$staging_warn,staging_node_count:3,escrow_status:$escrow,retention_status:$retention,historical_gc_proven:$historical,owner_aware_gc_proven:$owner_gc,provider_worm_proven:false,provider_worm_skipped_by_policy:true,clean_machine_bootstrap_proven:false,qemu_boot_restore_proven:false,full_site_dr_proven:false}' >\"$tmp\"","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/assets/homelab-backup-retention-gc:38:    vm130|vm190|vm200) printf 'pve03\\n' ;;","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/phases/dry-run.sh:20:grep -Fq 'vm200' \"$RETENTION_ASSET\"","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/phases/rollback.sh:27:jq -n --arg status OK '{status:$status,root_cause_count:0,production_changed:true,ct200_destroyed:true,backup_runtime_restored:true,vm_target_count_restored:12,vm200_cloud_backup_preserved:true,vm200_restore_evidence_preserved:true,old_mvp_preserved:true}' > \"$HOMELAB_RUN_DIR/rollback.json\"","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/phases/verify.sh:24:grep -Eq '^(KEEP|PROTECT|DELETE)\\|logical=vm200\\|' \"$retention_out\" || die RETENTION_VM200_MISSING","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/task.json:45:    \"rclone:pve01-mail-01-crypt:homelab-backups/vm200\",","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/task.json:46:    \"rclone:pve01-mail-02-crypt:homelab-backups/vm200\",","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/task.json:55:    \"ssh:root@[PRIVATE_IP]:/var/lib/homelab-backup/cloud-quorum/vm200\",","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/task.json:56:    \"ssh:root@[PRIVATE_IP]:/var/lib/homelab-backup/vm-restore-validation/vm200\"","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/task.json:73:    \"rclone:pve01-mail-01-crypt:homelab-backups/vm200\",","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/task.json:74:    \"rclone:pve01-mail-02-crypt:homelab-backups/vm200\",","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/task.json:80:    \"ssh:root@[PRIVATE_IP]:/var/lib/homelab-backup/cloud-quorum/vm200\",","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/task.json:81:    \"ssh:root@[PRIVATE_IP]:/var/lib/homelab-backup/vm-restore-validation/vm200\"","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/task.json:107:      \"verification\": \"proves CT boot/DNS, vm200 SEALED_PROVEN, retention owner mapping, 13-target audit and zero runtime source drift\"","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/task.json:112:      \"verification\": \"destroys only exact CT200 configuration and restores exact pre-CR runtime bytes while preserving any sealed vm200 cloud generation/evidence\"","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/task.json:139:    \"verification\": \"CT200 absent; exact old queue/probe/worker/audit/retention bytes restored on all relevant nodes; audit returns vm_count=12 and source_drift_count=0; sealed vm200 cloud backup is preserved fail-safe\"","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/task.json:146:    \"cloud objects outside the new vm200 namespace are not mutated\",","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/task.json:181:    \"initial_vm200_backup_required\": true,","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/tools/test_contract.py:33:assert \"vm130|vm190|vm200) printf 'pve03\\\\n' ;;\" in retention","HEAD:tasks/skladchik-moderator-v2-application-v1/task.json:105:      \"compile\": \"remote CT lifecycle helper\"","HEAD:tasks/skladchik-moderator-v2-application-v1/tools/runtime-lib.sh:28:assert_seals(){ assert_regular \"$INFRA_SEAL\"; [[ \"$(sha \"$INFRA_SEAL\")\" == \"$INFRA_SEAL_SHA\" ]] || die INFRA_SEAL_SHA_MISMATCH; jq -e '.status==\"SEALED\" and .ctid==200 and .vm_target_count==13 and .application_v2_installed==false and .cookie_onboarded==false' \"$INFRA_SEAL\" >/dev/null || die INFRA_SEAL_INVALID; assert_regular \"$RETENTION_SEAL\"; [[ \"$(sha \"$RETENTION_SEAL\")\" == \"$RETENTION_SEAL_SHA\" ]] || die RETENTION_SEAL_SHA_MISMATCH; jq -e '.status==\"SEALED\" and .vm200_retention_plan_proven==true and .gc_executed==false' \"$RETENTION_SEAL\" >/dev/null || die RETENTION_SEAL_INVALID; }","HEAD:tasks/skladchik-reports-monitor-controlled-reauth-v1/task.json:234:    \"operator_refresh_lifecycle\": [","HEAD:tests/test_cr_2026_0012_skladchik_cookie_refresh_runbook.py:36:    def test_full_lifecycle_order_is_explicit(self) -> None:","HEAD:tests/test_cr_2026_0035_skladchik_moderator_ct200.py:20:    def test_vm200_is_canonical_lxc_on_pve03(self) -> None:","HEAD:tests/test_cr_2026_0035_skladchik_moderator_ct200.py:27:    def test_audit_and_retention_include_vm200(self) -> None:","HEAD:tests/test_cr_2026_0035_skladchik_moderator_ct200.py:32:        self.assertIn(\"vm130|vm190|vm200) printf 'pve03\\\\n' ;;\", retention)","HEAD:tests/test_cr_2026_0036_skladchik_moderator_v2.py:455:    def test_db_text_encoding_lifecycle_is_independent_and_rollback_safe(self):","HEAD:tests/test_cr_2026_0036_skladchik_moderator_v2.py:513:    def test_rules_hotfix_lifecycle_restages_live_probe_and_rollback_is_seal_safe(self):","HEAD:tests/test_cr_2026_0036_skladchik_moderator_v2.py:560:    def test_collector_hotfix_lifecycle_is_seal_and_rollback_safe(self):","HEAD:tests/test_cr_2026_0057_control_refresh.py:30:    def test_lifecycle_cloud_boundary(self):","HEAD:tests/test_cr_2026_0057_control_refresh.py:36:    def test_source_worktree_must_be_clean_for_lifecycle(self):","HEAD:tests/test_cr_2026_0066_legacy_backup_target_retirement.py:31:        'assert_host(){ log assert_host; }','assert_stage(){ log assert_stage; }','assert_source_clean(){ log assert_source_clean; }','assert_seals(){ log assert_seals; }','assert_live_old(){ log assert_live_old; }','assert_asset_integrity(){ log assert_asset_integrity; }','assert_approved_diffs_old(){ log assert_approved_diffs_old; }','assert_candidate_semantics(){ log assert_candidate_semantics; }','assert_legacy_layout(){ log assert_legacy_layout; }','assert_no_open_legacy_tx(){ log assert_no_open_legacy_tx; }','assert_known_systemd(){ log assert_known_systemd; }','payload_fingerprint_set(){ PAYLOAD_FINGERPRINT=x; }','systemd_fingerprint_set(){ SYSTEMD_FINGERPRINT=y; }','acquire_locks(){ log acquire_locks; }','assert_no_legacy_process(){ log assert_no_legacy_process; }','assert_ct200_proven(){ CT200_OWNER=pve03; CT200_GENERATION=vm200-pve03-20260814T000000Z; CT200_EVIDENCE=/tmp/evidence; }',f'install_candidates(){{ log install_candidates; return {install_rc}; }}','assert_live_new(){ log assert_live_new; }',f'assert_live_semantics(){{ log assert_live_semantics; {post}; }}','restore_preimages(){ log restore_preimages; return 0; }']","HEAD:tests/test_cr_2026_0066_legacy_backup_target_retirement.py:41:    script=f\"set -Eeuo pipefail; HOMELAB_TASK_DIR={shlex.quote(str(TASK))}; source {shlex.quote(str(lib))}; remote_argv_command jq -e --arg g 'vm200-pve03-20260814T000000Z' '.schema==\\\"homelab-vm-restore-validation-v1\\\" and .generation==$g' '/tmp/evidence file.json'; printf '%s\\\\n' \\\"$REMOTE_COMMAND\\\"\"","HEAD:tests/test_cr_2026_0066_legacy_backup_target_retirement.py:42:    r=subprocess.run(['bash','-c',script],text=True,capture_output=True); self.assertEqual(r.returncode,0,r.stderr); cmd=r.stdout.strip(); probe=f\"set -- {cmd}; printf '<%s>\\\\n' \\\"$@\\\"\"; q=subprocess.run(['sh','-c',probe],text=True,capture_output=True); self.assertEqual(q.returncode,0,q.stderr); self.assertEqual(q.stdout.splitlines(),['<jq>','<-e>','<--arg>','<g>','<vm200-pve03-20260814T000000Z>','<.schema==\"homelab-vm-restore-validation-v1\" and .generation==$g>','</tmp/evidence file.json>'])","HEAD:tests/test_cr_2026_0067_final_control_refresh.py:18: def test_source_freshness_across_lifecycle(self):","HEAD:tests/test_cr_2026_0070_target_lifecycle_registry.py:4:TASK=ROOT/'tasks/backup-target-lifecycle-registry-v1'","HEAD:tests/test_cr_2026_0070_target_lifecycle_registry.py:12:        self.assertEqual(len([x for x in t if x['kind']=='VM' and x['lifecycle']=='ACTIVE']),13)","HEAD:tests/test_cr_2026_0070_target_lifecycle_registry.py:13:        self.assertEqual(len([x for x in t if x['kind']=='APP' and x['lifecycle']=='ACTIVE']),6)","HEAD:tests/test_cr_2026_0070_target_lifecycle_registry.py:16:        self.assertEqual(x['lifecycle'],'RETIRED_PRESERVE')","HEAD:tests/test_cr_2026_0070_target_lifecycle_registry.py:29:        self.assertEqual(subprocess.check_output([self.helper,'lifecycle','app-skladchik-moderator-assistant'],env=self.env,text=True).strip(),'RETIRED_PRESERVE')","HEAD:tests/test_cr_2026_0070_target_lifecycle_registry.py:32:        for m in ('PRELOCK','LOCKED_PRE_RESUME','LOCKED_POST_RESUME','REMOTE_LIST_FAILED','RETIRED_PRESERVE'): self.assertIn(m,r)","HEAD:tests/test_cr_2026_0070_target_lifecycle_registry.py:43:        diffdir = ROOT / \"tasks/backup-target-lifecycle-registry-v1/assets/approved-diffs\"","HEAD:tests/test_cr_2026_0072_gfs_retention.py:3:T=ROOT/'tasks/backup-gfs-retention-v1'","HEAD:tests/test_cr_2026_0072_gfs_retention.py:4:CRIT=['vm110','vm111','vm112','vm113','vm130','vm150','vm160','vm170','vm200']","HEAD:tests/test_cr_2026_0072_gfs_retention.py:7:  env=os.environ.copy(); env['HOMELAB_BACKUP_GFS_POLICY']=str(T/'assets/gfs-retention.json'); env['HOMELAB_BACKUP_TARGET_REGISTRY']=str(ROOT/'tasks/backup-target-lifecycle-registry-v1/assets/backup-target-registry.json'); env['HOMELAB_GFS_NOW_UTC']=now","HEAD:tests/test_cr_2026_0072_gfs_retention.py:8:  return subprocess.run([str(T/'assets/homelab-backup-gfs-policy'),'select',logical],input=''.join(lines),text=True,capture_output=True,env=env,check=True).stdout.splitlines()","HEAD:tests/test_cr_2026_0072_gfs_retention.py:17:   return subprocess.run(['python3','-B',str(T/'tools/capacity_guard.py'),str(h),str(T/'assets/gfs-retention.json')],text=True,capture_output=True,env=env)","HEAD:tests/test_cr_2026_0072_gfs_retention.py:19:  p=json.loads((T/'assets/gfs-retention.json').read_text()); self.assertEqual((p['weekly_buckets'],p['monthly_buckets'],len(p['critical_vm_logicals'])),(4,6,9)); self.assertTrue(p['completed_periods_only']); self.assertEqual(p['capacity_guard_target_max_age_seconds'],172800); self.assertEqual(p['capacity_guard_cloud_max_age_seconds'],14400)","HEAD:tests/test_cr_2026_0072_gfs_retention.py:27:  for item in ['LOCKED_PRE_RESUME','LOCKED_POST_RESUME','REMOTE_LIST_FAILED_','resume_transactions','stable_delete_set','RETIRED_PRESERVE']: self.assertIn(item,s)","HEAD:tests/test_cr_2026_0072_gfs_retention.py:45:  hs=sha(T/'assets/homelab-backup-gfs-policy'); ps=sha(T/'assets/gfs-retention.json'); cs=sha(T/'tools/capacity_guard.py'); rs=sha(T/'assets/homelab-backup-retention-gc')"],"head":"34d76b1cfd4071d94290edac50a31a8c0d4c11c8","head_commit":"34d76b1cfd4071d94290edac50a31a8c0d4c11c8|2026-08-14T17:19:33+03:00|fix(CR-2026-0072): close GFS runtime hash dependency graph","hit_files":[{"blob":"b8c98568b40a59c5e452e12835ae1924cba5bab4","path":"changes/CR-2026-0005/plan.md"},{"blob":"17f5adc7d28ce77a2ceeeb26a2541ff10a556958","path":"changes/CR-2026-0006/plan.json"},{"blob":"9faaa5679ff920509f23799ede7f53c8feffb390","path":"changes/CR-2026-0007/plan.json"},{"blob":"69d0bd7ae465aa8bf065d86bfb8d0b1a53ea58ee","path":"changes/CR-2026-0012/plan.json"},{"blob":"c45305eb1066f842fcd621e74ad68a6debd7962d","path":"changes/CR-2026-0030/implementation.md"},{"blob":"9195917b513ef95875bab7c9f9d007a3dbae0dac","path":"changes/CR-2026-0030/tests.md"},{"blob":"470bec45f0ec929fec32615e69b18d75a793347f","path":"changes/CR-2026-0031/risk.md"},{"blob":"043d175b0b3381595ef55ea9322cf58763794f00","path":"changes/CR-2026-0032/README.md"},{"blob":"87fe46bc5f804bd95cfd3f7e83fad2e8afba5b10","path":"changes/CR-2026-0035/implementation.md"},{"blob":"e8b5c8d3e67068b1cd477969ff4b7a6625193db7","path":"changes/CR-2026-0035/risk.md"},{"blob":"77166599150be819387e130677988174a19af59f","path":"changes/CR-2026-0035/tests.md"},{"blob":"ccb02467f67e50f6130ab3dd79f6dfc23f5f045f","path":"changes/CR-2026-0036/implementation.md"},{"blob":"defa021afc732d4e75cce165f7d748bea9317d8f","path":"changes/CR-2026-0049/source-provenance.tsv"},{"blob":"6e8c73d7d1d592bab2b0cb3cae1a551c7a640423","path":"changes/CR-2026-0049/task-package.sha256"},{"blob":"3963f962ced2ca39731680306cd153749616a9b2","path":"changes/CR-2026-0054/implementation.md"},{"blob":"e6e01a0f4a6fddad1dd9665d08d1a97d22c152c2","path":"changes/CR-2026-0054/tests.md"},{"blob":"9322a9c023d35be9f5003cc41ae687f0900f0de7","path":"changes/CR-2026-0057/implementation.md"},{"blob":"3779f6f28b2bdd01e1541121a2f3e5947963c399","path":"changes/CR-2026-0057/tests.md"},{"blob":"a8f4d9dad9be23170b6849b9b6ed9f57b574a68f","path":"changes/CR-2026-0060/implementation.md"},{"blob":"c210e2f145890aa1b04c9fda8593d8394b568b7c","path":"changes/CR-2026-0060/tests.md"},{"blob":"964401ce6097c87e87e0a1a36e5c9e4be136caf7","path":"changes/CR-2026-0064/implementation.md"},{"blob":"d6c047793673a864dc6dbb6b8e5f37c6517f6e29","path":"changes/CR-2026-0064/risk.md"},{"blob":"17c9beed7ec3a4b6114e8e5cccdd10a732a5ef02","path":"changes/CR-2026-0064/tests.md"},{"blob":"13fdb9bd99b1239cf91f55fd05fbbc5e9f31523a","path":"changes/CR-2026-0068/implementation.md"},{"blob":"396c9798872743f32af63f4167f5a9da0aac6d10","path":"changes/CR-2026-0070/implementation.md"},{"blob":"16e7093472088e7008049f7e06662fc7c60b8911","path":"changes/CR-2026-0070/package.sha256"},{"blob":"ac4bd506cc6ffa49518c758c3eaec18011caa2a5","path":"changes/CR-2026-0070/tests.md"},{"blob":"68dd44d3bdd6f6aeb4b356583db1640a5cff81ac","path":"changes/CR-2026-0071/implementation.md"},{"blob":"f17b75e3e7698340e0ba72d543e123a3902add57","path":"changes/CR-2026-0071/tests.md"},{"blob":"cd51cfb7d1c0e712b42e9fa395bff55ad5b14ea0","path":"changes/CR-2026-0072/package.sha256"},{"blob":"53430b7f739fb98897b04b248cf5e9a66c0991c0","path":"docs/superpowers/plans/2026-08-12-vm170-apps-b-retirement-implementation.md"},{"blob":"e0f59a8c442cbcaddaf69a9fc475e86d68f0886f","path":"docs/superpowers/plans/2026-08-13-backup-control-coverage-hardening-implementation.md"},{"blob":"aa99cb4e9568930cac4c84f9867d82bb94a476a1","path":"docs/superpowers/plans/2026-08-13-control-refresh-implementation.md"},{"blob":"8ac672a6f394500463465bc04c12b743ddfb42d8","path":"docs/superpowers/plans/2026-08-13-legacy-backup-target-retirement-implementation.md"},{"blob":"8bf377cec2719d7f8249407471b18fc6095b838a","path":"docs/superpowers/specs/2026-08-12-vm170-apps-b-retirement-design.md"},{"blob":"860a3ded9369f129c3a761cb702a77bad3118efb","path":"docs/superpowers/specs/2026-08-13-backup-control-coverage-hardening-design.md"},{"blob":"b39bb04840862c37c3b5f93d57cf3c8d3682378c","path":"docs/superpowers/specs/2026-08-13-control-refresh-design.md"},{"blob":"36edd4ad024a74760e58a99f251beabafa6f7ad4","path":"docs/superpowers/specs/2026-08-13-legacy-backup-target-retirement-design.md"},{"blob":"d521fc296860f18e46478cd04e9f2c382f01d6ef","path":"errors/regression-cases.json"},{"blob":"1197908146e655657316195a770cae38cef2d6dc","path":"observed/source-snapshots/dependency-map-latest.tsv"},{"blob":"7ca7c24801bffc9bdcb88c20830dec715f4e6f6d","path":"tasks/backup-control-coverage-hardening-v1/assets/homelab-backup-audit"},{"blob":"1769ba9fc3083b65a448e498bfd9714e6832cd7f","path":"tasks/backup-control-final-generation-v1/assets/runtime/homelab-backup-audit"},{"blob":"d3a69ebfbbf532c4668998d676fc704fbe750b49","path":"tasks/backup-control-refresh-post-legacy-retirement-v1/assets/runtime/homelab-backup-audit"},{"blob":"7e7df41a1631b9eff8c644995a04dcd7474e8273","path":"tasks/backup-control-refresh-post-legacy-retirement-v1/assets/runtime/homelab-backup-retention-gc"},{"blob":"a0bc4c7db7302bd340bcb4e463616aed7a12d7fd","path":"tasks/backup-control-refresh-post-legacy-retirement-v1/task.json"},{"blob":"bae9f9ab252621f91ab676888e3eba1c917bb4b3","path":"tasks/backup-control-refresh-post-legacy-retirement-v1/tools/test_contract.py"},{"blob":"7ca7c24801bffc9bdcb88c20830dec715f4e6f6d","path":"tasks/backup-control-refresh-v1/assets/runtime/homelab-backup-audit"},{"blob":"8ed6e4ef527c69dff55f444c78e4a19feaf4c879","path":"tasks/backup-control-refresh-v1/assets/runtime/homelab-backup-retention-gc"},{"blob":"ac4d5b1eb6f1adfd14d48ca26ac37227e4c99513","path":"tasks/backup-control-refresh-v1/task.json"},{"blob":"939c61bc3e55faa06bfad1dcef95b371207c5e3c","path":"tasks/backup-gfs-retention-v1/assets/approved-diffs/homelab-backup-retention-gc.diff"},{"blob":"6f8fee6da5c6ab02446c1132b50633fc3dd2ccd1","path":"tasks/backup-gfs-retention-v1/assets/gfs-retention.json"},{"blob":"9af2630ea7f69df1b5c386f8dda46a8866e310ee","path":"tasks/backup-gfs-retention-v1/assets/homelab-backup-gfs-policy"},{"blob":"4dbe9900d7963ac6cb42f5af34edea8a1041647a","path":"tasks/backup-gfs-retention-v1/assets/homelab-backup-retention-gc"},{"blob":"4db37a735701700697fcb91e9adcb0a7c88ae39c","path":"tasks/backup-gfs-retention-v1/phases/seal.sh"},{"blob":"e889f754ec6cfaf4c829b80a1fde866eef45da7d","path":"tasks/backup-gfs-retention-v1/phases/verify.sh"},{"blob":"eb55864338ca30bd3f9e7836c85f6366bf187f80","path":"tasks/backup-gfs-retention-v1/task.json"},{"blob":"7584314d7594b48c9e2e12979ef32824c86f9aa0","path":"tasks/backup-gfs-retention-v1/tools/capacity_guard.py"},{"blob":"ba7e0c1580a2ca01c45b0860ba805591b726534b","path":"tasks/backup-gfs-retention-v1/tools/runtime-lib.sh"},{"blob":"0394b0b72cf1c95c53810d322acaaec5f94e00eb","path":"tasks/backup-gfs-retention-v1/tools/test_contract.py"},{"blob":"5952ff82732939d9d9928b3964b2defeab1c6927","path":"tasks/backup-observability-risk-forecast-v1/assets/approved-diffs/homelab-backup-audit.diff"},{"blob":"1a9c723e31dee35c8bc29286f121812215f4b1b2","path":"tasks/backup-observability-risk-forecast-v1/assets/homelab-backup-audit"},{"blob":"4821fbc1d680e8b1341c381c564af32c3ee39321","path":"tasks/backup-observability-risk-forecast-v1/task.json"},{"blob":"159762353904596a4886207c91adcaefafc6595e","path":"tasks/backup-observability-risk-forecast-v1/tools/runtime-lib.sh"},{"blob":"a2bdac617f46db798c2affd210b6b170d7e7cb29","path":"tasks/backup-retention-dynamic-pinned-prune-mailru-cleanup-v1/assets/orchestrator"},{"blob":"a98651a207d8c0543a12829883ee577c7a7a94f3","path":"tasks/backup-retention-dynamic-pinned-prune-mailru-cleanup-v1/task.json"},{"blob":"f37f9d2494a7a2692ebf1d81bf5b19c124e7c18c","path":"tasks/backup-retention-pinned-scheduled-scope-hotfix-v1/assets/homelab-backup-retention-gc"},{"blob":"6ac8e7165549efd504a1edbe4083b8f68f700537","path":"tasks/backup-retention-pinned-scheduled-scope-hotfix-v1/task.json"},{"blob":"76d6c8eb28f2bd249ba469ab77488b03ce022196","path":"tasks/backup-retention-plan-stability-hotfix-v1/assets/homelab-backup-retention-gc"},{"blob":"c631d5b296b8ecd5810fe4cb60c6f4e6ba3b9c62","path":"tasks/backup-retention-plan-stability-hotfix-v1/tools/runtime-lib.sh"},{"blob":"a88c94ca83e168e0c47cdb16ce527f241c17fb67","path":"tasks/backup-retention-remote-list-failclosed-hotfix-v1/assets/homelab-backup-retention-gc"},{"blob":"7738957cb10a77d88e205111fd71a80fa61bd09f","path":"tasks/backup-retention-remote-stdin-hotfix-v1/assets/homelab-backup-retention-gc"},{"blob":"c5c8ee836c5acd690c1edfbad7968a8a03ed941d","path":"tasks/backup-retention-remote-stdin-hotfix-v1/phases/apply.sh"},{"blob":"486b021a5b538927eb09ca037f480d72bce4279a","path":"tasks/backup-retention-remote-stdin-hotfix-v1/phases/dry-run.sh"},{"blob":"cb33dac623282fdd768166135a52cdfde7051741","path":"tasks/backup-retention-remote-stdin-hotfix-v1/phases/seal.sh"},{"blob":"9c4a6b05b20fd97f5ffff4b30fa2f8fe26365f8f","path":"tasks/backup-retention-remote-stdin-hotfix-v1/phases/verify.sh"},{"blob":"2771655d95130aa7368a919a15e09cc837111111","path":"tasks/backup-retention-remote-stdin-hotfix-v1/task.json"},{"blob":"1cdd318a710104eaaca0cbcf732fae0c1291cb4a","path":"tasks/backup-retention-remote-stdin-hotfix-v1/tools/runtime-lib.sh"},{"blob":"942f1e7cc2191a00cb95cef563f41c6a644b6820","path":"tasks/backup-retention-remote-stdin-hotfix-v1/tools/test_contract.py"},{"blob":"1769ba9fc3083b65a448e498bfd9714e6832cd7f","path":"tasks/backup-retention-safe-gc-v1/assets/homelab-backup-audit"},{"blob":"8ed6e4ef527c69dff55f444c78e4a19feaf4c879","path":"tasks/backup-retention-transaction-resume-hotfix-v1/assets/homelab-backup-retention-gc"},{"blob":"a9c7bedb7f73ae9e19e2d99b40d85da34b4fc7e9","path":"tasks/backup-target-lifecycle-registry-v1/assets/approved-diffs/homelab-backup-retention-gc.diff"},{"blob":"05fde168293652c9f0d17d1d95270c4badb5655c","path":"tasks/backup-target-lifecycle-registry-v1/assets/backup-target-registry.json"},{"blob":"3c1aa2db80cc6e1f5509b46585487c52403b4cc3","path":"tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-audit"},{"blob":"633986dcd6d9e7fc52e2667fd83844b02e2c5bf4","path":"tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-retention-gc"},{"blob":"b9cd5ff228f4131acceb5bc59614d0d1de380a54","path":"tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-target-registry"},{"blob":"50a4d871ffa10c8ce806dd0ba4e5f9d584c433ee","path":"tasks/backup-target-lifecycle-registry-v1/phases/apply.sh"},{"blob":"2b9cb5c2d95437219ec74bb68a504598c14b1c8c","path":"tasks/backup-target-lifecycle-registry-v1/phases/dry-run.sh"},{"blob":"b6feb8f48b04ec4341c1f4c9d459fdebb1dc27fb","path":"tasks/backup-target-lifecycle-registry-v1/phases/preflight.sh"},{"blob":"1ddf9f9a1992ebdfefe72cb283536e52153bae7d","path":"tasks/backup-target-lifecycle-registry-v1/phases/seal.sh"},{"blob":"424b51ce5cf2e303eacc90c50f2dbcb720fcf8e1","path":"tasks/backup-target-lifecycle-registry-v1/phases/verify.sh"},{"blob":"a7fd425f26f3a61b5bbe5c49aa040ae8700f31db","path":"tasks/backup-target-lifecycle-registry-v1/task.json"},{"blob":"06533a1be3f30b7ef09d1fab800b145f2372131c","path":"tasks/backup-target-lifecycle-registry-v1/tools/runtime-lib.sh"},{"blob":"a65e3959b8daeba179eac38203721c2e2c0e9e32","path":"tasks/backup-target-lifecycle-registry-v1/tools/test_contract.py"},{"blob":"9a7c23eb8ddfa7a63e8aa546d5164529e658f023","path":"tasks/backup-unified-monitoring-v1/README.md"},{"blob":"2280847143ad79c71b77db18bdb1c638bde4e7c3","path":"tasks/backup-unified-monitoring-v1/assets/homelab-backup-audit"},{"blob":"a6ec8d8d46cb5d9ae181cc60db84c7b03f6fad16","path":"tasks/gitea-execution-journal-v1/assets/bootstrap-history.json"},{"blob":"5bb3df0845107727892637455ae502b9fc247e2b","path":"tasks/gitea-execution-journal-v1/task.json"},{"blob":"e9b7f2b689c5a2aa8abd26a24d5d53d1e297574f","path":"tasks/homelab-safety-foundation-v1/task.json"},{"blob":"d3a69ebfbbf532c4668998d676fc704fbe750b49","path":"tasks/legacy-backup-target-retirement-v1/assets/homelab-backup-audit"},{"blob":"7e7df41a1631b9eff8c644995a04dcd7474e8273","path":"tasks/legacy-backup-target-retirement-v1/assets/homelab-backup-retention-gc"},{"blob":"0d091e9e0b3ed362716eac23f0eb5e67645d15d8","path":"tasks/legacy-backup-target-retirement-v1/tools/runtime-lib.sh"},{"blob":"bb4f027cb2018dbe3883f64c507cfbec150092d0","path":"tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/assets/pve03-r8152-lifecycle-helper.sh"},{"blob":"d4bed407e8afb2dc7a35715928170a4499fd1635","path":"tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/apply.sh"},{"blob":"528cb4ccf43258855fea89a1ddcebc6367803c21","path":"tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/dry-run.sh"},{"blob":"1dc06d6fadccaf4b2bc38b64935d7efc3baf036c","path":"tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/prepare.sh"},{"blob":"0854080ad7ff316a409e05bb6ec383d914ce1695","path":"tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/seal.sh"},{"blob":"61a6c56cd7c972c31b593072b444181c9fe8b1dd","path":"tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/verify.sh"},{"blob":"70fc54a265dabad376c98defa0d7b6a5d8e86abf","path":"tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/task.json"},{"blob":"5304252574b3e31165d11d1ddb07c438e6ce486c","path":"tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/tools/runtime-lib.sh"},{"blob":"6eecf9b78607ac0f2799f01e1ae638ee40ff03c2","path":"tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/tools/test_contract.py"},{"blob":"a425ecd524835c669310302126a1d325ae912dd6","path":"tasks/skladchik-moderator-ct200-infrastructure-v1/assets/homelab-backup-audit"},{"blob":"7738957cb10a77d88e205111fd71a80fa61bd09f","path":"tasks/skladchik-moderator-ct200-infrastructure-v1/assets/homelab-backup-retention-gc"},{"blob":"57b6621ce47cd506c7f5e825b5a6bb3728e6332d","path":"tasks/skladchik-moderator-ct200-infrastructure-v1/phases/dry-run.sh"},{"blob":"c8ce6fc5c414a9673a57160ab0f08b5b147af22b","path":"tasks/skladchik-moderator-ct200-infrastructure-v1/phases/rollback.sh"},{"blob":"b565943a9da98d5fbda211ea89cc69f2f4f51bbf","path":"tasks/skladchik-moderator-ct200-infrastructure-v1/phases/verify.sh"},{"blob":"455d5183f71ce6a8b2a6c34d7e5a7616023d203f","path":"tasks/skladchik-moderator-ct200-infrastructure-v1/task.json"},{"blob":"c4d3eac95a1abe0cde1c7cf29e8fd58b7bd130af","path":"tasks/skladchik-moderator-ct200-infrastructure-v1/tools/test_contract.py"},{"blob":"0e7f38b73fd87672d806a23b60272c6548aac845","path":"tasks/skladchik-moderator-v2-application-v1/task.json"},{"blob":"db72a33d3fe6696895d56ae41778dadc10b6a298","path":"tasks/skladchik-moderator-v2-application-v1/tools/runtime-lib.sh"},{"blob":"68ae87029a1660255df02ff192e5b9206e9a6c05","path":"tasks/skladchik-reports-monitor-controlled-reauth-v1/task.json"}],"label":"CR0072_GFS","path":"/root/homelab-ops-cr-2026-0072"},{"branch":"cr-2026-0070-backup-target-lifecycle-registry","exists":true,"grep_count":301,"grep_lines":["HEAD:changes/CR-2026-0005/plan.md:10:8. \u041f\u043e\u0441\u043b\u0435 \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0433\u043e CI \u0438 review \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c lifecycle \u0447\u0435\u0440\u0435\u0437 `homelab-admin`.","HEAD:changes/CR-2026-0006/plan.json:20:    \"homelab-admin-lifecycle\"","HEAD:changes/CR-2026-0007/plan.json:21:    \"homelab-admin-lifecycle\"","HEAD:changes/CR-2026-0012/plan.json:9:  \"lifecycle\": [","HEAD:changes/CR-2026-0030/implementation.md:9:The first controlled apply stopped before capture with `HEALTH_STATE_MISSING`. The v2 task had a v2 state namespace but still referenced the v1 health file and retained hardcoded v1 logical-id literals in lifecycle phases. The correction gives v2 its own `/var/lib/homelab-health/control-bootstrap-v2-cloud-quorum.json` health file and changes all active phase logical-id checks/evidence to `control-bootstrap-v2`. The v1 health/state remain immutable and no failed-apply rollback is required because no generation or cloud mutation occurred.","HEAD:changes/CR-2026-0030/tests.md:6:- failed #401 state directory may exist but must contain zero generation JSON files before lifecycle resume;","HEAD:changes/CR-2026-0031/risk.md:4:Scheduler contention during the 12-target Cloud-A backfill may still stop an apply with rc75, but this no longer creates a dead-end lifecycle state: a subsequent controlled apply can resume from partially installed worker/probe bytes and already-written evidence without recapturing or writing cloud data.","HEAD:changes/CR-2026-0032/README.md:5:This change installs a single canonical audit surface for the current 12 VM/CT and 7 APP backup targets plus CONTROL, cloud health, current payload cleanup, scheduler/lock/process state, staging capacity, escrow presence, retention lifecycle and DR proof boundaries.","HEAD:changes/CR-2026-0035/implementation.md:5:The controlled apply creates CT200 on pve03 using the pinned Debian 13 template, 4 vCPU, 6144 MiB RAM, 1024 MiB swap, 40 GiB local-lvm rootfs, unprivileged mode and nesting. It proves boot and DNS, performs an initial vm200 cloud-quorum backup with restore-validation using the candidate worker before changing live backup runtime, then enrolls vm200 in the canonical VM queue/probe/worker/audit/retention runtime on pve01/pve02/pve03 as required.","HEAD:changes/CR-2026-0035/risk.md:11:- first vm200 SEALED backup and restore evidence before live enrollment;","HEAD:changes/CR-2026-0035/risk.md:13:- rollback preserves any already sealed vm200 cloud generation/evidence rather than deleting recovery data;","HEAD:changes/CR-2026-0035/tests.md:14:- Regression: retention candidate requires SSH stdin isolation and live plan must emit vm200 after hotfix.","HEAD:changes/CR-2026-0035/tests.md:15:- Live hotfix proof requires read-only candidate/post-install retention plans to include remote-owned VMIDs and `KEEP|logical=vm200|...|reason=POLICY_NEWEST_2`.","HEAD:changes/CR-2026-0036/implementation.md:50:- Auth-hotfix verify re-stages the pinned offline selftest before remote verification and removes the transient pve03 stage afterward; this closes the apply-to-verify staging lifecycle defect observed in run 20260812T113300Z-2937839-verify.","HEAD:changes/CR-2026-0049/source-provenance.tsv:4:new-script\ttasks/pve03-r8152-rx-ring-lifecycle-repair-v1/assets/homelab-pve03-r8152-rx-ring\td896dce2f9abdebc5f507fd63e4ef6d1d666452c0263469d3dab4d14a6b229af","HEAD:changes/CR-2026-0049/task-package.sha256:1:d896dce2f9abdebc5f507fd63e4ef6d1d666452c0263469d3dab4d14a6b229af  tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/assets/homelab-pve03-r8152-rx-ring","HEAD:changes/CR-2026-0049/task-package.sha256:2:1d773fb2a9a5fdd198569d8d04d65c4bfc9ce98109fed4148b6e46e50d874778  tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/assets/pve03-r8152-lifecycle-helper.sh","HEAD:changes/CR-2026-0049/task-package.sha256:3:50abd763a56d6da15d003474b4e59410dd2fb0d06c82acee762fb93e458a779d  tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/apply.sh","HEAD:changes/CR-2026-0049/task-package.sha256:4:b8e7df6de169b35b53c51764822faecc40b76767505244fbc5b72ef4dc852771  tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/dry-run.sh","HEAD:changes/CR-2026-0049/task-package.sha256:5:1f2c9da85a67737f86fca0ba41d02e2ed5bd0c75f8ebeffac6784c7f94b06aa3  tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/preflight.sh","HEAD:changes/CR-2026-0049/task-package.sha256:6:c34294d41a3d2ef1033ae674790976043174c1b7269b02bf5738891d8a614aa6  tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/prepare.sh","HEAD:changes/CR-2026-0049/task-package.sha256:7:ee1cd4487210ee9c90bdaf8e17809aaf6e17b1b9419746fcf3ae1557be4c659b  tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/rollback.sh","HEAD:changes/CR-2026-0049/task-package.sha256:8:8b1abc57f61fb46e51aa4b7a90d138dc92bbe1dfec210c4a5a952d3e9ad608a5  tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/seal.sh","HEAD:changes/CR-2026-0049/task-package.sha256:9:1f8916517c7480d63f5e2cb0ee208133583975e4aed7f63c7859d62ef1fb92d6  tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/verify.sh","HEAD:changes/CR-2026-0049/task-package.sha256:10:dd8768072688c206043e23d3ce787feb6a74e696aa7c2595f8679371ba24b930  tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/task.json","HEAD:changes/CR-2026-0049/task-package.sha256:11:c3b5f59dcd22b0f931e7cefd89749d562434396e19ae25aba01f0e116bcdb373  tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/tools/runtime-lib.sh","HEAD:changes/CR-2026-0049/task-package.sha256:12:7118284724c4fb8c21dddd6373adfa7569e2d027ec004a279d85a201b019e8a4  tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/tools/test_contract.py","HEAD:changes/CR-2026-0054/implementation.md:7:The future homelab-admin lifecycle is audit-runtime-only. It stages exact old audit bytes for rollback and does not modify retention runtime, APP/VM queues, dispatcher, systemd schedules, cloud generations, guest state, legacy moderator payload or CONTROL generations.","HEAD:changes/CR-2026-0054/tests.md:15:Expected source result: all PASS/GREEN. Validation only; no homelab-admin lifecycle phase is executed in the source-only scope.","HEAD:changes/CR-2026-0057/implementation.md:5:The CR0057 branch is not statically self-pinned in `source-recovery.tsv`, because a final source commit cannot contain its own future commit hash. Instead CR0054/CR0056 refs are statically pinned, the CR0057 worktree must be clean, and the lifecycle dynamically requires the exact current CR0057 branch HEAD to exist in the all-refs Git bundle. Apply is resume-safe if the quorum transport has already deleted the local archive at `DELETE_AUTHORIZED` or completed `SEALED`.","HEAD:changes/CR-2026-0057/tests.md:3:Required gates: package SHA, bash syntax, in-memory Python compile, CR0057 unittest, task contract test, repository full suite with temporary `PYTHONPYCACHEPREFIX`, `git diff --check`, and real `homelab-admin validate`. Production lifecycle is executed only after all source gates are green.","HEAD:changes/CR-2026-0060/implementation.md:3:Replace only the retention runtime. Preserve CR0055 age normalization and CR0056 resume ordering. `remote_generation_present` captures successful `rclone lsf` output first and aborts rc 69 on list failure. Canary post-purge verification uses the same fail-closed principle while listing the stable remote root. The hotfix lifecycle never calls `scheduled` or `canary`.","HEAD:changes/CR-2026-0060/tests.md:3:Manifest, bash syntax, homelab-admin lint, read-only plan and Python contract. Dynamic stubbed-rclone tests prove present rc=0, absent rc=1, and list failure rc=69. Static checks preserve CR0055 plan normalization and CR0056 transaction resume, and prove lifecycle apply/rollback do not invoke scheduled/canary/rclone writes.","HEAD:changes/CR-2026-0064/implementation.md:3:Add an optional exact pinned-delete lifecycle contract to canonical `scheduled`. With no pin environment the timer path is byte-semantically unchanged. With both pin file and SHA supplied, the runtime validates DELETE plus canonical transaction identities at PRELOCK, recalculates and validates again after acquiring backup locks but before transaction resume, then validates after resume before any new delete loop. Foreign transactions, unexpected PROTECT, plan drift, duplicate identities, wrong state SHA or malformed pin input fail closed. The hotfix lifecycle itself never invokes scheduled or canary.","HEAD:changes/CR-2026-0064/risk.md:3:Primary risk is changing the canonical retention runtime. Mitigation: exact CR0060 preimage SHA, deterministic approved diff, empty transaction journal requirement, five backup locks for runtime replacement, rollback snapshot, synthetic positive/negative pin lifecycle tests, and no destructive invocation in this change. Rollback is allowed only while the journal remains empty.","HEAD:changes/CR-2026-0064/tests.md:8:- pinned PLANNED and DONE transaction lifecycle acceptance","HEAD:changes/CR-2026-0068/implementation.md:16:The bootstrap lifecycle is monotonic and idempotent. Supported install states are ABSENT, ACCESS_READY, and ONLINE_UNSEALED. Existing scoped access is reused; no second token is generated. Access validation uses the issue API family only. Bootstrap creates state before full live assertion. Future command outcomes are never predicted in source; the dynamic ledger is backfilled at apply time.","HEAD:changes/CR-2026-0070/implementation.md:3:Install `/etc/homelab-backup/targets.json` plus `/usr/local/libexec/homelab-backup-target-registry` as the declarative lifecycle source. Replace five current APP/audit/retention runtimes so active VM/APP inventory, owner mapping, APP logical/source metadata, retention keep policy, retired-preserve lifecycle, and systemd expected-state checks come from the registry.","HEAD:changes/CR-2026-0070/implementation.md:5:The retired `app-skladchik-moderator-assistant` is explicit `RETIRED_PRESERVE`: it is not schedulable and retention cannot select it for DELETE. Five historical monitoring timers are explicit `ABSENT` and are healthy only as `not-found/inactive`. No systemd unit, backup, retention GC, cloud object, or guest is mutated by this CR.","HEAD:changes/CR-2026-0070/package.sha256:7:315da18fe0b49fd434e95c908aff552646411577199e4c9e9f31dde970206de5  tasks/backup-target-lifecycle-registry-v1/assets/approved-diffs/homelab-app-cloud-quorum-freshness-probe.diff","HEAD:changes/CR-2026-0070/package.sha256:8:47996e7ac4696db1e3f28f5f39c0dd00abd6f083188098c90c463a40b4502b4c  tasks/backup-target-lifecycle-registry-v1/assets/approved-diffs/homelab-app-cloud-quorum-queue.diff","HEAD:changes/CR-2026-0070/package.sha256:9:6cddcd77dfb1d1a4df9093940ecfd0050262d755512546dd6b8f0089b4149379  tasks/backup-target-lifecycle-registry-v1/assets/approved-diffs/homelab-app-cloud-quorum-worker.diff","HEAD:changes/CR-2026-0070/package.sha256:10:c0339ab239e4377076b1030efd666dbf0da17effd4607e8752aa91e1a003ef95  tasks/backup-target-lifecycle-registry-v1/assets/approved-diffs/homelab-backup-audit.diff","HEAD:changes/CR-2026-0070/package.sha256:11:cd25aa43186302c1ed99fc9762aecff3c49d4dbb247b78fae99242d27ad292eb  tasks/backup-target-lifecycle-registry-v1/assets/approved-diffs/homelab-backup-retention-gc.diff","HEAD:changes/CR-2026-0070/package.sha256:12:e5a0874e9168672aa7dd9d4196b160d25e28341263c6be6838688a028bce37e2  tasks/backup-target-lifecycle-registry-v1/assets/backup-target-registry.json","HEAD:changes/CR-2026-0070/package.sha256:13:2e77c17df19a29084e71af094831e44649f88a6d8d9147844aff54da8301112a  tasks/backup-target-lifecycle-registry-v1/assets/homelab-app-cloud-quorum-freshness-probe","HEAD:changes/CR-2026-0070/package.sha256:14:93905d993cd7552d2141c3e554743be36a72f7cb419cdc3db165d563dd9fa57d  tasks/backup-target-lifecycle-registry-v1/assets/homelab-app-cloud-quorum-queue","HEAD:changes/CR-2026-0070/package.sha256:15:bdacec92dd033fc83bdf45b87362d079f4663d954cc9f0375a76791a4601b76b  tasks/backup-target-lifecycle-registry-v1/assets/homelab-app-cloud-quorum-worker","HEAD:changes/CR-2026-0070/package.sha256:16:4827a3eec23595c2a4d0ae17e91dcd9604102db73c38de9061531223dd132902  tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-audit","HEAD:changes/CR-2026-0070/package.sha256:17:5698c4b03cde557ed103f7f9c51bec17a4ff969ab96a1cb89a7be4ce8e810437  tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-retention-gc","HEAD:changes/CR-2026-0070/package.sha256:18:94ee1e17257b9e64ce951b50cfe20db218e18f2f8aa1b964acd04befaf4fcb2e  tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-target-registry","HEAD:changes/CR-2026-0070/package.sha256:19:380fb826e09b757fd6ebfa9d2b2da7243466c3147909cfa3d2c5231e39d4101d  tasks/backup-target-lifecycle-registry-v1/phases/apply.sh","HEAD:changes/CR-2026-0070/package.sha256:20:3e0c78c3600f1b714682ea5bf2298b255635d925fe5372ba56094161dc058d65  tasks/backup-target-lifecycle-registry-v1/phases/dry-run.sh","HEAD:changes/CR-2026-0070/package.sha256:21:8b3eee5fa157ba3e48e8aab895208efe4130061855c81848a1f82f689e2b4e96  tasks/backup-target-lifecycle-registry-v1/phases/preflight.sh","HEAD:changes/CR-2026-0070/package.sha256:22:46e9c5e85796e3fdfc559be96d60dfd64d772a722b00045015b259ecf5ef2988  tasks/backup-target-lifecycle-registry-v1/phases/prepare.sh","HEAD:changes/CR-2026-0070/package.sha256:23:dad64c5a20eacc7656b2c88f6e8e0b1659630ba1055a39a7d40cd6682854f4ea  tasks/backup-target-lifecycle-registry-v1/phases/rollback.sh","HEAD:changes/CR-2026-0070/package.sha256:24:c09615e5d4956b1078dbf56a5d0afd2fe2f037bd5ff2cbf8e6fac947609ea09b  tasks/backup-target-lifecycle-registry-v1/phases/seal.sh","HEAD:changes/CR-2026-0070/package.sha256:25:c39682d0502cea8e03e07c7624a9c1ccbb073cae498094c1cc8275c4ee3b6545  tasks/backup-target-lifecycle-registry-v1/phases/verify.sh","HEAD:changes/CR-2026-0070/package.sha256:26:0842a4888a2a198dc6ef6864c43d3133b9f7959928f54f9d938abf370ca3802b  tasks/backup-target-lifecycle-registry-v1/task.json","HEAD:changes/CR-2026-0070/package.sha256:27:03e0b829100962b02c32058a9f6bae7243566b4e9c3388a096e4ed9be6a2cbf3  tasks/backup-target-lifecycle-registry-v1/tools/runtime-lib.sh","HEAD:changes/CR-2026-0070/package.sha256:28:4c34665873e4cbe9dda384d1d137b260ddffb536347591b4f52021eb3acc38d6  tasks/backup-target-lifecycle-registry-v1/tools/test_contract.py","HEAD:changes/CR-2026-0070/package.sha256:29:14c7dff3961627f6ecd205da28eb606db87b764464be70e00354603821f59005  tests/test_cr_2026_0070_target_lifecycle_registry.py","HEAD:changes/CR-2026-0070/tests.md:7:- explicit `RETIRED_PRESERVE` semantics;","HEAD:docs/superpowers/plans/2026-08-12-vm170-apps-b-retirement-implementation.md:60:- `tasks/vm170-selected-app-retirement-v1/phases/{preflight,prepare,dry-run,apply,verify,rollback,seal}.sh` \u2014 standard lifecycle.","HEAD:docs/superpowers/plans/2026-08-12-vm170-apps-b-retirement-implementation.md:351:Delete ignored `*.pyc` and empty `__pycache__` directories first. Run `PYTHONDONTWRITEBYTECODE=1 python3 -m pytest -q tests`. The known suite may recreate the CR0029 lifecycle `.pyc`; record that classification, remove it after the successful run, and require zero remaining `*.pyc` before commit.","HEAD:docs/superpowers/plans/2026-08-13-backup-control-coverage-hardening-implementation.md:524:- [ ] **Step 4: Create lifecycle phases**","HEAD:docs/superpowers/plans/2026-08-13-control-refresh-implementation.md:9:**Tech Stack:** Bash, Python 3, jq, git bundle, tar/gzip, sha256sum, rclone, `homelab-admin` schema v2 controlled lifecycle, Python `unittest`.","HEAD:docs/superpowers/plans/2026-08-13-control-refresh-implementation.md:27:- The generated ops bundle must contain the CR0057 source branch at the exact CR0057 source HEAD used for the lifecycle.","HEAD:docs/superpowers/plans/2026-08-13-control-refresh-implementation.md:41:- Every lifecycle phase is a separate operator command; do not combine `prepare`, `dry-run`, `apply`, `verify`, or `seal`.","HEAD:docs/superpowers/plans/2026-08-13-control-refresh-implementation.md:49:- `tasks/backup-control-refresh-v1/task.json` \u2014 controlled-task contract, source-of-truth pins, reads/writes, lifecycle phase map, runtime matrix and no-change assertions.","HEAD:docs/superpowers/plans/2026-08-13-control-refresh-implementation.md:67:- `changes/CR-2026-0057/implementation.md` \u2014 implemented design and lifecycle behavior.","HEAD:docs/superpowers/plans/2026-08-13-control-refresh-implementation.md:69:- `changes/CR-2026-0057/tests.md` \u2014 exact tests and expected lifecycle gates.","HEAD:docs/superpowers/plans/2026-08-13-control-refresh-implementation.md:298:- [ ] **Step 1: Add failing lifecycle contract tests**","HEAD:docs/superpowers/plans/2026-08-13-control-refresh-implementation.md:325:Exact lifecycle:","HEAD:docs/superpowers/plans/2026-08-13-control-refresh-implementation.md:344:Expected: all green; no lifecycle phase has been run.","HEAD:docs/superpowers/plans/2026-08-13-control-refresh-implementation.md:350:git commit -m \"feat(CR-2026-0057): add CONTROL refresh lifecycle\"","HEAD:docs/superpowers/plans/2026-08-13-control-refresh-implementation.md:367:- Produces: auditable CR0057 source package ready for controlled lifecycle.","HEAD:docs/superpowers/plans/2026-08-13-legacy-backup-target-retirement-implementation.md:9:**Tech Stack:** Bash, Python 3, jq, sha256sum, systemd read-only inspection, `homelab-admin` schema v2 controlled lifecycle, Python `unittest`.","HEAD:docs/superpowers/plans/2026-08-13-legacy-backup-target-retirement-implementation.md:29:- MODERATOR-CR0035 generation `vm200-pve03-20260812T050910Z` is historical evidence only and MUST NOT be a CR0058 freshness pin.","HEAD:docs/superpowers/plans/2026-08-13-legacy-backup-target-retirement-implementation.md:31:- Latest read-only witness before source construction (#837): generation `vm200-pve03-20260813T013518Z`, restore-evidence SHA256 `d4824c806b573c2ba430772ee3da019227d69a16a97e45a5c9ef6b2270e09c0c`. This is diagnostic provenance, not a static lifecycle pin.","HEAD:docs/superpowers/plans/2026-08-13-legacy-backup-target-retirement-implementation.md:124:Declare exact reads/writes, five runtime mutation paths, lifecycle phases, new seal path `/var/lib/homelab-admin/seals/legacy-backup-target-retirement-v1.json`, no-change assertions, runtime matrix, source-of-truth pins and CT200 replacement evidence.","HEAD:docs/superpowers/plans/2026-08-13-legacy-backup-target-retirement-implementation.md:203:- [ ] **Step 1: Add failing lifecycle tests**","HEAD:docs/superpowers/plans/2026-08-13-legacy-backup-target-retirement-implementation.md:221:- [ ] **Step 3: Implement lifecycle**","HEAD:docs/superpowers/plans/2026-08-13-legacy-backup-target-retirement-implementation.md:278:git commit -m \"feat(CR-2026-0058): add controlled legacy backup target retirement lifecycle\"","HEAD:docs/superpowers/plans/2026-08-13-legacy-backup-target-retirement-implementation.md:318:- [ ] **Step 4: Exercise lifecycle in fake/runtime harness**","HEAD:docs/superpowers/specs/2026-08-12-vm170-apps-b-retirement-design.md:283:- apply-to-verify phase artifact lifecycle;","HEAD:docs/superpowers/specs/2026-08-13-backup-control-coverage-hardening-design.md:242:- use `homelab-admin` controlled lifecycle only;","HEAD:docs/superpowers/specs/2026-08-13-control-refresh-design.md:101:- full controlled lifecycle completes through seal;","HEAD:docs/superpowers/specs/2026-08-13-legacy-backup-target-retirement-design.md:16:- MODERATOR-CR0035 historically proved generation `vm200-pve03-20260812T050910Z`; that value is historical evidence, not a CR0058 freshness pin.","HEAD:docs/superpowers/specs/2026-08-13-legacy-backup-target-retirement-design.md:18:- Latest read-only observation before source construction (#837) was generation `vm200-pve03-20260813T013518Z`, evidence SHA256 `d4824c806b573c2ba430772ee3da019227d69a16a97e45a5c9ef6b2270e09c0c`; this is a witness, not a static lifecycle pin.","HEAD:docs/superpowers/specs/2026-08-13-legacy-backup-target-retirement-design.md:198:- fake/runtime lifecycle exercise for preflight through seal;","HEAD:errors/regression-cases.json:484:      \"source\": \"CR0070 target lifecycle registry\",","HEAD:errors/regression-cases.json:487:      \"prevention\": \"Install one validated target registry; lifecycle-aware runtimes consume it and source integrity tests reject hard-coded active target arrays.\"","HEAD:errors/regression-cases.json:493:      \"root_cause\": \"Retention had no explicit RETIRED_PRESERVE lifecycle state.\",","HEAD:errors/regression-cases.json:494:      \"prevention\": \"Registry declares retired logicals; retention enumerates them explicitly and emits RETIRED_PRESERVE KEEP decisions with zero DELETE candidates.\"","HEAD:errors/regression-cases.json:500:      \"root_cause\": \"Monitoring compared raw unit presence rather than actual state to desired lifecycle state.\",","HEAD:observed/source-snapshots/dependency-map-latest.tsv:11:npmplus-edge\t192.168.50.24\tcritical\tnpmplus-edge\tok\thomelab-pve01-app-npmplus-edge-20260715T012136Z\tedge-vm,dns,backup\tok","HEAD:tasks/backup-control-coverage-hardening-v1/assets/homelab-backup-audit:398:lifecycle_status=OPEN","HEAD:tasks/backup-control-coverage-hardening-v1/assets/homelab-backup-audit:399:if [[ -s \"$SITE_DR_SEAL\" && ! -L \"$SITE_DR_SEAL\" ]] && [[ \"$(sha256sum \"$SITE_DR_SEAL\" | awk '{print $1}')\" == \"$SITE_DR_SEAL_SHA\" ]] && jq -e '.status==\"SEALED\" and .change_id==\"DR-2026-FINAL\" and .full_site_dr_proven==true and .qemu_boot_restore_proven==true and .ct_boot_restore_proven==true and .provider_worm_proven==false and .provider_worm_skipped_by_policy==true' \"$SITE_DR_SEAL\" >/dev/null; then dr_proof_status=PROVEN; global_dr_proven=YES; lifecycle_status=CLOSED_PROVEN; fi","HEAD:tasks/backup-control-coverage-hardening-v1/assets/homelab-backup-audit:408:printf 'SUMMARY|AUDIT_STATUS=OK|BACKUP_STATUS=%s|DR_PROOF_STATUS=%s|CONTROL_FRESHNESS=%s|LIFECYCLE_STATUS=%s|VM_COUNT=%s|APP_COUNT=%s|FRESH=%s|STALE=%s|RESUME=%s|UNVERIFIED=%s|CONTROL_STATE=%s|CLOUD_OK=%s|SCHEDULER_OK=%s|SOURCE_OK=%s|SOURCE_DRIFT=%s|STAGING_BAD=%s|STAGING_WARN=%s|PAYLOAD_LEAKS=%s|RETENTION_STATUS=%s|GLOBAL_DR_PROVEN=%s\\n' \"$backup_status\" \"$dr_proof_status\" \"$control_status\" \"$lifecycle_status\" \"$vm_seen\" \"$app_seen\" \"$fresh\" \"$stale\" \"$resume\" \"$unverified\" \"$control_status\" \"$cloud_ok\" \"$scheduler_ok\" \"$source_ok\" \"$source_drift\" \"$staging_bad\" \"$staging_warn\" \"$payload_leaks\" \"$retention_status\" \"$global_dr_proven\"","HEAD:tasks/backup-control-coverage-hardening-v1/assets/homelab-backup-audit:413:  jq -n --arg task \"$TASK_ID\" --arg change \"$CHANGE_ID\" --arg at \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\" --arg backup \"$backup_status\" --arg control \"$control_status\" --arg dr \"$dr_proof_status\" --arg lifecycle \"$lifecycle_status\" --arg escrow \"$escrow_status\" --arg staging \"$staging_status\" --arg retention \"$retention_status\" --argjson historical \"$historical_gc_proven\" --argjson owner_gc \"$owner_aware_gc_proven\" --argjson staging_bad \"$staging_bad\" --argjson staging_warn \"$staging_warn\" --argjson vm_count \"$vm_seen\" --argjson app_count \"$app_seen\" --argjson fresh \"$fresh\" --argjson stale \"$stale\" --argjson resume \"$resume\" --argjson unverified \"$unverified\" --argjson cloud_ok \"$cloud_ok\" --argjson scheduler_ok \"$scheduler_ok\" --argjson source_ok \"$source_ok\" --argjson source_drift \"$source_drift\" --argjson payload_leaks \"$payload_leaks\" '{schema:\"homelab-backup-unified-audit-v1\",task_id:$task,change_id:$change,updated_at_utc:$at,audit_status:\"OK\",backup_status:$backup,dr_readiness:$dr,dr_proof_status:$dr,control_freshness:$control,lifecycle_status:$lifecycle,vm_count:$vm_count,app_count:$app_count,fresh_count:$fresh,stale_count:$stale,resume_count:$resume,unverified_count:$unverified,cloud_ok_count:$cloud_ok,scheduler_ok_count:$scheduler_ok,source_ok_count:$source_ok,source_drift_count:$source_drift,payload_leaks:$payload_leaks,control_status:$control,control_source_coverage:\"NOT_MACHINE_PROVEN\",staging_status:$staging,staging_bad_count:$staging_bad,staging_warn_count:$staging_warn,staging_node_count:3,escrow_status:$escrow,retention_status:$retention,historical_gc_proven:$historical,owner_aware_gc_proven:$owner_gc,provider_worm_proven:false,provider_worm_skipped_by_policy:true,clean_machine_bootstrap_proven:($dr==\"PROVEN\"),qemu_boot_restore_proven:($dr==\"PROVEN\"),ct_boot_restore_proven:($dr==\"PROVEN\"),full_site_dr_proven:($dr==\"PROVEN\")}' >\"$tmp\"","HEAD:tasks/backup-control-final-generation-v1/assets/runtime/homelab-backup-audit:407:  jq -n --arg task \"$TASK_ID\" --arg change \"$CHANGE_ID\" --arg at \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\" --arg backup \"$backup_status\" --arg control \"$control_status\" --arg escrow \"$escrow_status\" --arg staging \"$staging_status\" --arg retention \"$retention_status\" --argjson historical \"$historical_gc_proven\" --argjson owner_gc \"$owner_aware_gc_proven\" --argjson staging_bad \"$staging_bad\" --argjson staging_warn \"$staging_warn\" --argjson vm_count \"$vm_seen\" --argjson app_count \"$app_seen\" --argjson fresh \"$fresh\" --argjson stale \"$stale\" --argjson resume \"$resume\" --argjson unverified \"$unverified\" --argjson cloud_ok \"$cloud_ok\" --argjson scheduler_ok \"$scheduler_ok\" --argjson source_ok \"$source_ok\" --argjson source_drift \"$source_drift\" --argjson payload_leaks \"$payload_leaks\" '{schema:\"homelab-backup-unified-audit-v1\",task_id:$task,change_id:$change,updated_at_utc:$at,audit_status:\"OK\",backup_status:$backup,dr_readiness:\"NOT_PROVEN\",lifecycle_status:\"OPEN\",vm_count:$vm_count,app_count:$app_count,fresh_count:$fresh,stale_count:$stale,resume_count:$resume,unverified_count:$unverified,cloud_ok_count:$cloud_ok,scheduler_ok_count:$scheduler_ok,source_ok_count:$source_ok,source_drift_count:$source_drift,payload_leaks:$payload_leaks,control_status:$control,control_source_coverage:\"NOT_MACHINE_PROVEN\",staging_status:$staging,staging_bad_count:$staging_bad,staging_warn_count:$staging_warn,staging_node_count:3,escrow_status:$escrow,retention_status:$retention,historical_gc_proven:$historical,owner_aware_gc_proven:$owner_gc,provider_worm_proven:false,provider_worm_skipped_by_policy:true,clean_machine_bootstrap_proven:false,qemu_boot_restore_proven:false,full_site_dr_proven:false}' >\"$tmp\"","HEAD:tasks/backup-control-refresh-post-legacy-retirement-v1/assets/runtime/homelab-backup-audit:398:lifecycle_status=OPEN","HEAD:tasks/backup-control-refresh-post-legacy-retirement-v1/assets/runtime/homelab-backup-audit:399:if [[ -s \"$SITE_DR_SEAL\" && ! -L \"$SITE_DR_SEAL\" ]] && [[ \"$(sha256sum \"$SITE_DR_SEAL\" | awk '{print $1}')\" == \"$SITE_DR_SEAL_SHA\" ]] && jq -e '.status==\"SEALED\" and .change_id==\"DR-2026-FINAL\" and .full_site_dr_proven==true and .qemu_boot_restore_proven==true and .ct_boot_restore_proven==true and .provider_worm_proven==false and .provider_worm_skipped_by_policy==true' \"$SITE_DR_SEAL\" >/dev/null; then dr_proof_status=PROVEN; global_dr_proven=YES; lifecycle_status=CLOSED_PROVEN; fi","HEAD:tasks/backup-control-refresh-post-legacy-retirement-v1/assets/runtime/homelab-backup-audit:408:printf 'SUMMARY|AUDIT_STATUS=OK|BACKUP_STATUS=%s|DR_PROOF_STATUS=%s|CONTROL_FRESHNESS=%s|LIFECYCLE_STATUS=%s|VM_COUNT=%s|APP_COUNT=%s|FRESH=%s|STALE=%s|RESUME=%s|UNVERIFIED=%s|CONTROL_STATE=%s|CLOUD_OK=%s|SCHEDULER_OK=%s|SOURCE_OK=%s|SOURCE_DRIFT=%s|STAGING_BAD=%s|STAGING_WARN=%s|PAYLOAD_LEAKS=%s|RETENTION_STATUS=%s|GLOBAL_DR_PROVEN=%s\\n' \"$backup_status\" \"$dr_proof_status\" \"$control_status\" \"$lifecycle_status\" \"$vm_seen\" \"$app_seen\" \"$fresh\" \"$stale\" \"$resume\" \"$unverified\" \"$control_status\" \"$cloud_ok\" \"$scheduler_ok\" \"$source_ok\" \"$source_drift\" \"$staging_bad\" \"$staging_warn\" \"$payload_leaks\" \"$retention_status\" \"$global_dr_proven\"","HEAD:tasks/backup-control-refresh-post-legacy-retirement-v1/assets/runtime/homelab-backup-audit:413:  jq -n --arg task \"$TASK_ID\" --arg change \"$CHANGE_ID\" --arg at \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\" --arg backup \"$backup_status\" --arg control \"$control_status\" --arg dr \"$dr_proof_status\" --arg lifecycle \"$lifecycle_status\" --arg escrow \"$escrow_status\" --arg staging \"$staging_status\" --arg retention \"$retention_status\" --argjson historical \"$historical_gc_proven\" --argjson owner_gc \"$owner_aware_gc_proven\" --argjson staging_bad \"$staging_bad\" --argjson staging_warn \"$staging_warn\" --argjson vm_count \"$vm_seen\" --argjson app_count \"$app_seen\" --argjson fresh \"$fresh\" --argjson stale \"$stale\" --argjson resume \"$resume\" --argjson unverified \"$unverified\" --argjson cloud_ok \"$cloud_ok\" --argjson scheduler_ok \"$scheduler_ok\" --argjson source_ok \"$source_ok\" --argjson source_drift \"$source_drift\" --argjson payload_leaks \"$payload_leaks\" '{schema:\"homelab-backup-unified-audit-v1\",task_id:$task,change_id:$change,updated_at_utc:$at,audit_status:\"OK\",backup_status:$backup,dr_readiness:$dr,dr_proof_status:$dr,control_freshness:$control,lifecycle_status:$lifecycle,vm_count:$vm_count,app_count:$app_count,fresh_count:$fresh,stale_count:$stale,resume_count:$resume,unverified_count:$unverified,cloud_ok_count:$cloud_ok,scheduler_ok_count:$scheduler_ok,source_ok_count:$source_ok,source_drift_count:$source_drift,payload_leaks:$payload_leaks,control_status:$control,control_source_coverage:\"NOT_MACHINE_PROVEN\",staging_status:$staging,staging_bad_count:$staging_bad,staging_warn_count:$staging_warn,staging_node_count:3,escrow_status:$escrow,retention_status:$retention,historical_gc_proven:$historical,owner_aware_gc_proven:$owner_gc,provider_worm_proven:false,provider_worm_skipped_by_policy:true,clean_machine_bootstrap_proven:($dr==\"PROVEN\"),qemu_boot_restore_proven:($dr==\"PROVEN\"),ct_boot_restore_proven:($dr==\"PROVEN\"),full_site_dr_proven:($dr==\"PROVEN\")}' >\"$tmp\"","HEAD:tasks/backup-control-refresh-post-legacy-retirement-v1/assets/runtime/homelab-backup-retention-gc:39:    vm130|vm190|vm200) printf 'pve03\\n' ;;","HEAD:tasks/backup-control-refresh-post-legacy-retirement-v1/task.json:178:    \"source_fingerprint_pinned_across_lifecycle\": true,","HEAD:tasks/backup-control-refresh-post-legacy-retirement-v1/task.json:179:    \"source_head_dynamic_at_lifecycle\": true,","HEAD:tasks/backup-control-refresh-post-legacy-retirement-v1/tools/test_contract.py:10:assert t['source_of_truth']['desired_head']=='fe76fd13eb164ebb09706074edaf1185e0d347b0' and t['source_of_truth']['source_fingerprint_pinned_across_lifecycle'] is True","HEAD:tasks/backup-control-refresh-v1/assets/runtime/homelab-backup-audit:398:lifecycle_status=OPEN","HEAD:tasks/backup-control-refresh-v1/assets/runtime/homelab-backup-audit:399:if [[ -s \"$SITE_DR_SEAL\" && ! -L \"$SITE_DR_SEAL\" ]] && [[ \"$(sha256sum \"$SITE_DR_SEAL\" | awk '{print $1}')\" == \"$SITE_DR_SEAL_SHA\" ]] && jq -e '.status==\"SEALED\" and .change_id==\"DR-2026-FINAL\" and .full_site_dr_proven==true and .qemu_boot_restore_proven==true and .ct_boot_restore_proven==true and .provider_worm_proven==false and .provider_worm_skipped_by_policy==true' \"$SITE_DR_SEAL\" >/dev/null; then dr_proof_status=PROVEN; global_dr_proven=YES; lifecycle_status=CLOSED_PROVEN; fi","HEAD:tasks/backup-control-refresh-v1/assets/runtime/homelab-backup-audit:408:printf 'SUMMARY|AUDIT_STATUS=OK|BACKUP_STATUS=%s|DR_PROOF_STATUS=%s|CONTROL_FRESHNESS=%s|LIFECYCLE_STATUS=%s|VM_COUNT=%s|APP_COUNT=%s|FRESH=%s|STALE=%s|RESUME=%s|UNVERIFIED=%s|CONTROL_STATE=%s|CLOUD_OK=%s|SCHEDULER_OK=%s|SOURCE_OK=%s|SOURCE_DRIFT=%s|STAGING_BAD=%s|STAGING_WARN=%s|PAYLOAD_LEAKS=%s|RETENTION_STATUS=%s|GLOBAL_DR_PROVEN=%s\\n' \"$backup_status\" \"$dr_proof_status\" \"$control_status\" \"$lifecycle_status\" \"$vm_seen\" \"$app_seen\" \"$fresh\" \"$stale\" \"$resume\" \"$unverified\" \"$control_status\" \"$cloud_ok\" \"$scheduler_ok\" \"$source_ok\" \"$source_drift\" \"$staging_bad\" \"$staging_warn\" \"$payload_leaks\" \"$retention_status\" \"$global_dr_proven\"","HEAD:tasks/backup-control-refresh-v1/assets/runtime/homelab-backup-audit:413:  jq -n --arg task \"$TASK_ID\" --arg change \"$CHANGE_ID\" --arg at \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\" --arg backup \"$backup_status\" --arg control \"$control_status\" --arg dr \"$dr_proof_status\" --arg lifecycle \"$lifecycle_status\" --arg escrow \"$escrow_status\" --arg staging \"$staging_status\" --arg retention \"$retention_status\" --argjson historical \"$historical_gc_proven\" --argjson owner_gc \"$owner_aware_gc_proven\" --argjson staging_bad \"$staging_bad\" --argjson staging_warn \"$staging_warn\" --argjson vm_count \"$vm_seen\" --argjson app_count \"$app_seen\" --argjson fresh \"$fresh\" --argjson stale \"$stale\" --argjson resume \"$resume\" --argjson unverified \"$unverified\" --argjson cloud_ok \"$cloud_ok\" --argjson scheduler_ok \"$scheduler_ok\" --argjson source_ok \"$source_ok\" --argjson source_drift \"$source_drift\" --argjson payload_leaks \"$payload_leaks\" '{schema:\"homelab-backup-unified-audit-v1\",task_id:$task,change_id:$change,updated_at_utc:$at,audit_status:\"OK\",backup_status:$backup,dr_readiness:$dr,dr_proof_status:$dr,control_freshness:$control,lifecycle_status:$lifecycle,vm_count:$vm_count,app_count:$app_count,fresh_count:$fresh,stale_count:$stale,resume_count:$resume,unverified_count:$unverified,cloud_ok_count:$cloud_ok,scheduler_ok_count:$scheduler_ok,source_ok_count:$source_ok,source_drift_count:$source_drift,payload_leaks:$payload_leaks,control_status:$control,control_source_coverage:\"NOT_MACHINE_PROVEN\",staging_status:$staging,staging_bad_count:$staging_bad,staging_warn_count:$staging_warn,staging_node_count:3,escrow_status:$escrow,retention_status:$retention,historical_gc_proven:$historical,owner_aware_gc_proven:$owner_gc,provider_worm_proven:false,provider_worm_skipped_by_policy:true,clean_machine_bootstrap_proven:($dr==\"PROVEN\"),qemu_boot_restore_proven:($dr==\"PROVEN\"),ct_boot_restore_proven:($dr==\"PROVEN\"),full_site_dr_proven:($dr==\"PROVEN\")}' >\"$tmp\"","HEAD:tasks/backup-control-refresh-v1/assets/runtime/homelab-backup-retention-gc:39:    vm130|vm190|vm200) printf 'pve03\\n' ;;","HEAD:tasks/backup-control-refresh-v1/task.json:171:    \"source_head_dynamic_at_lifecycle\": true,","HEAD:tasks/backup-retention-dynamic-pinned-prune-mailru-cleanup-v1/assets/orchestrator:120:  case \"$logical\" in vm110|vm112|vm150|vm170|vm171) owner=pve01;; vm111|vm113|vm160|vm180|vm9130) owner=pve02;; vm130|vm190|vm200) owner=pve03;; *) fail \"TX_LOGICAL_UNEXPECTED_$logical\";; esac","HEAD:tasks/backup-retention-dynamic-pinned-prune-mailru-cleanup-v1/task.json:108:      \"compile\": \"bash -n phases/assets; homelab-admin lint/validate; Python contract test; fake lifecycle harness\"","HEAD:tasks/backup-retention-pinned-scheduled-scope-hotfix-v1/assets/homelab-backup-retention-gc:39:    vm130|vm190|vm200) printf 'pve03\\n' ;;","HEAD:tasks/backup-retention-pinned-scheduled-scope-hotfix-v1/task.json:53:      \"verification\": \"candidate plan read-only plus synthetic pinned-scope lifecycle tests; no scheduled/canary\"","HEAD:tasks/backup-retention-pinned-scheduled-scope-hotfix-v1/task.json:93:    \"no scheduled or canary action is invoked by this hotfix lifecycle\",","HEAD:tasks/backup-retention-pinned-scheduled-scope-hotfix-v1/task.json:94:    \"transaction journal remains empty throughout hotfix lifecycle\",","HEAD:tasks/backup-retention-pinned-scheduled-scope-hotfix-v1/task.json:103:    \"reason\": \"eliminate pre-scheduled TOCTOU by validating exact pinned delete/transaction lifecycle before lock, under backup locks before resume, and after resume before deletion\",","HEAD:tasks/backup-retention-plan-stability-hotfix-v1/assets/homelab-backup-retention-gc:39:    vm130|vm190|vm200) printf 'pve03\\n' ;;","HEAD:tasks/backup-retention-plan-stability-hotfix-v1/tools/runtime-lib.sh:20:assert_plan(){ local p=\"$1\"; [[ -s \"$p\" && ! -L \"$p\" ]] || die PLAN_MISSING; grep -Fq 'CONTRACT|task=backup-retention-safe-gc-v1|policy=OWNER_AWARE_SAFE_GC' \"$p\" || die PLAN_CONTRACT_MISSING; grep -Eq '^KEEP\\|logical=vm200\\|generation=vm200-pve03-[0-9]{8}T[0-9]{6}Z\\|owner=pve03\\|reason=POLICY_NEWEST_2$' \"$p\" || die PLAN_VM200_KEEP_MISSING; awk -F'[=|]' '/^DELETE\\|/{l=\"\"; for(i=1;i<=NF;i++)if($i==\"logical\")l=$(i+1); if(l!~/^vm[0-9]+$/)bad=1} END{exit bad}' \"$p\" || die NON_VM_DELETE_CANDIDATE; }","HEAD:tasks/backup-retention-remote-list-failclosed-hotfix-v1/assets/homelab-backup-retention-gc:39:    vm130|vm190|vm200) printf 'pve03\\n' ;;","HEAD:tasks/backup-retention-remote-stdin-hotfix-v1/assets/homelab-backup-retention-gc:38:    vm130|vm190|vm200) printf 'pve03\\n' ;;","HEAD:tasks/backup-retention-remote-stdin-hotfix-v1/phases/apply.sh:31:  jq -e '.status==\"OK\" and .root_cause_count==0 and .runtime_replaced==true and .new_sha==\"d5e70fca273e67ec272ea44f73558e28fb707902a09e96497a5fb7cecf4e3336\" and .vm200_planned==true and .gc_started==false and .cloud_writes==false' \"$FAILED/apply.json\" >/dev/null || die FAILED_APPLY_EVIDENCE_INVALID","HEAD:tasks/backup-retention-remote-stdin-hotfix-v1/phases/apply.sh:38:jq -n --argjson resumed \"$resumed\" '{status:\"OK\",root_cause_count:0,production_changed:true,runtime_replaced:true,resumed_existing_runtime:$resumed,recovered_failed_apply_run:(if $resumed then \"20260812T054054Z-1692543-apply\" else null end),old_sha:\"7a6f51f4fb360b31b53dcdd16a296670ae35bdad45a3ef8ff5ebd09d3982d518\",new_sha:\"d5e70fca273e67ec272ea44f73558e28fb707902a09e96497a5fb7cecf4e3336\",vm200_planned:true,gc_started:false,cloud_writes:false}' > \"$HOMELAB_RUN_DIR/apply.json\"","HEAD:tasks/backup-retention-remote-stdin-hotfix-v1/phases/dry-run.sh:13:jq -n '{status:\"OK\",root_cause_count:0,production_changed:false,candidate_plan_complete:true,vm200_planned:true,cloud_reads:true,cloud_writes:false,gc_started:false}' > \"$HOMELAB_RUN_DIR/dry-run.json\"","HEAD:tasks/backup-retention-remote-stdin-hotfix-v1/phases/seal.sh:9:jq -e '.status==\"OK\" and .runtime_verified==true and .remote_logicals_visible==true and .vm200_keep_verified==true and .gc_started==false and .cloud_writes==false' \"$V\" >/dev/null || die VERIFY_EVIDENCE_INVALID","HEAD:tasks/backup-retention-remote-stdin-hotfix-v1/phases/seal.sh:10:mkdir -p \"$(dirname \"$SEAL\")\"; tmp=\"${SEAL}.new.$$\"; jq -n --arg task \"$TASK_ID\" --arg change \"$CHANGE_ID\" --arg at \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\" --arg sha \"$NEW_SHA\" '{status:\"SEALED\",task_id:$task,change_id:$change,sealed_at_utc:$at,runtime_sha256:$sha,remote_stdin_isolated:true,vm200_retention_plan_proven:true,gc_executed:false,cloud_writes:false}' > \"$tmp\"; chmod 0644 \"$tmp\"; mv -f -- \"$tmp\" \"$SEAL\"; SS=\"$(sha \"$SEAL\")\"; jq -n --arg status OK --arg seal \"$SEAL\" --arg sha \"$SS\" '{status:$status,root_cause_count:0,production_changed:true,task_seal:$seal,task_seal_sha256:$sha,cloud_writes:false,gc_started:false}' > \"$HOMELAB_RUN_DIR/seal.json\"; echo \"SEAL_STATUS=OK|RETENTION_STDIN_ISOLATED=YES|VM200_PLAN_PROVEN=YES|GC_STARTED=NO|TASK_SEAL_SHA256=$SS\"","HEAD:tasks/backup-retention-remote-stdin-hotfix-v1/phases/verify.sh:11:test ! -e /var/lib/homelab-backup/retention-safe-gc/transactions/vm200","HEAD:tasks/backup-retention-remote-stdin-hotfix-v1/phases/verify.sh:12:jq -n '{status:\"OK\",root_cause_count:0,production_changed:true,runtime_verified:true,remote_logicals_visible:true,vm200_keep_verified:true,gc_started:false,cloud_writes:false}' > \"$HOMELAB_RUN_DIR/verify.json\"","HEAD:tasks/backup-retention-remote-stdin-hotfix-v1/task.json:49:      \"verification\": \"candidate read-only plan includes remote-owned vm200\"","HEAD:tasks/backup-retention-remote-stdin-hotfix-v1/task.json:59:      \"verification\": \"new runtime plan includes remote-owned VMs and vm200 is retained\"","HEAD:tasks/backup-retention-remote-stdin-hotfix-v1/task.json:101:    \"failure_evidence\": \"CR0035 verify plan stopped after first vm111 state and omitted vm200\",","HEAD:tasks/backup-retention-remote-stdin-hotfix-v1/task.json:102:    \"proof_requirement\": \"candidate and installed plan must contain remote-owned vm200 as POLICY_NEWEST_2 while GC remains unexecuted\",","HEAD:tasks/backup-retention-remote-stdin-hotfix-v1/tools/runtime-lib.sh:17:assert_plan(){ local p=\"$1\"; [[ -s \"$p\" && ! -L \"$p\" ]] || die PLAN_MISSING; grep -Fq 'CONTRACT|task=backup-retention-safe-gc-v1|policy=OWNER_AWARE_SAFE_GC' \"$p\" || die PLAN_CONTRACT_MISSING; for l in vm111 vm113 vm130 vm160 vm180 vm190 vm9130 vm200; do awk -v l=\"$l\" -F'|' '$1==\"KEEP\" || $1==\"PROTECT\" || $1==\"DELETE\" || $1==\"RETIRED\" {for(i=1;i<=NF;i++) if($i==\"logical=\" l){found=1}} END{exit !found}' \"$p\" || die \"PLAN_REMOTE_LOGICAL_MISSING_${l}\"; done; grep -Eq '^KEEP\\|logical=vm200\\|generation=vm200-pve03-[0-9]{8}T[0-9]{6}Z\\|owner=pve03\\|reason=POLICY_NEWEST_2$' \"$p\" || die PLAN_VM200_KEEP_MISSING; }","HEAD:tasks/backup-retention-remote-stdin-hotfix-v1/tools/test_contract.py:8:assert \"vm130|vm190|vm200) printf 'pve03\\\\n' ;;\" in asset","HEAD:tasks/backup-retention-safe-gc-v1/assets/homelab-backup-audit:407:  jq -n --arg task \"$TASK_ID\" --arg change \"$CHANGE_ID\" --arg at \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\" --arg backup \"$backup_status\" --arg control \"$control_status\" --arg escrow \"$escrow_status\" --arg staging \"$staging_status\" --arg retention \"$retention_status\" --argjson historical \"$historical_gc_proven\" --argjson owner_gc \"$owner_aware_gc_proven\" --argjson staging_bad \"$staging_bad\" --argjson staging_warn \"$staging_warn\" --argjson vm_count \"$vm_seen\" --argjson app_count \"$app_seen\" --argjson fresh \"$fresh\" --argjson stale \"$stale\" --argjson resume \"$resume\" --argjson unverified \"$unverified\" --argjson cloud_ok \"$cloud_ok\" --argjson scheduler_ok \"$scheduler_ok\" --argjson source_ok \"$source_ok\" --argjson source_drift \"$source_drift\" --argjson payload_leaks \"$payload_leaks\" '{schema:\"homelab-backup-unified-audit-v1\",task_id:$task,change_id:$change,updated_at_utc:$at,audit_status:\"OK\",backup_status:$backup,dr_readiness:\"NOT_PROVEN\",lifecycle_status:\"OPEN\",vm_count:$vm_count,app_count:$app_count,fresh_count:$fresh,stale_count:$stale,resume_count:$resume,unverified_count:$unverified,cloud_ok_count:$cloud_ok,scheduler_ok_count:$scheduler_ok,source_ok_count:$source_ok,source_drift_count:$source_drift,payload_leaks:$payload_leaks,control_status:$control,control_source_coverage:\"NOT_MACHINE_PROVEN\",staging_status:$staging,staging_bad_count:$staging_bad,staging_warn_count:$staging_warn,staging_node_count:3,escrow_status:$escrow,retention_status:$retention,historical_gc_proven:$historical,owner_aware_gc_proven:$owner_gc,provider_worm_proven:false,provider_worm_skipped_by_policy:true,clean_machine_bootstrap_proven:false,qemu_boot_restore_proven:false,full_site_dr_proven:false}' >\"$tmp\"","HEAD:tasks/backup-retention-transaction-resume-hotfix-v1/assets/homelab-backup-retention-gc:39:    vm130|vm190|vm200) printf 'pve03\\n' ;;","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/approved-diffs/homelab-backup-retention-gc.diff:24:-    vm130|vm190|vm200) printf 'pve03\\n' ;;","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/approved-diffs/homelab-backup-retention-gc.diff:51:+  local now logical node keep lifecycle open_count file json schema lid gen status sha sealed_at epoch age idx candidates=0 protected=0 kept=0","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/approved-diffs/homelab-backup-retention-gc.diff:54:+    lifecycle=\"$(\"$REGISTRY_HELPER\" lifecycle \"$logical\")\" || die \"LIFECYCLE_UNKNOWN_$logical\"","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/approved-diffs/homelab-backup-retention-gc.diff:55:+    if [[ \"$lifecycle\" == ACTIVE ]]; then keep=\"$(keep_for \"$logical\")\" || die \"KEEP_POLICY_UNKNOWN_$logical\"; else keep=0; fi","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/approved-diffs/homelab-backup-retention-gc.diff:59:+    if [[ \"$lifecycle\" == RETIRED_PRESERVE ]]; then","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/approved-diffs/homelab-backup-retention-gc.diff:60:+      while IFS=$'\\t' read -r gen file sha age node sealed_at; do printf 'KEEP|logical=%s|generation=%s|owner=%s|reason=RETIRED_PRESERVE\\n' \"$logical\" \"$gen\" \"$node\"; kept=$((kept+1)); done < <(LC_ALL=C sort -r \"$TMPROOT/$logical.rows\")","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/backup-target-registry.json:9:    {\"kind\":\"VM\",\"id\":\"110\",\"logical_id\":\"vm110\",\"owner\":\"pve01\",\"lifecycle\":\"ACTIVE\"},","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/backup-target-registry.json:10:    {\"kind\":\"VM\",\"id\":\"111\",\"logical_id\":\"vm111\",\"owner\":\"pve02\",\"lifecycle\":\"ACTIVE\"},","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/backup-target-registry.json:11:    {\"kind\":\"VM\",\"id\":\"112\",\"logical_id\":\"vm112\",\"owner\":\"pve01\",\"lifecycle\":\"ACTIVE\"},","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/backup-target-registry.json:12:    {\"kind\":\"VM\",\"id\":\"113\",\"logical_id\":\"vm113\",\"owner\":\"pve02\",\"lifecycle\":\"ACTIVE\"},","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/backup-target-registry.json:13:    {\"kind\":\"VM\",\"id\":\"130\",\"logical_id\":\"vm130\",\"owner\":\"pve03\",\"lifecycle\":\"ACTIVE\"},","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/backup-target-registry.json:14:    {\"kind\":\"VM\",\"id\":\"150\",\"logical_id\":\"vm150\",\"owner\":\"pve01\",\"lifecycle\":\"ACTIVE\"},","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/backup-target-registry.json:15:    {\"kind\":\"VM\",\"id\":\"160\",\"logical_id\":\"vm160\",\"owner\":\"pve02\",\"lifecycle\":\"ACTIVE\"},","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/backup-target-registry.json:16:    {\"kind\":\"VM\",\"id\":\"170\",\"logical_id\":\"vm170\",\"owner\":\"pve01\",\"lifecycle\":\"ACTIVE\"},","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/backup-target-registry.json:17:    {\"kind\":\"VM\",\"id\":\"171\",\"logical_id\":\"vm171\",\"owner\":\"pve01\",\"lifecycle\":\"ACTIVE\"},","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/backup-target-registry.json:18:    {\"kind\":\"VM\",\"id\":\"180\",\"logical_id\":\"vm180\",\"owner\":\"pve02\",\"lifecycle\":\"ACTIVE\"},","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/backup-target-registry.json:19:    {\"kind\":\"VM\",\"id\":\"190\",\"logical_id\":\"vm190\",\"owner\":\"pve03\",\"lifecycle\":\"ACTIVE\"},","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/backup-target-registry.json:20:    {\"kind\":\"VM\",\"id\":\"9130\",\"logical_id\":\"vm9130\",\"owner\":\"pve02\",\"lifecycle\":\"ACTIVE\"},","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/backup-target-registry.json:21:    {\"kind\":\"VM\",\"id\":\"200\",\"logical_id\":\"vm200\",\"owner\":\"pve03\",\"lifecycle\":\"ACTIVE\"},","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/backup-target-registry.json:22:    {\"kind\":\"APP\",\"id\":\"memos\",\"logical_id\":\"app-memos\",\"owner\":\"pve01\",\"source_host\":\"[PRIVATE_IP]\",\"lifecycle\":\"ACTIVE\",\"migrate\":false},","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/backup-target-registry.json:23:    {\"kind\":\"APP\",\"id\":\"filebrowser\",\"logical_id\":\"app-filebrowser\",\"owner\":\"pve01\",\"source_host\":\"[PRIVATE_IP]\",\"lifecycle\":\"ACTIVE\",\"migrate\":true},","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/backup-target-registry.json:24:    {\"kind\":\"APP\",\"id\":\"skladchik-reports-monitor\",\"logical_id\":\"app-skladchik-reports-monitor\",\"owner\":\"pve01\",\"source_host\":\"[PRIVATE_IP]\",\"lifecycle\":\"ACTIVE\",\"migrate\":true},","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/backup-target-registry.json:25:    {\"kind\":\"APP\",\"id\":\"immich\",\"logical_id\":\"app-immich\",\"owner\":\"pve01\",\"source_host\":\"[PRIVATE_IP]\",\"lifecycle\":\"ACTIVE\",\"migrate\":true},","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/backup-target-registry.json:26:    {\"kind\":\"APP\",\"id\":\"hbarhub\",\"logical_id\":\"app-hbarhub\",\"owner\":\"pve01\",\"source_host\":\"[PRIVATE_IP]\",\"lifecycle\":\"ACTIVE\",\"migrate\":true},","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/backup-target-registry.json:27:    {\"kind\":\"APP\",\"id\":\"scrutiny\",\"logical_id\":\"app-scrutiny\",\"owner\":\"pve01\",\"source_host\":\"pve01\",\"lifecycle\":\"ACTIVE\",\"migrate\":true},","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/backup-target-registry.json:28:    {\"kind\":\"APP\",\"id\":\"skladchik-moderator-assistant\",\"logical_id\":\"app-skladchik-moderator-assistant\",\"owner\":\"pve01\",\"lifecycle\":\"RETIRED_PRESERVE\",\"migrate\":false},","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/backup-target-registry.json:29:    {\"kind\":\"CONTROL\",\"id\":\"control-bootstrap-v2\",\"logical_id\":\"control-bootstrap-v2\",\"owner\":\"pve01\",\"lifecycle\":\"ACTIVE\"}","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-audit:400:lifecycle_status=OPEN","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-audit:401:if [[ -s \"$SITE_DR_SEAL\" && ! -L \"$SITE_DR_SEAL\" ]] && [[ \"$(sha256sum \"$SITE_DR_SEAL\" | awk '{print $1}')\" == \"$SITE_DR_SEAL_SHA\" ]] && jq -e '.status==\"SEALED\" and .change_id==\"DR-2026-FINAL\" and .full_site_dr_proven==true and .qemu_boot_restore_proven==true and .ct_boot_restore_proven==true and .provider_worm_proven==false and .provider_worm_skipped_by_policy==true' \"$SITE_DR_SEAL\" >/dev/null; then dr_proof_status=PROVEN; global_dr_proven=YES; lifecycle_status=CLOSED_PROVEN; fi","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-audit:410:printf 'SUMMARY|AUDIT_STATUS=OK|BACKUP_STATUS=%s|DR_PROOF_STATUS=%s|CONTROL_FRESHNESS=%s|LIFECYCLE_STATUS=%s|VM_COUNT=%s|APP_COUNT=%s|FRESH=%s|STALE=%s|RESUME=%s|UNVERIFIED=%s|CONTROL_STATE=%s|CLOUD_OK=%s|SCHEDULER_OK=%s|SOURCE_OK=%s|SOURCE_DRIFT=%s|STAGING_BAD=%s|STAGING_WARN=%s|PAYLOAD_LEAKS=%s|RETENTION_STATUS=%s|GLOBAL_DR_PROVEN=%s\\n' \"$backup_status\" \"$dr_proof_status\" \"$control_status\" \"$lifecycle_status\" \"$vm_seen\" \"$app_seen\" \"$fresh\" \"$stale\" \"$resume\" \"$unverified\" \"$control_status\" \"$cloud_ok\" \"$scheduler_ok\" \"$source_ok\" \"$source_drift\" \"$staging_bad\" \"$staging_warn\" \"$payload_leaks\" \"$retention_status\" \"$global_dr_proven\"","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-audit:415:  jq -n --arg task \"$TASK_ID\" --arg change \"$CHANGE_ID\" --arg at \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\" --arg backup \"$backup_status\" --arg control \"$control_status\" --arg dr \"$dr_proof_status\" --arg lifecycle \"$lifecycle_status\" --arg escrow \"$escrow_status\" --arg staging \"$staging_status\" --arg retention \"$retention_status\" --argjson historical \"$historical_gc_proven\" --argjson owner_gc \"$owner_aware_gc_proven\" --argjson staging_bad \"$staging_bad\" --argjson staging_warn \"$staging_warn\" --argjson vm_count \"$vm_seen\" --argjson app_count \"$app_seen\" --argjson fresh \"$fresh\" --argjson stale \"$stale\" --argjson resume \"$resume\" --argjson unverified \"$unverified\" --argjson cloud_ok \"$cloud_ok\" --argjson scheduler_ok \"$scheduler_ok\" --argjson source_ok \"$source_ok\" --argjson source_drift \"$source_drift\" --argjson payload_leaks \"$payload_leaks\" '{schema:\"homelab-backup-unified-audit-v1\",task_id:$task,change_id:$change,updated_at_utc:$at,audit_status:\"OK\",backup_status:$backup,dr_readiness:$dr,dr_proof_status:$dr,control_freshness:$control,lifecycle_status:$lifecycle,vm_count:$vm_count,app_count:$app_count,fresh_count:$fresh,stale_count:$stale,resume_count:$resume,unverified_count:$unverified,cloud_ok_count:$cloud_ok,scheduler_ok_count:$scheduler_ok,source_ok_count:$source_ok,source_drift_count:$source_drift,payload_leaks:$payload_leaks,control_status:$control,control_source_coverage:\"NOT_MACHINE_PROVEN\",staging_status:$staging,staging_bad_count:$staging_bad,staging_warn_count:$staging_warn,staging_node_count:3,escrow_status:$escrow,retention_status:$retention,historical_gc_proven:$historical,owner_aware_gc_proven:$owner_gc,provider_worm_proven:false,provider_worm_skipped_by_policy:true,clean_machine_bootstrap_proven:($dr==\"PROVEN\"),qemu_boot_restore_proven:($dr==\"PROVEN\"),ct_boot_restore_proven:($dr==\"PROVEN\"),full_site_dr_proven:($dr==\"PROVEN\")}' >\"$tmp\"","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-retention-gc:208:  local now logical node keep lifecycle open_count file json schema lid gen status sha sealed_at epoch age idx candidates=0 protected=0 kept=0","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-retention-gc:213:    lifecycle=\"$(\"$REGISTRY_HELPER\" lifecycle \"$logical\")\" || die \"LIFECYCLE_UNKNOWN_$logical\"","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-retention-gc:214:    if [[ \"$lifecycle\" == ACTIVE ]]; then keep=\"$(keep_for \"$logical\")\" || die \"KEEP_POLICY_UNKNOWN_$logical\"; else keep=0; fi","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-retention-gc:244:    if [[ \"$lifecycle\" == RETIRED_PRESERVE ]]; then","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-retention-gc:245:      while IFS=$'\\t' read -r gen file sha age node sealed_at; do printf 'KEEP|logical=%s|generation=%s|owner=%s|reason=RETIRED_PRESERVE\\n' \"$logical\" \"$gen\" \"$node\"; kept=$((kept+1)); done < <(LC_ALL=C sort -r \"$TMPROOT/$logical.rows\")","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-target-registry:17:    ([.targets[]|select(.kind==\"VM\" and .lifecycle==\"ACTIVE\")]|length)==13 and","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-target-registry:18:    ([.targets[]|select(.kind==\"APP\" and .lifecycle==\"ACTIVE\")]|length)==6 and","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-target-registry:19:    ([.targets[]|select(.kind==\"APP\" and .lifecycle==\"RETIRED_PRESERVE\")]|length)==1 and","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-target-registry:20:    ([.targets[]|select(.kind==\"CONTROL\" and .lifecycle==\"ACTIVE\")]|length)==1 and","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-target-registry:21:    ([.targets[]|select((.kind!=\"VM\" and .kind!=\"APP\" and .kind!=\"CONTROL\") or (.lifecycle!=\"ACTIVE\" and .lifecycle!=\"RETIRED_PRESERVE\"))]|length)==0 and","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-target-registry:27:rows(){ validate; jq -r '.targets[]|[.kind,.id,.logical_id,.owner,.lifecycle,(.source_host//\"\"),((.migrate//false)|tostring)]|@tsv' \"$REGISTRY\"; }","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-target-registry:32:  active-vm-ids) [[ \"$#\" == 1 ]] || die USAGE 64; validate; jq -r '.targets[]|select(.kind==\"VM\" and .lifecycle==\"ACTIVE\")|.id' \"$REGISTRY\" ;;","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-target-registry:33:  active-app-ids) [[ \"$#\" == 1 ]] || die USAGE 64; validate; jq -r '.targets[]|select(.kind==\"APP\" and .lifecycle==\"ACTIVE\")|.id' \"$REGISTRY\" ;;","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-target-registry:34:  migrate-app-ids) [[ \"$#\" == 1 ]] || die USAGE 64; validate; jq -r '.targets[]|select(.kind==\"APP\" and .lifecycle==\"ACTIVE\" and .migrate==true)|.id' \"$REGISTRY\" ;;","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-target-registry:35:  app-active) [[ \"$#\" == 2 ]] || die USAGE 64; find_by_id APP \"$2\" | jq -e '.lifecycle==\"ACTIVE\"' >/dev/null ;;","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-target-registry:36:  app-logical) [[ \"$#\" == 2 ]] || die USAGE 64; find_by_id APP \"$2\" | jq -er 'select(.lifecycle==\"ACTIVE\")|.logical_id' ;;","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-target-registry:37:  app-source-host) [[ \"$#\" == 2 ]] || die USAGE 64; find_by_id APP \"$2\" | jq -er 'select(.lifecycle==\"ACTIVE\")|.source_host' ;;","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-target-registry:39:  lifecycle) [[ \"$#\" == 2 ]] || die USAGE 64; find_by_logical \"$2\" | jq -er '.lifecycle' ;;","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-target-registry:40:  retention-logicals) [[ \"$#\" == 1 ]] || die USAGE 64; validate; jq -r '.targets[]|select(.lifecycle==\"ACTIVE\" or .lifecycle==\"RETIRED_PRESERVE\")|.logical_id' \"$REGISTRY\" ;;","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-target-registry:41:  retention-keep) [[ \"$#\" == 2 ]] || die USAGE 64; rec=\"$(find_by_logical \"$2\")\"; life=\"$(jq -r '.lifecycle' <<<\"$rec\")\"; [[ \"$life\" == ACTIVE ]] || die RETENTION_KEEP_NOT_ACTIVE 64; kind=\"$(jq -r '.kind' <<<\"$rec\")\"; jq -er --arg k \"$kind\" '.policies.retention_keep[$k]' \"$REGISTRY\" ;;","HEAD:tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-target-registry:46:  *) die USAGE_validate_active-vm-ids_active-app-ids_migrate-app-ids_app-active_app-logical_app-source-host_logical-owner_lifecycle_retention-logicals_retention-keep_policy-keep_freshness-seconds_systemd-expectations_rows 64 ;;","HEAD:tasks/backup-target-lifecycle-registry-v1/phases/apply.sh:21:grep -q '^KEEP|logical=app-skladchik-moderator-assistant|.*reason=RETIRED_PRESERVE' \"$installed_plan\" || rollback_after_mutation RETIRED_PRESERVE_NOT_EXPLICIT 70","HEAD:tasks/backup-target-lifecycle-registry-v1/phases/apply.sh:24:printf 'APPLY_STATUS=OK|REGISTRY=INSTALLED|FILES=7|VM=13|APP=6|RETIRED_PRESERVE=1|GC_STARTED=NO|BACKUP_STARTED=NO\\n'","HEAD:tasks/backup-target-lifecycle-registry-v1/phases/dry-run.sh:12:printf 'DRY_RUN_STATUS=OK|VM=13|APP=6|RETIRED_PRESERVE=1|EXPECTED_ABSENT=5|DELETE_SET=UNCHANGED|PRODUCTION_CHANGED=NO\\n'","HEAD:tasks/backup-target-lifecycle-registry-v1/phases/preflight.sh:10:printf 'PREFLIGHT_STATUS=OK|PREIMAGES=5|REGISTRY=ABSENT|DELETE_SET=UNCHANGED|RETIRED_PRESERVE=YES|PRODUCTION_CHANGED=NO\\n'","HEAD:tasks/backup-target-lifecycle-registry-v1/phases/seal.sh:10:if [[ -e \"$SEAL\" ]]; then assert_regular \"$SEAL\"; jq -e --arg h \"$head\" '.status==\"SEALED\" and .change_id==\"CR-2026-0070\" and .task_id==\"backup-target-lifecycle-registry-v1\" and .source_head==$h and .active_vm_count==13 and .active_app_count==6 and .retired_preserve_count==1 and .expected_absent_timers==5 and .retention_delete_set_preserved==true and .systemd_changed==false' \"$SEAL\" >/dev/null || die EXISTING_SEAL_INVALID 75; else tmp=\"${SEAL}.new.$$\"; jq -n --arg h \"$head\" --arg at \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\" --arg registry \"$REGISTRY_SHA\" --arg helper \"$HELPER_SHA\" '{status:\"SEALED\",task_id:\"backup-target-lifecycle-registry-v1\",change_id:\"CR-2026-0070\",sealed_at_utc:$at,source_head:$h,production_changed:true,target_registry_schema:\"homelab-backup-target-registry-v1\",target_registry_sha256:$registry,target_registry_helper_sha256:$helper,active_vm_count:13,active_app_count:6,retired_preserve_count:1,expected_absent_timers:5,retention_delete_set_preserved:true,retired_target_delete_candidates:0,systemd_changed:false,backup_started:false,retention_gc_started:false,cloud_writes:false,rollback_after_seal_allowed:false}' >\"$tmp\"; chmod 0644 \"$tmp\"; mv -f \"$tmp\" \"$SEAL\"; fi","HEAD:tasks/backup-target-lifecycle-registry-v1/phases/verify.sh:9:plan=\"$HOMELAB_RUN_DIR/retention.plan\"; /usr/local/sbin/homelab-backup-retention-gc plan >\"$plan\"; ! grep '^DELETE|logical=app-skladchik-moderator-assistant|' \"$plan\" >/dev/null || die RETIRED_TARGET_DELETE_CANDIDATE; grep -q '^KEEP|logical=app-skladchik-moderator-assistant|.*reason=RETIRED_PRESERVE' \"$plan\" || die RETIRED_PRESERVE_NOT_EXPLICIT","HEAD:tasks/backup-target-lifecycle-registry-v1/task.json:3:  \"task_id\": \"backup-target-lifecycle-registry-v1\",","HEAD:tasks/backup-target-lifecycle-registry-v1/task.json:35:    \"/mnt/staging/homelab-admin-rollback/backup-target-lifecycle-registry-v1\",","HEAD:tasks/backup-target-lifecycle-registry-v1/task.json:43:    \"/var/lib/homelab-admin/seals/backup-target-lifecycle-registry-v1.json\"","HEAD:tasks/backup-target-lifecycle-registry-v1/task.json:46:    \"/mnt/staging/homelab-admin-rollback/backup-target-lifecycle-registry-v1\",","HEAD:tasks/backup-target-lifecycle-registry-v1/task.json:54:    \"/var/lib/homelab-admin/seals/backup-target-lifecycle-registry-v1.json\"","HEAD:tasks/backup-target-lifecycle-registry-v1/task.json:90:      \"verification\": \"CR0070 source identity and canonical lifecycle registry invariants\"","HEAD:tasks/backup-target-lifecycle-registry-v1/task.json:93:      \"path\": \"/var/lib/homelab-admin/seals/backup-target-lifecycle-registry-v1.json\",","HEAD:tasks/backup-target-lifecycle-registry-v1/task.json:116:    \"command\": \"HOMELAB_CONTROLLED_APPLY_CONFIRM=backup-target-lifecycle-registry-v1 /opt/homelab-admin/bin/homelab-admin run TASK_DIR rollback\",","HEAD:tasks/backup-target-lifecycle-registry-v1/tools/runtime-lib.sh:3:TASK_ID=backup-target-lifecycle-registry-v1","HEAD:tasks/backup-target-lifecycle-registry-v1/tools/runtime-lib.sh:16:TASK_LOCK=/run/lock/homelab-backup-target-lifecycle-registry.lock","HEAD:tasks/backup-target-lifecycle-registry-v1/tools/runtime-lib.sh:37:assert_source_clean(){ local r; r=\"$(cd \"$HOMELAB_TASK_DIR/../..\" && pwd -P)\"; [[ \"$(git -C \"$r\" branch --show-current)\" == cr-2026-0070-backup-target-lifecycle-registry ]] || die SOURCE_BRANCH_INVALID 66; [[ -z \"$(git -C \"$r\" status --porcelain=v1 --untracked-files=all)\" ]] || die SOURCE_WORKTREE_DIRTY 66; }","HEAD:tasks/backup-target-lifecycle-registry-v1/tools/runtime-lib.sh:51:compare_delete_sets(){ local dir oldp newp; dir=\"${1:-$HOMELAB_RUN_DIR}\"; oldp=\"$dir/retention-old.plan\"; newp=\"$dir/retention-candidate.plan\"; /usr/local/sbin/homelab-backup-retention-gc plan >\"$oldp\"; HOMELAB_BACKUP_TARGET_REGISTRY=\"$HOMELAB_TASK_DIR/assets/backup-target-registry.json\" HOMELAB_BACKUP_TARGET_REGISTRY_HELPER=\"$HOMELAB_TASK_DIR/assets/homelab-backup-target-registry\" \"$HOMELAB_TASK_DIR/assets/homelab-backup-retention-gc\" plan >\"$newp\"; cmp -s <(normalize_delete \"$oldp\") <(normalize_delete \"$newp\") || die RETENTION_DELETE_SET_CHANGED 66; ! grep '^DELETE|logical=app-skladchik-moderator-assistant|' \"$newp\" >/dev/null || die RETIRED_TARGET_DELETE_CANDIDATE 66; grep -q '^KEEP|logical=app-skladchik-moderator-assistant|.*reason=RETIRED_PRESERVE' \"$newp\" || die RETIRED_PRESERVE_NOT_EXPLICIT 66; }","HEAD:tasks/backup-target-lifecycle-registry-v1/tools/test_contract.py:6:assert task['schema_version']==2 and task['task_id']=='backup-target-lifecycle-registry-v1' and task['production_change'] is True","HEAD:tasks/backup-target-lifecycle-registry-v1/tools/test_contract.py:12:active_vm=[x for x in reg['targets'] if x['kind']=='VM' and x['lifecycle']=='ACTIVE']","HEAD:tasks/backup-target-lifecycle-registry-v1/tools/test_contract.py:13:active_app=[x for x in reg['targets'] if x['kind']=='APP' and x['lifecycle']=='ACTIVE']","HEAD:tasks/backup-target-lifecycle-registry-v1/tools/test_contract.py:14:retired=[x for x in reg['targets'] if x['lifecycle']=='RETIRED_PRESERVE']","HEAD:tasks/backup-target-lifecycle-registry-v1/tools/test_contract.py:24:assert subprocess.check_output([str(helper),'lifecycle','app-skladchik-moderator-assistant'],env=env,text=True).strip()=='RETIRED_PRESERVE'","HEAD:tasks/backup-target-lifecycle-registry-v1/tools/test_contract.py:37:assert 'reason=RETIRED_PRESERVE' in ret and 'retired_preserve=PROTECT' in ret","HEAD:tasks/backup-unified-monitoring-v1/README.md:5:The monitor separates execution health (`AUDIT_STATUS`), current backup data-plane state (`BACKUP_STATUS`), lifecycle gaps (`LIFECYCLE_STATUS`) and site-DR proof (`DR_READINESS`). It does not start backups, restore guests, mutate cloud objects, or claim retention/WORM/clean-machine/QEMU-boot/full-site-DR proof.","HEAD:tasks/backup-unified-monitoring-v1/assets/homelab-backup-audit:396:  jq -n --arg task \"$TASK_ID\" --arg change \"$CHANGE_ID\" --arg at \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\" --arg backup \"$backup_status\" --arg control \"$control_status\" --arg escrow \"$escrow_status\" --arg staging \"$staging_status\" --argjson staging_bad \"$staging_bad\" --argjson staging_warn \"$staging_warn\" --argjson vm_count \"$vm_seen\" --argjson app_count \"$app_seen\" --argjson fresh \"$fresh\" --argjson stale \"$stale\" --argjson resume \"$resume\" --argjson unverified \"$unverified\" --argjson cloud_ok \"$cloud_ok\" --argjson scheduler_ok \"$scheduler_ok\" --argjson source_ok \"$source_ok\" --argjson source_drift \"$source_drift\" --argjson payload_leaks \"$payload_leaks\" '{schema:\"homelab-backup-unified-audit-v1\",task_id:$task,change_id:$change,updated_at_utc:$at,audit_status:\"OK\",backup_status:$backup,dr_readiness:\"NOT_PROVEN\",lifecycle_status:\"OPEN\",vm_count:$vm_count,app_count:$app_count,fresh_count:$fresh,stale_count:$stale,resume_count:$resume,unverified_count:$unverified,cloud_ok_count:$cloud_ok,scheduler_ok_count:$scheduler_ok,source_ok_count:$source_ok,source_drift_count:$source_drift,payload_leaks:$payload_leaks,control_status:$control,control_source_coverage:\"NOT_MACHINE_PROVEN\",staging_status:$staging,staging_bad_count:$staging_bad,staging_warn_count:$staging_warn,staging_node_count:3,escrow_status:$escrow,retention_status:\"OPEN_NOT_IMPLEMENTED\",historical_gc_proven:false,provider_worm_proven:false,provider_worm_skipped_by_policy:true,clean_machine_bootstrap_proven:false,qemu_boot_restore_proven:false,full_site_dr_proven:false}' >\"$tmp\"","HEAD:tasks/gitea-execution-journal-v1/assets/bootstrap-history.json:31:      \"summary\": \"Probe CR lifecycle and anonymous private-repo visibility.\",","HEAD:tasks/gitea-execution-journal-v1/task.json:98:    \"verification\": \"rollback is only a pre-access contingency; once scoped access exists, lifecycle is monotonic resume/ensure; after seal rollback is forbidden\"","HEAD:tasks/homelab-safety-foundation-v1/task.json:63:    \"no Git fetch or push performed by lifecycle\"","HEAD:tasks/legacy-backup-target-retirement-v1/assets/homelab-backup-audit:398:lifecycle_status=OPEN","HEAD:tasks/legacy-backup-target-retirement-v1/assets/homelab-backup-audit:399:if [[ -s \"$SITE_DR_SEAL\" && ! -L \"$SITE_DR_SEAL\" ]] && [[ \"$(sha256sum \"$SITE_DR_SEAL\" | awk '{print $1}')\" == \"$SITE_DR_SEAL_SHA\" ]] && jq -e '.status==\"SEALED\" and .change_id==\"DR-2026-FINAL\" and .full_site_dr_proven==true and .qemu_boot_restore_proven==true and .ct_boot_restore_proven==true and .provider_worm_proven==false and .provider_worm_skipped_by_policy==true' \"$SITE_DR_SEAL\" >/dev/null; then dr_proof_status=PROVEN; global_dr_proven=YES; lifecycle_status=CLOSED_PROVEN; fi","HEAD:tasks/legacy-backup-target-retirement-v1/assets/homelab-backup-audit:408:printf 'SUMMARY|AUDIT_STATUS=OK|BACKUP_STATUS=%s|DR_PROOF_STATUS=%s|CONTROL_FRESHNESS=%s|LIFECYCLE_STATUS=%s|VM_COUNT=%s|APP_COUNT=%s|FRESH=%s|STALE=%s|RESUME=%s|UNVERIFIED=%s|CONTROL_STATE=%s|CLOUD_OK=%s|SCHEDULER_OK=%s|SOURCE_OK=%s|SOURCE_DRIFT=%s|STAGING_BAD=%s|STAGING_WARN=%s|PAYLOAD_LEAKS=%s|RETENTION_STATUS=%s|GLOBAL_DR_PROVEN=%s\\n' \"$backup_status\" \"$dr_proof_status\" \"$control_status\" \"$lifecycle_status\" \"$vm_seen\" \"$app_seen\" \"$fresh\" \"$stale\" \"$resume\" \"$unverified\" \"$control_status\" \"$cloud_ok\" \"$scheduler_ok\" \"$source_ok\" \"$source_drift\" \"$staging_bad\" \"$staging_warn\" \"$payload_leaks\" \"$retention_status\" \"$global_dr_proven\"","HEAD:tasks/legacy-backup-target-retirement-v1/assets/homelab-backup-audit:413:  jq -n --arg task \"$TASK_ID\" --arg change \"$CHANGE_ID\" --arg at \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\" --arg backup \"$backup_status\" --arg control \"$control_status\" --arg dr \"$dr_proof_status\" --arg lifecycle \"$lifecycle_status\" --arg escrow \"$escrow_status\" --arg staging \"$staging_status\" --arg retention \"$retention_status\" --argjson historical \"$historical_gc_proven\" --argjson owner_gc \"$owner_aware_gc_proven\" --argjson staging_bad \"$staging_bad\" --argjson staging_warn \"$staging_warn\" --argjson vm_count \"$vm_seen\" --argjson app_count \"$app_seen\" --argjson fresh \"$fresh\" --argjson stale \"$stale\" --argjson resume \"$resume\" --argjson unverified \"$unverified\" --argjson cloud_ok \"$cloud_ok\" --argjson scheduler_ok \"$scheduler_ok\" --argjson source_ok \"$source_ok\" --argjson source_drift \"$source_drift\" --argjson payload_leaks \"$payload_leaks\" '{schema:\"homelab-backup-unified-audit-v1\",task_id:$task,change_id:$change,updated_at_utc:$at,audit_status:\"OK\",backup_status:$backup,dr_readiness:$dr,dr_proof_status:$dr,control_freshness:$control,lifecycle_status:$lifecycle,vm_count:$vm_count,app_count:$app_count,fresh_count:$fresh,stale_count:$stale,resume_count:$resume,unverified_count:$unverified,cloud_ok_count:$cloud_ok,scheduler_ok_count:$scheduler_ok,source_ok_count:$source_ok,source_drift_count:$source_drift,payload_leaks:$payload_leaks,control_status:$control,control_source_coverage:\"NOT_MACHINE_PROVEN\",staging_status:$staging,staging_bad_count:$staging_bad,staging_warn_count:$staging_warn,staging_node_count:3,escrow_status:$escrow,retention_status:$retention,historical_gc_proven:$historical,owner_aware_gc_proven:$owner_gc,provider_worm_proven:false,provider_worm_skipped_by_policy:true,clean_machine_bootstrap_proven:($dr==\"PROVEN\"),qemu_boot_restore_proven:($dr==\"PROVEN\"),ct_boot_restore_proven:($dr==\"PROVEN\"),full_site_dr_proven:($dr==\"PROVEN\")}' >\"$tmp\"","HEAD:tasks/legacy-backup-target-retirement-v1/assets/homelab-backup-retention-gc:39:    vm130|vm190|vm200) printf 'pve03\\n' ;;","HEAD:tasks/legacy-backup-target-retirement-v1/tools/runtime-lib.sh:67:assert_ct200_proven(){ local owner out dec gen state ev sha_out remote_sha; resolve_ct200_owner; owner=\"$CT200_OWNER\"; sha_out=\"$(node_exec \"$owner\" sha256sum \"$VM_PROBE\")\" || die CT200_VM_PROBE_SHA_READ_FAILED 69; remote_sha=\"$(awk 'NR==1{print $1}' <<<\"$sha_out\")\"; [[ \"$remote_sha\" =~ ^[0-9a-f]{64}$ ]] || die CT200_VM_PROBE_SHA_FORMAT_INVALID 66; [[ \"$remote_sha\" == \"$VM_PROBE_SHA\" ]] || die CT200_VM_PROBE_SHA_DRIFT 66; out=\"$(node_exec \"$owner\" \"$VM_PROBE\" decision 200)\" || die CT200_FRESHNESS_PROBE_FAILED 69; dec=\"$(awk -F= '$1==\"DECISION\"{v=$2} END{print v}' <<<\"$out\")\"; gen=\"$(awk -F= '$1==\"GENERATION\"{v=$2} END{print v}' <<<\"$out\")\"; state=\"$(awk -F= '$1==\"STATE_FILE\"{v=$2} END{print v}' <<<\"$out\")\"; ev=\"$(awk -F= '$1==\"RESTORE_EVIDENCE\"{v=$2} END{print v}' <<<\"$out\")\"; [[ \"$dec\" == SEALED_PROVEN ]] || die CT200_NOT_SEALED_PROVEN 66; [[ \"$gen\" =~ ^vm200-${owner}-[0-9]{8}T[0-9]{6}Z$ ]] || die CT200_GENERATION_INVALID 66; [[ \"$state\" == \"/var/lib/homelab-backup/cloud-quorum/vm200/$gen.json\" ]] || die CT200_STATE_PATH_INVALID 66; [[ \"$ev\" == \"/var/lib/homelab-backup/vm-restore-validation/vm200/$gen.json\" ]] || die CT200_EVIDENCE_PATH_INVALID 66; node_exec \"$owner\" jq -e --arg l vm200 --arg g \"$gen\" --arg s \"$state\" '.schema==\"homelab-vm-restore-validation-v1\" and .logical_id==$l and .generation==$g and .transport_state==\"SEALED\" and .transport_state_file==$s and .restore_source==\"Cloud A\" and .parts_manifest_verified==true and .payload_sha256_verified==true and .payload_decompression_verified==true and .proxmox_config_extract_verified==true and .archive_recovery_readback_verified==true and .bounded_staging==true and .full_local_payload_written==false and .full_restore_proven==false and .result==\"OK\"' \"$ev\" >/dev/null || die CT200_RESTORE_EVIDENCE_INVALID 66; CT200_OWNER=\"$owner\"; CT200_GENERATION=\"$gen\"; CT200_STATE=\"$state\"; CT200_EVIDENCE=\"$ev\"; }","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/assets/pve03-r8152-lifecycle-helper.sh:5:TASK_ID=pve03-r8152-rx-ring-lifecycle-repair-v1","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/assets/pve03-r8152-lifecycle-helper.sh:14:STAGE=/var/lib/homelab-admin/staging/pve03-r8152-rx-ring-lifecycle-repair-v1","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/assets/pve03-r8152-lifecycle-helper.sh:160:  jq -n --arg before_link \"$before_link\" --arg after_link \"$after_link\" --argjson before_rx \"$before_rx\" --argjson after_rx \"$after_rx\" '{status:\"OK\",production_changed:true,lifecycle_repaired:true,script_replaced:true,service_definition_changed:false,rx_ring_changed:false,before_rx:$before_rx,after_rx:$after_rx,before_link:$before_link,after_link:$after_link,service_result:\"success\",service_active:\"active\",service_substate:\"exited\",link_is_failure_gate:false,link_diagnostic_preserved:true,automatic_rollback_triggered:false}' >\"$RESULT\"","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/assets/pve03-r8152-lifecycle-helper.sh:174:  jq -n --arg link \"$link\" --arg quorate \"$quorate\" --argjson current_rx \"$currx\" --argjson nodes \"$nodes\" '{status:\"OK\",production_changed:true,lifecycle_repaired:true,new_script_active:true,service_definition_changed:false,current_rx:$current_rx,rx_ring_changed:false,link_detected:$link,quorate:$quorate,nodes:$nodes,service_result:\"success\",service_active:\"active\",service_substate:\"exited\",link_is_failure_gate:false,link_diagnostic_preserved:true,rollback_payload_retained:true}' >\"$RESULT\"","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/apply.sh:17:jq -e '.status==\"OK\" and .production_changed==true and .lifecycle_repaired==true and .script_replaced==true and .service_definition_changed==false and .rx_ring_changed==false and .before_rx==4096 and .after_rx==4096 and .service_result==\"success\" and .service_active==\"active\" and .service_substate==\"exited\" and .link_is_failure_gate==false and .link_diagnostic_preserved==true and .automatic_rollback_triggered==false' <<<\"$R\" >/dev/null","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/apply.sh:19:jq -n --argjson remote \"$R\" '{status:\"OK\",root_cause_count:0,production_changed:true,pve03_changed:true,lifecycle_repaired:true,remote_result:$remote,canary_seal_unchanged:true,service_definition_changed:false,rx_ring_changed:false,network_restart_executed:false,vmbr0_changed:false}' >\"$HOMELAB_RUN_DIR/apply.json\"","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/dry-run.sh:16:jq -n '{status:\"OK\",root_cause_count:0,production_changed:false,pve03_changed:false,lifecycle_repair_planned:true,script_replace_planned:true,service_definition_change_planned:false,current_rx:4096,target_rx:4096,rx_change_planned:false,link_failure_gate_remove_planned:true,link_diagnostic_preserve_planned:true,network_restart_planned:false}' >\"$HOMELAB_RUN_DIR/dry-run.json\"","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/prepare.sh:11:asset_helper=\"$HOMELAB_TASK_DIR/assets/pve03-r8152-lifecycle-helper.sh\"","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/seal.sh:16:jq -e '.status==\"OK\" and .lifecycle_repaired==true and .remote_result.current_rx==4096 and .remote_result.service_result==\"success\" and .remote_result.link_is_failure_gate==false and .service_definition_changed==false and .rx_ring_changed==false and .canary_seal_unchanged==true and .network_restart_executed==false and .vmbr0_changed==false and .rollback_payload_retained==true' \"$V\" >/dev/null","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/seal.sh:20:jq -n --arg task \"$TASK_ID\" --arg change \"$CHANGE_ID\" --arg sealed \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\" --arg old \"$OLD_SCRIPT_SHA\" --arg new \"$NEW_SCRIPT_SHA\" --arg unit \"$OLD_SERVICE_SHA\" --arg canary \"$CANARY_SHA\" --arg stage \"$REMOTE_STAGE\" --argjson remote \"$R\" '{status:\"SEALED\",task_id:$task,change_id:$change,sealed_at_utc:$sealed,production_changed:true,pve03_changed:true,lifecycle_repaired:true,service_sha256:$unit,old_script_sha256:$old,new_script_sha256:$new,interface:\"nic1\",driver:\"r8152\",target_rx:4096,current_rx:4096,rx_ring_changed:false,service_definition_changed:false,service_result:\"success\",service_active:\"active\",service_substate:\"exited\",link_is_failure_gate:false,link_diagnostic_preserved:true,network_restart_executed:false,vmbr0_changed:false,canary_seal_sha256:$canary,canary_seal_unchanged:true,rollback_payload_retained:true,remote_rollback_stage:$stage,remote_verify:$remote}' >\"$tmp\"","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/seal.sh:24:jq -n --arg sha \"$ss\" '{status:\"OK\",root_cause_count:0,production_changed:true,lifecycle_repaired:true,task_seal_sha256:$sha}' >\"$HOMELAB_RUN_DIR/seal.json\"","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/verify.sh:16:jq -e '.status==\"OK\" and .lifecycle_repaired==true and .new_script_active==true and .service_definition_changed==false and .current_rx==4096 and .rx_ring_changed==false and .link_detected==\"yes\" and .quorate==\"Yes\" and .nodes==3 and .service_result==\"success\" and .service_active==\"active\" and .service_substate==\"exited\" and .link_is_failure_gate==false and .link_diagnostic_preserved==true and .rollback_payload_retained==true' <<<\"$R\" >/dev/null","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/verify.sh:18:jq -e '.status==\"OK\" and .lifecycle_repaired==true and .remote_result.rx_ring_changed==false and .service_definition_changed==false and .canary_seal_unchanged==true and .network_restart_executed==false and .vmbr0_changed==false' \"$A\" >/dev/null","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/verify.sh:20:jq -n --argjson remote \"$R\" '{status:\"OK\",root_cause_count:0,production_changed:true,pve03_changed:true,lifecycle_repaired:true,remote_result:$remote,canary_seal_unchanged:true,service_definition_changed:false,rx_ring_changed:false,network_restart_executed:false,vmbr0_changed:false,rollback_payload_retained:true}' >\"$HOMELAB_RUN_DIR/verify.json\"","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/task.json:3:  \"task_id\": \"pve03-r8152-rx-ring-lifecycle-repair-v1\",","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/task.json:26:    \"ssh:root@[PRIVATE_IP]:/var/lib/homelab-admin/staging/pve03-r8152-rx-ring-lifecycle-repair-v1\",","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/task.json:29:    \"/var/lib/homelab-admin/seals/pve03-r8152-rx-ring-lifecycle-repair-v1.json\"","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/task.json:32:    \"ssh:root@[PRIVATE_IP]:/var/lib/homelab-admin/staging/pve03-r8152-rx-ring-lifecycle-repair-v1\",","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/task.json:35:    \"/var/lib/homelab-admin/seals/pve03-r8152-rx-ring-lifecycle-repair-v1.json\"","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/task.json:71:      \"verification\": \"lifecycle repair sealed with exact source hashes, RX unchanged and CR0015 canary seal unchanged\"","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/task.json:87:    \"command\": \"HOMELAB_CONTROLLED_APPLY_CONFIRM=pve03-r8152-rx-ring-lifecycle-repair-v1 /opt/homelab-admin/bin/homelab-admin run TASK_DIR rollback\",","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/task.json:128:    \"assets/pve03-r8152-lifecycle-helper.sh\"","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/tools/runtime-lib.sh:2:TASK_ID=pve03-r8152-rx-ring-lifecycle-repair-v1","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/tools/runtime-lib.sh:5:REMOTE_STAGE=/var/lib/homelab-admin/staging/pve03-r8152-rx-ring-lifecycle-repair-v1","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/tools/runtime-lib.sh:6:REMOTE_HELPER=$REMOTE_STAGE/pve03-r8152-lifecycle-helper.sh","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/tools/runtime-lib.sh:17:SEAL=/var/lib/homelab-admin/seals/pve03-r8152-rx-ring-lifecycle-repair-v1.json","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/tools/runtime-lib.sh:25:assert_remote_stage(){ local a h n; a=\"$HOMELAB_TASK_DIR/assets/pve03-r8152-lifecycle-helper.sh\"; n=\"$HOMELAB_TASK_DIR/assets/homelab-pve03-r8152-rx-ring\"; h=\"$(ssh \"${SSH_BASE[@]}\" \"$REMOTE_HOST\" /usr/bin/sha256sum \"$REMOTE_HELPER\" | awk '{print $1}')\"; [[ \"$h\" == \"$(sha \"$a\")\" ]] || die REMOTE_HELPER_SHA_BAD; h=\"$(ssh \"${SSH_BASE[@]}\" \"$REMOTE_HOST\" /usr/bin/sha256sum \"$REMOTE_NEW\" | awk '{print $1}')\"; [[ \"$h\" == \"$NEW_SCRIPT_SHA\" && \"$h\" == \"$(sha \"$n\")\" ]] || die REMOTE_NEW_SHA_BAD; ssh \"${SSH_BASE[@]}\" \"$REMOTE_HOST\" /usr/bin/test -s \"$REMOTE_STAGE/baseline.json\" || die REMOTE_BASELINE_MISSING; }","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/tools/test_contract.py:6:helper=(T/\"assets/pve03-r8152-lifecycle-helper.sh\").read_text(encoding=\"utf-8\")","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/tools/test_contract.py:17:subprocess.run([\"bash\",\"-n\",str(T/\"assets/pve03-r8152-lifecycle-helper.sh\")],check=True)","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/tools/test_contract.py:21:assert task[\"task_id\"]==\"pve03-r8152-rx-ring-lifecycle-repair-v1\"","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/assets/homelab-backup-audit:407:  jq -n --arg task \"$TASK_ID\" --arg change \"$CHANGE_ID\" --arg at \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\" --arg backup \"$backup_status\" --arg control \"$control_status\" --arg escrow \"$escrow_status\" --arg staging \"$staging_status\" --arg retention \"$retention_status\" --argjson historical \"$historical_gc_proven\" --argjson owner_gc \"$owner_aware_gc_proven\" --argjson staging_bad \"$staging_bad\" --argjson staging_warn \"$staging_warn\" --argjson vm_count \"$vm_seen\" --argjson app_count \"$app_seen\" --argjson fresh \"$fresh\" --argjson stale \"$stale\" --argjson resume \"$resume\" --argjson unverified \"$unverified\" --argjson cloud_ok \"$cloud_ok\" --argjson scheduler_ok \"$scheduler_ok\" --argjson source_ok \"$source_ok\" --argjson source_drift \"$source_drift\" --argjson payload_leaks \"$payload_leaks\" '{schema:\"homelab-backup-unified-audit-v1\",task_id:$task,change_id:$change,updated_at_utc:$at,audit_status:\"OK\",backup_status:$backup,dr_readiness:\"NOT_PROVEN\",lifecycle_status:\"OPEN\",vm_count:$vm_count,app_count:$app_count,fresh_count:$fresh,stale_count:$stale,resume_count:$resume,unverified_count:$unverified,cloud_ok_count:$cloud_ok,scheduler_ok_count:$scheduler_ok,source_ok_count:$source_ok,source_drift_count:$source_drift,payload_leaks:$payload_leaks,control_status:$control,control_source_coverage:\"NOT_MACHINE_PROVEN\",staging_status:$staging,staging_bad_count:$staging_bad,staging_warn_count:$staging_warn,staging_node_count:3,escrow_status:$escrow,retention_status:$retention,historical_gc_proven:$historical,owner_aware_gc_proven:$owner_gc,provider_worm_proven:false,provider_worm_skipped_by_policy:true,clean_machine_bootstrap_proven:false,qemu_boot_restore_proven:false,full_site_dr_proven:false}' >\"$tmp\"","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/assets/homelab-backup-retention-gc:38:    vm130|vm190|vm200) printf 'pve03\\n' ;;","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/phases/dry-run.sh:20:grep -Fq 'vm200' \"$RETENTION_ASSET\"","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/phases/rollback.sh:27:jq -n --arg status OK '{status:$status,root_cause_count:0,production_changed:true,ct200_destroyed:true,backup_runtime_restored:true,vm_target_count_restored:12,vm200_cloud_backup_preserved:true,vm200_restore_evidence_preserved:true,old_mvp_preserved:true}' > \"$HOMELAB_RUN_DIR/rollback.json\"","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/phases/verify.sh:24:grep -Eq '^(KEEP|PROTECT|DELETE)\\|logical=vm200\\|' \"$retention_out\" || die RETENTION_VM200_MISSING","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/task.json:45:    \"rclone:pve01-mail-01-crypt:homelab-backups/vm200\",","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/task.json:46:    \"rclone:pve01-mail-02-crypt:homelab-backups/vm200\",","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/task.json:55:    \"ssh:root@[PRIVATE_IP]:/var/lib/homelab-backup/cloud-quorum/vm200\",","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/task.json:56:    \"ssh:root@[PRIVATE_IP]:/var/lib/homelab-backup/vm-restore-validation/vm200\"","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/task.json:73:    \"rclone:pve01-mail-01-crypt:homelab-backups/vm200\",","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/task.json:74:    \"rclone:pve01-mail-02-crypt:homelab-backups/vm200\",","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/task.json:80:    \"ssh:root@[PRIVATE_IP]:/var/lib/homelab-backup/cloud-quorum/vm200\",","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/task.json:81:    \"ssh:root@[PRIVATE_IP]:/var/lib/homelab-backup/vm-restore-validation/vm200\"","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/task.json:107:      \"verification\": \"proves CT boot/DNS, vm200 SEALED_PROVEN, retention owner mapping, 13-target audit and zero runtime source drift\"","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/task.json:112:      \"verification\": \"destroys only exact CT200 configuration and restores exact pre-CR runtime bytes while preserving any sealed vm200 cloud generation/evidence\"","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/task.json:139:    \"verification\": \"CT200 absent; exact old queue/probe/worker/audit/retention bytes restored on all relevant nodes; audit returns vm_count=12 and source_drift_count=0; sealed vm200 cloud backup is preserved fail-safe\"","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/task.json:146:    \"cloud objects outside the new vm200 namespace are not mutated\",","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/task.json:181:    \"initial_vm200_backup_required\": true,","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/tools/test_contract.py:33:assert \"vm130|vm190|vm200) printf 'pve03\\\\n' ;;\" in retention","HEAD:tasks/skladchik-moderator-v2-application-v1/task.json:105:      \"compile\": \"remote CT lifecycle helper\"","HEAD:tasks/skladchik-moderator-v2-application-v1/tools/runtime-lib.sh:28:assert_seals(){ assert_regular \"$INFRA_SEAL\"; [[ \"$(sha \"$INFRA_SEAL\")\" == \"$INFRA_SEAL_SHA\" ]] || die INFRA_SEAL_SHA_MISMATCH; jq -e '.status==\"SEALED\" and .ctid==200 and .vm_target_count==13 and .application_v2_installed==false and .cookie_onboarded==false' \"$INFRA_SEAL\" >/dev/null || die INFRA_SEAL_INVALID; assert_regular \"$RETENTION_SEAL\"; [[ \"$(sha \"$RETENTION_SEAL\")\" == \"$RETENTION_SEAL_SHA\" ]] || die RETENTION_SEAL_SHA_MISMATCH; jq -e '.status==\"SEALED\" and .vm200_retention_plan_proven==true and .gc_executed==false' \"$RETENTION_SEAL\" >/dev/null || die RETENTION_SEAL_INVALID; }","HEAD:tasks/skladchik-reports-monitor-controlled-reauth-v1/task.json:234:    \"operator_refresh_lifecycle\": [","HEAD:tests/test_cr_2026_0012_skladchik_cookie_refresh_runbook.py:36:    def test_full_lifecycle_order_is_explicit(self) -> None:","HEAD:tests/test_cr_2026_0035_skladchik_moderator_ct200.py:20:    def test_vm200_is_canonical_lxc_on_pve03(self) -> None:","HEAD:tests/test_cr_2026_0035_skladchik_moderator_ct200.py:27:    def test_audit_and_retention_include_vm200(self) -> None:","HEAD:tests/test_cr_2026_0035_skladchik_moderator_ct200.py:32:        self.assertIn(\"vm130|vm190|vm200) printf 'pve03\\\\n' ;;\", retention)","HEAD:tests/test_cr_2026_0036_skladchik_moderator_v2.py:455:    def test_db_text_encoding_lifecycle_is_independent_and_rollback_safe(self):","HEAD:tests/test_cr_2026_0036_skladchik_moderator_v2.py:513:    def test_rules_hotfix_lifecycle_restages_live_probe_and_rollback_is_seal_safe(self):","HEAD:tests/test_cr_2026_0036_skladchik_moderator_v2.py:560:    def test_collector_hotfix_lifecycle_is_seal_and_rollback_safe(self):","HEAD:tests/test_cr_2026_0057_control_refresh.py:30:    def test_lifecycle_cloud_boundary(self):","HEAD:tests/test_cr_2026_0057_control_refresh.py:36:    def test_source_worktree_must_be_clean_for_lifecycle(self):","HEAD:tests/test_cr_2026_0066_legacy_backup_target_retirement.py:31:        'assert_host(){ log assert_host; }','assert_stage(){ log assert_stage; }','assert_source_clean(){ log assert_source_clean; }','assert_seals(){ log assert_seals; }','assert_live_old(){ log assert_live_old; }','assert_asset_integrity(){ log assert_asset_integrity; }','assert_approved_diffs_old(){ log assert_approved_diffs_old; }','assert_candidate_semantics(){ log assert_candidate_semantics; }','assert_legacy_layout(){ log assert_legacy_layout; }','assert_no_open_legacy_tx(){ log assert_no_open_legacy_tx; }','assert_known_systemd(){ log assert_known_systemd; }','payload_fingerprint_set(){ PAYLOAD_FINGERPRINT=x; }','systemd_fingerprint_set(){ SYSTEMD_FINGERPRINT=y; }','acquire_locks(){ log acquire_locks; }','assert_no_legacy_process(){ log assert_no_legacy_process; }','assert_ct200_proven(){ CT200_OWNER=pve03; CT200_GENERATION=vm200-pve03-20260814T000000Z; CT200_EVIDENCE=/tmp/evidence; }',f'install_candidates(){{ log install_candidates; return {install_rc}; }}','assert_live_new(){ log assert_live_new; }',f'assert_live_semantics(){{ log assert_live_semantics; {post}; }}','restore_preimages(){ log restore_preimages; return 0; }']","HEAD:tests/test_cr_2026_0066_legacy_backup_target_retirement.py:41:    script=f\"set -Eeuo pipefail; HOMELAB_TASK_DIR={shlex.quote(str(TASK))}; source {shlex.quote(str(lib))}; remote_argv_command jq -e --arg g 'vm200-pve03-20260814T000000Z' '.schema==\\\"homelab-vm-restore-validation-v1\\\" and .generation==$g' '/tmp/evidence file.json'; printf '%s\\\\n' \\\"$REMOTE_COMMAND\\\"\"","HEAD:tests/test_cr_2026_0066_legacy_backup_target_retirement.py:42:    r=subprocess.run(['bash','-c',script],text=True,capture_output=True); self.assertEqual(r.returncode,0,r.stderr); cmd=r.stdout.strip(); probe=f\"set -- {cmd}; printf '<%s>\\\\n' \\\"$@\\\"\"; q=subprocess.run(['sh','-c',probe],text=True,capture_output=True); self.assertEqual(q.returncode,0,q.stderr); self.assertEqual(q.stdout.splitlines(),['<jq>','<-e>','<--arg>','<g>','<vm200-pve03-20260814T000000Z>','<.schema==\"homelab-vm-restore-validation-v1\" and .generation==$g>','</tmp/evidence file.json>'])","HEAD:tests/test_cr_2026_0067_final_control_refresh.py:18: def test_source_freshness_across_lifecycle(self):","HEAD:tests/test_cr_2026_0070_target_lifecycle_registry.py:4:TASK=ROOT/'tasks/backup-target-lifecycle-registry-v1'","HEAD:tests/test_cr_2026_0070_target_lifecycle_registry.py:12:        self.assertEqual(len([x for x in t if x['kind']=='VM' and x['lifecycle']=='ACTIVE']),13)","HEAD:tests/test_cr_2026_0070_target_lifecycle_registry.py:13:        self.assertEqual(len([x for x in t if x['kind']=='APP' and x['lifecycle']=='ACTIVE']),6)","HEAD:tests/test_cr_2026_0070_target_lifecycle_registry.py:16:        self.assertEqual(x['lifecycle'],'RETIRED_PRESERVE')","HEAD:tests/test_cr_2026_0070_target_lifecycle_registry.py:29:        self.assertEqual(subprocess.check_output([self.helper,'lifecycle','app-skladchik-moderator-assistant'],env=self.env,text=True).strip(),'RETIRED_PRESERVE')","HEAD:tests/test_cr_2026_0070_target_lifecycle_registry.py:32:        for m in ('PRELOCK','LOCKED_PRE_RESUME','LOCKED_POST_RESUME','REMOTE_LIST_FAILED','RETIRED_PRESERVE'): self.assertIn(m,r)","HEAD:tests/test_cr_2026_0070_target_lifecycle_registry.py:43:        diffdir = ROOT / \"tasks/backup-target-lifecycle-registry-v1/assets/approved-diffs\""],"head":"dbf8266d5f2bc4c87024ea8f0eb5f0e8922c7519","head_commit":"dbf8266d5f2bc4c87024ea8f0eb5f0e8922c7519|2026-08-14T12:04:14+03:00|fix(CR-2026-0070): make approved diffs Git-whitespace safe","hit_files":[{"blob":"b8c98568b40a59c5e452e12835ae1924cba5bab4","path":"changes/CR-2026-0005/plan.md"},{"blob":"17f5adc7d28ce77a2ceeeb26a2541ff10a556958","path":"changes/CR-2026-0006/plan.json"},{"blob":"9faaa5679ff920509f23799ede7f53c8feffb390","path":"changes/CR-2026-0007/plan.json"},{"blob":"69d0bd7ae465aa8bf065d86bfb8d0b1a53ea58ee","path":"changes/CR-2026-0012/plan.json"},{"blob":"c45305eb1066f842fcd621e74ad68a6debd7962d","path":"changes/CR-2026-0030/implementation.md"},{"blob":"9195917b513ef95875bab7c9f9d007a3dbae0dac","path":"changes/CR-2026-0030/tests.md"},{"blob":"470bec45f0ec929fec32615e69b18d75a793347f","path":"changes/CR-2026-0031/risk.md"},{"blob":"043d175b0b3381595ef55ea9322cf58763794f00","path":"changes/CR-2026-0032/README.md"},{"blob":"87fe46bc5f804bd95cfd3f7e83fad2e8afba5b10","path":"changes/CR-2026-0035/implementation.md"},{"blob":"e8b5c8d3e67068b1cd477969ff4b7a6625193db7","path":"changes/CR-2026-0035/risk.md"},{"blob":"77166599150be819387e130677988174a19af59f","path":"changes/CR-2026-0035/tests.md"},{"blob":"ccb02467f67e50f6130ab3dd79f6dfc23f5f045f","path":"changes/CR-2026-0036/implementation.md"},{"blob":"defa021afc732d4e75cce165f7d748bea9317d8f","path":"changes/CR-2026-0049/source-provenance.tsv"},{"blob":"6e8c73d7d1d592bab2b0cb3cae1a551c7a640423","path":"changes/CR-2026-0049/task-package.sha256"},{"blob":"3963f962ced2ca39731680306cd153749616a9b2","path":"changes/CR-2026-0054/implementation.md"},{"blob":"e6e01a0f4a6fddad1dd9665d08d1a97d22c152c2","path":"changes/CR-2026-0054/tests.md"},{"blob":"9322a9c023d35be9f5003cc41ae687f0900f0de7","path":"changes/CR-2026-0057/implementation.md"},{"blob":"3779f6f28b2bdd01e1541121a2f3e5947963c399","path":"changes/CR-2026-0057/tests.md"},{"blob":"a8f4d9dad9be23170b6849b9b6ed9f57b574a68f","path":"changes/CR-2026-0060/implementation.md"},{"blob":"c210e2f145890aa1b04c9fda8593d8394b568b7c","path":"changes/CR-2026-0060/tests.md"},{"blob":"964401ce6097c87e87e0a1a36e5c9e4be136caf7","path":"changes/CR-2026-0064/implementation.md"},{"blob":"d6c047793673a864dc6dbb6b8e5f37c6517f6e29","path":"changes/CR-2026-0064/risk.md"},{"blob":"17c9beed7ec3a4b6114e8e5cccdd10a732a5ef02","path":"changes/CR-2026-0064/tests.md"},{"blob":"13fdb9bd99b1239cf91f55fd05fbbc5e9f31523a","path":"changes/CR-2026-0068/implementation.md"},{"blob":"396c9798872743f32af63f4167f5a9da0aac6d10","path":"changes/CR-2026-0070/implementation.md"},{"blob":"16e7093472088e7008049f7e06662fc7c60b8911","path":"changes/CR-2026-0070/package.sha256"},{"blob":"ac4bd506cc6ffa49518c758c3eaec18011caa2a5","path":"changes/CR-2026-0070/tests.md"},{"blob":"53430b7f739fb98897b04b248cf5e9a66c0991c0","path":"docs/superpowers/plans/2026-08-12-vm170-apps-b-retirement-implementation.md"},{"blob":"e0f59a8c442cbcaddaf69a9fc475e86d68f0886f","path":"docs/superpowers/plans/2026-08-13-backup-control-coverage-hardening-implementation.md"},{"blob":"aa99cb4e9568930cac4c84f9867d82bb94a476a1","path":"docs/superpowers/plans/2026-08-13-control-refresh-implementation.md"},{"blob":"8ac672a6f394500463465bc04c12b743ddfb42d8","path":"docs/superpowers/plans/2026-08-13-legacy-backup-target-retirement-implementation.md"},{"blob":"8bf377cec2719d7f8249407471b18fc6095b838a","path":"docs/superpowers/specs/2026-08-12-vm170-apps-b-retirement-design.md"},{"blob":"860a3ded9369f129c3a761cb702a77bad3118efb","path":"docs/superpowers/specs/2026-08-13-backup-control-coverage-hardening-design.md"},{"blob":"b39bb04840862c37c3b5f93d57cf3c8d3682378c","path":"docs/superpowers/specs/2026-08-13-control-refresh-design.md"},{"blob":"36edd4ad024a74760e58a99f251beabafa6f7ad4","path":"docs/superpowers/specs/2026-08-13-legacy-backup-target-retirement-design.md"},{"blob":"7d83927a47bdfc16e4747c7191000437144d8c7c","path":"errors/regression-cases.json"},{"blob":"1197908146e655657316195a770cae38cef2d6dc","path":"observed/source-snapshots/dependency-map-latest.tsv"},{"blob":"7ca7c24801bffc9bdcb88c20830dec715f4e6f6d","path":"tasks/backup-control-coverage-hardening-v1/assets/homelab-backup-audit"},{"blob":"1769ba9fc3083b65a448e498bfd9714e6832cd7f","path":"tasks/backup-control-final-generation-v1/assets/runtime/homelab-backup-audit"},{"blob":"d3a69ebfbbf532c4668998d676fc704fbe750b49","path":"tasks/backup-control-refresh-post-legacy-retirement-v1/assets/runtime/homelab-backup-audit"},{"blob":"7e7df41a1631b9eff8c644995a04dcd7474e8273","path":"tasks/backup-control-refresh-post-legacy-retirement-v1/assets/runtime/homelab-backup-retention-gc"},{"blob":"a0bc4c7db7302bd340bcb4e463616aed7a12d7fd","path":"tasks/backup-control-refresh-post-legacy-retirement-v1/task.json"},{"blob":"bae9f9ab252621f91ab676888e3eba1c917bb4b3","path":"tasks/backup-control-refresh-post-legacy-retirement-v1/tools/test_contract.py"},{"blob":"7ca7c24801bffc9bdcb88c20830dec715f4e6f6d","path":"tasks/backup-control-refresh-v1/assets/runtime/homelab-backup-audit"},{"blob":"8ed6e4ef527c69dff55f444c78e4a19feaf4c879","path":"tasks/backup-control-refresh-v1/assets/runtime/homelab-backup-retention-gc"},{"blob":"ac4d5b1eb6f1adfd14d48ca26ac37227e4c99513","path":"tasks/backup-control-refresh-v1/task.json"},{"blob":"a2bdac617f46db798c2affd210b6b170d7e7cb29","path":"tasks/backup-retention-dynamic-pinned-prune-mailru-cleanup-v1/assets/orchestrator"},{"blob":"a98651a207d8c0543a12829883ee577c7a7a94f3","path":"tasks/backup-retention-dynamic-pinned-prune-mailru-cleanup-v1/task.json"},{"blob":"f37f9d2494a7a2692ebf1d81bf5b19c124e7c18c","path":"tasks/backup-retention-pinned-scheduled-scope-hotfix-v1/assets/homelab-backup-retention-gc"},{"blob":"6ac8e7165549efd504a1edbe4083b8f68f700537","path":"tasks/backup-retention-pinned-scheduled-scope-hotfix-v1/task.json"},{"blob":"76d6c8eb28f2bd249ba469ab77488b03ce022196","path":"tasks/backup-retention-plan-stability-hotfix-v1/assets/homelab-backup-retention-gc"},{"blob":"c631d5b296b8ecd5810fe4cb60c6f4e6ba3b9c62","path":"tasks/backup-retention-plan-stability-hotfix-v1/tools/runtime-lib.sh"},{"blob":"a88c94ca83e168e0c47cdb16ce527f241c17fb67","path":"tasks/backup-retention-remote-list-failclosed-hotfix-v1/assets/homelab-backup-retention-gc"},{"blob":"7738957cb10a77d88e205111fd71a80fa61bd09f","path":"tasks/backup-retention-remote-stdin-hotfix-v1/assets/homelab-backup-retention-gc"},{"blob":"c5c8ee836c5acd690c1edfbad7968a8a03ed941d","path":"tasks/backup-retention-remote-stdin-hotfix-v1/phases/apply.sh"},{"blob":"486b021a5b538927eb09ca037f480d72bce4279a","path":"tasks/backup-retention-remote-stdin-hotfix-v1/phases/dry-run.sh"},{"blob":"cb33dac623282fdd768166135a52cdfde7051741","path":"tasks/backup-retention-remote-stdin-hotfix-v1/phases/seal.sh"},{"blob":"9c4a6b05b20fd97f5ffff4b30fa2f8fe26365f8f","path":"tasks/backup-retention-remote-stdin-hotfix-v1/phases/verify.sh"},{"blob":"2771655d95130aa7368a919a15e09cc837111111","path":"tasks/backup-retention-remote-stdin-hotfix-v1/task.json"},{"blob":"1cdd318a710104eaaca0cbcf732fae0c1291cb4a","path":"tasks/backup-retention-remote-stdin-hotfix-v1/tools/runtime-lib.sh"},{"blob":"942f1e7cc2191a00cb95cef563f41c6a644b6820","path":"tasks/backup-retention-remote-stdin-hotfix-v1/tools/test_contract.py"},{"blob":"1769ba9fc3083b65a448e498bfd9714e6832cd7f","path":"tasks/backup-retention-safe-gc-v1/assets/homelab-backup-audit"},{"blob":"8ed6e4ef527c69dff55f444c78e4a19feaf4c879","path":"tasks/backup-retention-transaction-resume-hotfix-v1/assets/homelab-backup-retention-gc"},{"blob":"a9c7bedb7f73ae9e19e2d99b40d85da34b4fc7e9","path":"tasks/backup-target-lifecycle-registry-v1/assets/approved-diffs/homelab-backup-retention-gc.diff"},{"blob":"05fde168293652c9f0d17d1d95270c4badb5655c","path":"tasks/backup-target-lifecycle-registry-v1/assets/backup-target-registry.json"},{"blob":"3c1aa2db80cc6e1f5509b46585487c52403b4cc3","path":"tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-audit"},{"blob":"633986dcd6d9e7fc52e2667fd83844b02e2c5bf4","path":"tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-retention-gc"},{"blob":"b9cd5ff228f4131acceb5bc59614d0d1de380a54","path":"tasks/backup-target-lifecycle-registry-v1/assets/homelab-backup-target-registry"},{"blob":"50a4d871ffa10c8ce806dd0ba4e5f9d584c433ee","path":"tasks/backup-target-lifecycle-registry-v1/phases/apply.sh"},{"blob":"2b9cb5c2d95437219ec74bb68a504598c14b1c8c","path":"tasks/backup-target-lifecycle-registry-v1/phases/dry-run.sh"},{"blob":"b6feb8f48b04ec4341c1f4c9d459fdebb1dc27fb","path":"tasks/backup-target-lifecycle-registry-v1/phases/preflight.sh"},{"blob":"1ddf9f9a1992ebdfefe72cb283536e52153bae7d","path":"tasks/backup-target-lifecycle-registry-v1/phases/seal.sh"},{"blob":"424b51ce5cf2e303eacc90c50f2dbcb720fcf8e1","path":"tasks/backup-target-lifecycle-registry-v1/phases/verify.sh"},{"blob":"a7fd425f26f3a61b5bbe5c49aa040ae8700f31db","path":"tasks/backup-target-lifecycle-registry-v1/task.json"},{"blob":"06533a1be3f30b7ef09d1fab800b145f2372131c","path":"tasks/backup-target-lifecycle-registry-v1/tools/runtime-lib.sh"},{"blob":"a65e3959b8daeba179eac38203721c2e2c0e9e32","path":"tasks/backup-target-lifecycle-registry-v1/tools/test_contract.py"},{"blob":"9a7c23eb8ddfa7a63e8aa546d5164529e658f023","path":"tasks/backup-unified-monitoring-v1/README.md"},{"blob":"2280847143ad79c71b77db18bdb1c638bde4e7c3","path":"tasks/backup-unified-monitoring-v1/assets/homelab-backup-audit"},{"blob":"a6ec8d8d46cb5d9ae181cc60db84c7b03f6fad16","path":"tasks/gitea-execution-journal-v1/assets/bootstrap-history.json"},{"blob":"5bb3df0845107727892637455ae502b9fc247e2b","path":"tasks/gitea-execution-journal-v1/task.json"},{"blob":"e9b7f2b689c5a2aa8abd26a24d5d53d1e297574f","path":"tasks/homelab-safety-foundation-v1/task.json"},{"blob":"d3a69ebfbbf532c4668998d676fc704fbe750b49","path":"tasks/legacy-backup-target-retirement-v1/assets/homelab-backup-audit"},{"blob":"7e7df41a1631b9eff8c644995a04dcd7474e8273","path":"tasks/legacy-backup-target-retirement-v1/assets/homelab-backup-retention-gc"},{"blob":"0d091e9e0b3ed362716eac23f0eb5e67645d15d8","path":"tasks/legacy-backup-target-retirement-v1/tools/runtime-lib.sh"},{"blob":"bb4f027cb2018dbe3883f64c507cfbec150092d0","path":"tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/assets/pve03-r8152-lifecycle-helper.sh"},{"blob":"d4bed407e8afb2dc7a35715928170a4499fd1635","path":"tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/apply.sh"},{"blob":"528cb4ccf43258855fea89a1ddcebc6367803c21","path":"tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/dry-run.sh"},{"blob":"1dc06d6fadccaf4b2bc38b64935d7efc3baf036c","path":"tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/prepare.sh"},{"blob":"0854080ad7ff316a409e05bb6ec383d914ce1695","path":"tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/seal.sh"},{"blob":"61a6c56cd7c972c31b593072b444181c9fe8b1dd","path":"tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/verify.sh"},{"blob":"70fc54a265dabad376c98defa0d7b6a5d8e86abf","path":"tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/task.json"},{"blob":"5304252574b3e31165d11d1ddb07c438e6ce486c","path":"tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/tools/runtime-lib.sh"},{"blob":"6eecf9b78607ac0f2799f01e1ae638ee40ff03c2","path":"tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/tools/test_contract.py"},{"blob":"a425ecd524835c669310302126a1d325ae912dd6","path":"tasks/skladchik-moderator-ct200-infrastructure-v1/assets/homelab-backup-audit"},{"blob":"7738957cb10a77d88e205111fd71a80fa61bd09f","path":"tasks/skladchik-moderator-ct200-infrastructure-v1/assets/homelab-backup-retention-gc"},{"blob":"57b6621ce47cd506c7f5e825b5a6bb3728e6332d","path":"tasks/skladchik-moderator-ct200-infrastructure-v1/phases/dry-run.sh"},{"blob":"c8ce6fc5c414a9673a57160ab0f08b5b147af22b","path":"tasks/skladchik-moderator-ct200-infrastructure-v1/phases/rollback.sh"},{"blob":"b565943a9da98d5fbda211ea89cc69f2f4f51bbf","path":"tasks/skladchik-moderator-ct200-infrastructure-v1/phases/verify.sh"},{"blob":"455d5183f71ce6a8b2a6c34d7e5a7616023d203f","path":"tasks/skladchik-moderator-ct200-infrastructure-v1/task.json"},{"blob":"c4d3eac95a1abe0cde1c7cf29e8fd58b7bd130af","path":"tasks/skladchik-moderator-ct200-infrastructure-v1/tools/test_contract.py"},{"blob":"0e7f38b73fd87672d806a23b60272c6548aac845","path":"tasks/skladchik-moderator-v2-application-v1/task.json"},{"blob":"db72a33d3fe6696895d56ae41778dadc10b6a298","path":"tasks/skladchik-moderator-v2-application-v1/tools/runtime-lib.sh"},{"blob":"68ae87029a1660255df02ff192e5b9206e9a6c05","path":"tasks/skladchik-reports-monitor-controlled-reauth-v1/task.json"},{"blob":"aefe7ac6860ec2107c281485b35c8cba1f1196ef","path":"tests/test_cr_2026_0012_skladchik_cookie_refresh_runbook.py"},{"blob":"4b696b282810207e45bb9d2b351a1d22ee37fe93","path":"tests/test_cr_2026_0035_skladchik_moderator_ct200.py"},{"blob":"6888cd3ef05ced3789bb9564b9c2f3b3d337a8f2","path":"tests/test_cr_2026_0036_skladchik_moderator_v2.py"},{"blob":"2964926a43e0d46571e0d320bd8af437d7f49814","path":"tests/test_cr_2026_0057_control_refresh.py"},{"blob":"b17c15e7a17638917007f2d9d78db1089f9e1a76","path":"tests/test_cr_2026_0066_legacy_backup_target_retirement.py"},{"blob":"e75fe9993d0706dab603193e6c493a2bc59841c4","path":"tests/test_cr_2026_0067_final_control_refresh.py"},{"blob":"4c88d5d0d61e4972948cd57e047a07765df38673","path":"tests/test_cr_2026_0070_target_lifecycle_registry.py"}],"label":"CR0070_LIFECYCLE","path":"/root/homelab-ops-cr-2026-0070"},{"branch":"cr-2026-0066-legacy-backup-target-retirement","exists":true,"grep_count":174,"grep_lines":["HEAD:changes/CR-2026-0005/plan.md:10:8. \u041f\u043e\u0441\u043b\u0435 \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0433\u043e CI \u0438 review \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c lifecycle \u0447\u0435\u0440\u0435\u0437 `homelab-admin`.","HEAD:changes/CR-2026-0006/plan.json:20:    \"homelab-admin-lifecycle\"","HEAD:changes/CR-2026-0007/plan.json:21:    \"homelab-admin-lifecycle\"","HEAD:changes/CR-2026-0012/plan.json:9:  \"lifecycle\": [","HEAD:changes/CR-2026-0030/implementation.md:9:The first controlled apply stopped before capture with `HEALTH_STATE_MISSING`. The v2 task had a v2 state namespace but still referenced the v1 health file and retained hardcoded v1 logical-id literals in lifecycle phases. The correction gives v2 its own `/var/lib/homelab-health/control-bootstrap-v2-cloud-quorum.json` health file and changes all active phase logical-id checks/evidence to `control-bootstrap-v2`. The v1 health/state remain immutable and no failed-apply rollback is required because no generation or cloud mutation occurred.","HEAD:changes/CR-2026-0030/tests.md:6:- failed #401 state directory may exist but must contain zero generation JSON files before lifecycle resume;","HEAD:changes/CR-2026-0031/risk.md:4:Scheduler contention during the 12-target Cloud-A backfill may still stop an apply with rc75, but this no longer creates a dead-end lifecycle state: a subsequent controlled apply can resume from partially installed worker/probe bytes and already-written evidence without recapturing or writing cloud data.","HEAD:changes/CR-2026-0032/README.md:5:This change installs a single canonical audit surface for the current 12 VM/CT and 7 APP backup targets plus CONTROL, cloud health, current payload cleanup, scheduler/lock/process state, staging capacity, escrow presence, retention lifecycle and DR proof boundaries.","HEAD:changes/CR-2026-0035/implementation.md:5:The controlled apply creates CT200 on pve03 using the pinned Debian 13 template, 4 vCPU, 6144 MiB RAM, 1024 MiB swap, 40 GiB local-lvm rootfs, unprivileged mode and nesting. It proves boot and DNS, performs an initial vm200 cloud-quorum backup with restore-validation using the candidate worker before changing live backup runtime, then enrolls vm200 in the canonical VM queue/probe/worker/audit/retention runtime on pve01/pve02/pve03 as required.","HEAD:changes/CR-2026-0035/risk.md:11:- first vm200 SEALED backup and restore evidence before live enrollment;","HEAD:changes/CR-2026-0035/risk.md:13:- rollback preserves any already sealed vm200 cloud generation/evidence rather than deleting recovery data;","HEAD:changes/CR-2026-0035/tests.md:14:- Regression: retention candidate requires SSH stdin isolation and live plan must emit vm200 after hotfix.","HEAD:changes/CR-2026-0035/tests.md:15:- Live hotfix proof requires read-only candidate/post-install retention plans to include remote-owned VMIDs and `KEEP|logical=vm200|...|reason=POLICY_NEWEST_2`.","HEAD:changes/CR-2026-0036/implementation.md:50:- Auth-hotfix verify re-stages the pinned offline selftest before remote verification and removes the transient pve03 stage afterward; this closes the apply-to-verify staging lifecycle defect observed in run 20260812T113300Z-2937839-verify.","HEAD:changes/CR-2026-0049/source-provenance.tsv:4:new-script\ttasks/pve03-r8152-rx-ring-lifecycle-repair-v1/assets/homelab-pve03-r8152-rx-ring\td896dce2f9abdebc5f507fd63e4ef6d1d666452c0263469d3dab4d14a6b229af","HEAD:changes/CR-2026-0049/task-package.sha256:1:d896dce2f9abdebc5f507fd63e4ef6d1d666452c0263469d3dab4d14a6b229af  tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/assets/homelab-pve03-r8152-rx-ring","HEAD:changes/CR-2026-0049/task-package.sha256:2:1d773fb2a9a5fdd198569d8d04d65c4bfc9ce98109fed4148b6e46e50d874778  tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/assets/pve03-r8152-lifecycle-helper.sh","HEAD:changes/CR-2026-0049/task-package.sha256:3:50abd763a56d6da15d003474b4e59410dd2fb0d06c82acee762fb93e458a779d  tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/apply.sh","HEAD:changes/CR-2026-0049/task-package.sha256:4:b8e7df6de169b35b53c51764822faecc40b76767505244fbc5b72ef4dc852771  tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/dry-run.sh","HEAD:changes/CR-2026-0049/task-package.sha256:5:1f2c9da85a67737f86fca0ba41d02e2ed5bd0c75f8ebeffac6784c7f94b06aa3  tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/preflight.sh","HEAD:changes/CR-2026-0049/task-package.sha256:6:c34294d41a3d2ef1033ae674790976043174c1b7269b02bf5738891d8a614aa6  tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/prepare.sh","HEAD:changes/CR-2026-0049/task-package.sha256:7:ee1cd4487210ee9c90bdaf8e17809aaf6e17b1b9419746fcf3ae1557be4c659b  tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/rollback.sh","HEAD:changes/CR-2026-0049/task-package.sha256:8:8b1abc57f61fb46e51aa4b7a90d138dc92bbe1dfec210c4a5a952d3e9ad608a5  tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/seal.sh","HEAD:changes/CR-2026-0049/task-package.sha256:9:1f8916517c7480d63f5e2cb0ee208133583975e4aed7f63c7859d62ef1fb92d6  tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/verify.sh","HEAD:changes/CR-2026-0049/task-package.sha256:10:dd8768072688c206043e23d3ce787feb6a74e696aa7c2595f8679371ba24b930  tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/task.json","HEAD:changes/CR-2026-0049/task-package.sha256:11:c3b5f59dcd22b0f931e7cefd89749d562434396e19ae25aba01f0e116bcdb373  tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/tools/runtime-lib.sh","HEAD:changes/CR-2026-0049/task-package.sha256:12:7118284724c4fb8c21dddd6373adfa7569e2d027ec004a279d85a201b019e8a4  tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/tools/test_contract.py","HEAD:changes/CR-2026-0054/implementation.md:7:The future homelab-admin lifecycle is audit-runtime-only. It stages exact old audit bytes for rollback and does not modify retention runtime, APP/VM queues, dispatcher, systemd schedules, cloud generations, guest state, legacy moderator payload or CONTROL generations.","HEAD:changes/CR-2026-0054/tests.md:15:Expected source result: all PASS/GREEN. Validation only; no homelab-admin lifecycle phase is executed in the source-only scope.","HEAD:changes/CR-2026-0057/implementation.md:5:The CR0057 branch is not statically self-pinned in `source-recovery.tsv`, because a final source commit cannot contain its own future commit hash. Instead CR0054/CR0056 refs are statically pinned, the CR0057 worktree must be clean, and the lifecycle dynamically requires the exact current CR0057 branch HEAD to exist in the all-refs Git bundle. Apply is resume-safe if the quorum transport has already deleted the local archive at `DELETE_AUTHORIZED` or completed `SEALED`.","HEAD:changes/CR-2026-0057/tests.md:3:Required gates: package SHA, bash syntax, in-memory Python compile, CR0057 unittest, task contract test, repository full suite with temporary `PYTHONPYCACHEPREFIX`, `git diff --check`, and real `homelab-admin validate`. Production lifecycle is executed only after all source gates are green.","HEAD:changes/CR-2026-0060/implementation.md:3:Replace only the retention runtime. Preserve CR0055 age normalization and CR0056 resume ordering. `remote_generation_present` captures successful `rclone lsf` output first and aborts rc 69 on list failure. Canary post-purge verification uses the same fail-closed principle while listing the stable remote root. The hotfix lifecycle never calls `scheduled` or `canary`.","HEAD:changes/CR-2026-0060/tests.md:3:Manifest, bash syntax, homelab-admin lint, read-only plan and Python contract. Dynamic stubbed-rclone tests prove present rc=0, absent rc=1, and list failure rc=69. Static checks preserve CR0055 plan normalization and CR0056 transaction resume, and prove lifecycle apply/rollback do not invoke scheduled/canary/rclone writes.","HEAD:changes/CR-2026-0064/implementation.md:3:Add an optional exact pinned-delete lifecycle contract to canonical `scheduled`. With no pin environment the timer path is byte-semantically unchanged. With both pin file and SHA supplied, the runtime validates DELETE plus canonical transaction identities at PRELOCK, recalculates and validates again after acquiring backup locks but before transaction resume, then validates after resume before any new delete loop. Foreign transactions, unexpected PROTECT, plan drift, duplicate identities, wrong state SHA or malformed pin input fail closed. The hotfix lifecycle itself never invokes scheduled or canary.","HEAD:changes/CR-2026-0064/risk.md:3:Primary risk is changing the canonical retention runtime. Mitigation: exact CR0060 preimage SHA, deterministic approved diff, empty transaction journal requirement, five backup locks for runtime replacement, rollback snapshot, synthetic positive/negative pin lifecycle tests, and no destructive invocation in this change. Rollback is allowed only while the journal remains empty.","HEAD:changes/CR-2026-0064/tests.md:8:- pinned PLANNED and DONE transaction lifecycle acceptance","HEAD:docs/superpowers/plans/2026-08-12-vm170-apps-b-retirement-implementation.md:60:- `tasks/vm170-selected-app-retirement-v1/phases/{preflight,prepare,dry-run,apply,verify,rollback,seal}.sh` \u2014 standard lifecycle.","HEAD:docs/superpowers/plans/2026-08-12-vm170-apps-b-retirement-implementation.md:351:Delete ignored `*.pyc` and empty `__pycache__` directories first. Run `PYTHONDONTWRITEBYTECODE=1 python3 -m pytest -q tests`. The known suite may recreate the CR0029 lifecycle `.pyc`; record that classification, remove it after the successful run, and require zero remaining `*.pyc` before commit.","HEAD:docs/superpowers/plans/2026-08-13-backup-control-coverage-hardening-implementation.md:524:- [ ] **Step 4: Create lifecycle phases**","HEAD:docs/superpowers/plans/2026-08-13-control-refresh-implementation.md:9:**Tech Stack:** Bash, Python 3, jq, git bundle, tar/gzip, sha256sum, rclone, `homelab-admin` schema v2 controlled lifecycle, Python `unittest`.","HEAD:docs/superpowers/plans/2026-08-13-control-refresh-implementation.md:27:- The generated ops bundle must contain the CR0057 source branch at the exact CR0057 source HEAD used for the lifecycle.","HEAD:docs/superpowers/plans/2026-08-13-control-refresh-implementation.md:41:- Every lifecycle phase is a separate operator command; do not combine `prepare`, `dry-run`, `apply`, `verify`, or `seal`.","HEAD:docs/superpowers/plans/2026-08-13-control-refresh-implementation.md:49:- `tasks/backup-control-refresh-v1/task.json` \u2014 controlled-task contract, source-of-truth pins, reads/writes, lifecycle phase map, runtime matrix and no-change assertions.","HEAD:docs/superpowers/plans/2026-08-13-control-refresh-implementation.md:67:- `changes/CR-2026-0057/implementation.md` \u2014 implemented design and lifecycle behavior.","HEAD:docs/superpowers/plans/2026-08-13-control-refresh-implementation.md:69:- `changes/CR-2026-0057/tests.md` \u2014 exact tests and expected lifecycle gates.","HEAD:docs/superpowers/plans/2026-08-13-control-refresh-implementation.md:298:- [ ] **Step 1: Add failing lifecycle contract tests**","HEAD:docs/superpowers/plans/2026-08-13-control-refresh-implementation.md:325:Exact lifecycle:","HEAD:docs/superpowers/plans/2026-08-13-control-refresh-implementation.md:344:Expected: all green; no lifecycle phase has been run.","HEAD:docs/superpowers/plans/2026-08-13-control-refresh-implementation.md:350:git commit -m \"feat(CR-2026-0057): add CONTROL refresh lifecycle\"","HEAD:docs/superpowers/plans/2026-08-13-control-refresh-implementation.md:367:- Produces: auditable CR0057 source package ready for controlled lifecycle.","HEAD:docs/superpowers/plans/2026-08-13-legacy-backup-target-retirement-implementation.md:9:**Tech Stack:** Bash, Python 3, jq, sha256sum, systemd read-only inspection, `homelab-admin` schema v2 controlled lifecycle, Python `unittest`.","HEAD:docs/superpowers/plans/2026-08-13-legacy-backup-target-retirement-implementation.md:29:- MODERATOR-CR0035 generation `vm200-pve03-20260812T050910Z` is historical evidence only and MUST NOT be a CR0058 freshness pin.","HEAD:docs/superpowers/plans/2026-08-13-legacy-backup-target-retirement-implementation.md:31:- Latest read-only witness before source construction (#837): generation `vm200-pve03-20260813T013518Z`, restore-evidence SHA256 `d4824c806b573c2ba430772ee3da019227d69a16a97e45a5c9ef6b2270e09c0c`. This is diagnostic provenance, not a static lifecycle pin.","HEAD:docs/superpowers/plans/2026-08-13-legacy-backup-target-retirement-implementation.md:124:Declare exact reads/writes, five runtime mutation paths, lifecycle phases, new seal path `/var/lib/homelab-admin/seals/legacy-backup-target-retirement-v1.json`, no-change assertions, runtime matrix, source-of-truth pins and CT200 replacement evidence.","HEAD:docs/superpowers/plans/2026-08-13-legacy-backup-target-retirement-implementation.md:203:- [ ] **Step 1: Add failing lifecycle tests**","HEAD:docs/superpowers/plans/2026-08-13-legacy-backup-target-retirement-implementation.md:221:- [ ] **Step 3: Implement lifecycle**","HEAD:docs/superpowers/plans/2026-08-13-legacy-backup-target-retirement-implementation.md:278:git commit -m \"feat(CR-2026-0058): add controlled legacy backup target retirement lifecycle\"","HEAD:docs/superpowers/plans/2026-08-13-legacy-backup-target-retirement-implementation.md:318:- [ ] **Step 4: Exercise lifecycle in fake/runtime harness**","HEAD:docs/superpowers/specs/2026-08-12-vm170-apps-b-retirement-design.md:283:- apply-to-verify phase artifact lifecycle;","HEAD:docs/superpowers/specs/2026-08-13-backup-control-coverage-hardening-design.md:242:- use `homelab-admin` controlled lifecycle only;","HEAD:docs/superpowers/specs/2026-08-13-control-refresh-design.md:101:- full controlled lifecycle completes through seal;","HEAD:docs/superpowers/specs/2026-08-13-legacy-backup-target-retirement-design.md:16:- MODERATOR-CR0035 historically proved generation `vm200-pve03-20260812T050910Z`; that value is historical evidence, not a CR0058 freshness pin.","HEAD:docs/superpowers/specs/2026-08-13-legacy-backup-target-retirement-design.md:18:- Latest read-only observation before source construction (#837) was generation `vm200-pve03-20260813T013518Z`, evidence SHA256 `d4824c806b573c2ba430772ee3da019227d69a16a97e45a5c9ef6b2270e09c0c`; this is a witness, not a static lifecycle pin.","HEAD:docs/superpowers/specs/2026-08-13-legacy-backup-target-retirement-design.md:198:- fake/runtime lifecycle exercise for preflight through seal;","HEAD:observed/source-snapshots/dependency-map-latest.tsv:11:npmplus-edge\t192.168.50.24\tcritical\tnpmplus-edge\tok\thomelab-pve01-app-npmplus-edge-20260715T012136Z\tedge-vm,dns,backup\tok","HEAD:tasks/backup-control-coverage-hardening-v1/assets/homelab-backup-audit:398:lifecycle_status=OPEN","HEAD:tasks/backup-control-coverage-hardening-v1/assets/homelab-backup-audit:399:if [[ -s \"$SITE_DR_SEAL\" && ! -L \"$SITE_DR_SEAL\" ]] && [[ \"$(sha256sum \"$SITE_DR_SEAL\" | awk '{print $1}')\" == \"$SITE_DR_SEAL_SHA\" ]] && jq -e '.status==\"SEALED\" and .change_id==\"DR-2026-FINAL\" and .full_site_dr_proven==true and .qemu_boot_restore_proven==true and .ct_boot_restore_proven==true and .provider_worm_proven==false and .provider_worm_skipped_by_policy==true' \"$SITE_DR_SEAL\" >/dev/null; then dr_proof_status=PROVEN; global_dr_proven=YES; lifecycle_status=CLOSED_PROVEN; fi","HEAD:tasks/backup-control-coverage-hardening-v1/assets/homelab-backup-audit:408:printf 'SUMMARY|AUDIT_STATUS=OK|BACKUP_STATUS=%s|DR_PROOF_STATUS=%s|CONTROL_FRESHNESS=%s|LIFECYCLE_STATUS=%s|VM_COUNT=%s|APP_COUNT=%s|FRESH=%s|STALE=%s|RESUME=%s|UNVERIFIED=%s|CONTROL_STATE=%s|CLOUD_OK=%s|SCHEDULER_OK=%s|SOURCE_OK=%s|SOURCE_DRIFT=%s|STAGING_BAD=%s|STAGING_WARN=%s|PAYLOAD_LEAKS=%s|RETENTION_STATUS=%s|GLOBAL_DR_PROVEN=%s\\n' \"$backup_status\" \"$dr_proof_status\" \"$control_status\" \"$lifecycle_status\" \"$vm_seen\" \"$app_seen\" \"$fresh\" \"$stale\" \"$resume\" \"$unverified\" \"$control_status\" \"$cloud_ok\" \"$scheduler_ok\" \"$source_ok\" \"$source_drift\" \"$staging_bad\" \"$staging_warn\" \"$payload_leaks\" \"$retention_status\" \"$global_dr_proven\"","HEAD:tasks/backup-control-coverage-hardening-v1/assets/homelab-backup-audit:413:  jq -n --arg task \"$TASK_ID\" --arg change \"$CHANGE_ID\" --arg at \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\" --arg backup \"$backup_status\" --arg control \"$control_status\" --arg dr \"$dr_proof_status\" --arg lifecycle \"$lifecycle_status\" --arg escrow \"$escrow_status\" --arg staging \"$staging_status\" --arg retention \"$retention_status\" --argjson historical \"$historical_gc_proven\" --argjson owner_gc \"$owner_aware_gc_proven\" --argjson staging_bad \"$staging_bad\" --argjson staging_warn \"$staging_warn\" --argjson vm_count \"$vm_seen\" --argjson app_count \"$app_seen\" --argjson fresh \"$fresh\" --argjson stale \"$stale\" --argjson resume \"$resume\" --argjson unverified \"$unverified\" --argjson cloud_ok \"$cloud_ok\" --argjson scheduler_ok \"$scheduler_ok\" --argjson source_ok \"$source_ok\" --argjson source_drift \"$source_drift\" --argjson payload_leaks \"$payload_leaks\" '{schema:\"homelab-backup-unified-audit-v1\",task_id:$task,change_id:$change,updated_at_utc:$at,audit_status:\"OK\",backup_status:$backup,dr_readiness:$dr,dr_proof_status:$dr,control_freshness:$control,lifecycle_status:$lifecycle,vm_count:$vm_count,app_count:$app_count,fresh_count:$fresh,stale_count:$stale,resume_count:$resume,unverified_count:$unverified,cloud_ok_count:$cloud_ok,scheduler_ok_count:$scheduler_ok,source_ok_count:$source_ok,source_drift_count:$source_drift,payload_leaks:$payload_leaks,control_status:$control,control_source_coverage:\"NOT_MACHINE_PROVEN\",staging_status:$staging,staging_bad_count:$staging_bad,staging_warn_count:$staging_warn,staging_node_count:3,escrow_status:$escrow,retention_status:$retention,historical_gc_proven:$historical,owner_aware_gc_proven:$owner_gc,provider_worm_proven:false,provider_worm_skipped_by_policy:true,clean_machine_bootstrap_proven:($dr==\"PROVEN\"),qemu_boot_restore_proven:($dr==\"PROVEN\"),ct_boot_restore_proven:($dr==\"PROVEN\"),full_site_dr_proven:($dr==\"PROVEN\")}' >\"$tmp\"","HEAD:tasks/backup-control-final-generation-v1/assets/runtime/homelab-backup-audit:407:  jq -n --arg task \"$TASK_ID\" --arg change \"$CHANGE_ID\" --arg at \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\" --arg backup \"$backup_status\" --arg control \"$control_status\" --arg escrow \"$escrow_status\" --arg staging \"$staging_status\" --arg retention \"$retention_status\" --argjson historical \"$historical_gc_proven\" --argjson owner_gc \"$owner_aware_gc_proven\" --argjson staging_bad \"$staging_bad\" --argjson staging_warn \"$staging_warn\" --argjson vm_count \"$vm_seen\" --argjson app_count \"$app_seen\" --argjson fresh \"$fresh\" --argjson stale \"$stale\" --argjson resume \"$resume\" --argjson unverified \"$unverified\" --argjson cloud_ok \"$cloud_ok\" --argjson scheduler_ok \"$scheduler_ok\" --argjson source_ok \"$source_ok\" --argjson source_drift \"$source_drift\" --argjson payload_leaks \"$payload_leaks\" '{schema:\"homelab-backup-unified-audit-v1\",task_id:$task,change_id:$change,updated_at_utc:$at,audit_status:\"OK\",backup_status:$backup,dr_readiness:\"NOT_PROVEN\",lifecycle_status:\"OPEN\",vm_count:$vm_count,app_count:$app_count,fresh_count:$fresh,stale_count:$stale,resume_count:$resume,unverified_count:$unverified,cloud_ok_count:$cloud_ok,scheduler_ok_count:$scheduler_ok,source_ok_count:$source_ok,source_drift_count:$source_drift,payload_leaks:$payload_leaks,control_status:$control,control_source_coverage:\"NOT_MACHINE_PROVEN\",staging_status:$staging,staging_bad_count:$staging_bad,staging_warn_count:$staging_warn,staging_node_count:3,escrow_status:$escrow,retention_status:$retention,historical_gc_proven:$historical,owner_aware_gc_proven:$owner_gc,provider_worm_proven:false,provider_worm_skipped_by_policy:true,clean_machine_bootstrap_proven:false,qemu_boot_restore_proven:false,full_site_dr_proven:false}' >\"$tmp\"","HEAD:tasks/backup-control-refresh-v1/assets/runtime/homelab-backup-audit:398:lifecycle_status=OPEN","HEAD:tasks/backup-control-refresh-v1/assets/runtime/homelab-backup-audit:399:if [[ -s \"$SITE_DR_SEAL\" && ! -L \"$SITE_DR_SEAL\" ]] && [[ \"$(sha256sum \"$SITE_DR_SEAL\" | awk '{print $1}')\" == \"$SITE_DR_SEAL_SHA\" ]] && jq -e '.status==\"SEALED\" and .change_id==\"DR-2026-FINAL\" and .full_site_dr_proven==true and .qemu_boot_restore_proven==true and .ct_boot_restore_proven==true and .provider_worm_proven==false and .provider_worm_skipped_by_policy==true' \"$SITE_DR_SEAL\" >/dev/null; then dr_proof_status=PROVEN; global_dr_proven=YES; lifecycle_status=CLOSED_PROVEN; fi","HEAD:tasks/backup-control-refresh-v1/assets/runtime/homelab-backup-audit:408:printf 'SUMMARY|AUDIT_STATUS=OK|BACKUP_STATUS=%s|DR_PROOF_STATUS=%s|CONTROL_FRESHNESS=%s|LIFECYCLE_STATUS=%s|VM_COUNT=%s|APP_COUNT=%s|FRESH=%s|STALE=%s|RESUME=%s|UNVERIFIED=%s|CONTROL_STATE=%s|CLOUD_OK=%s|SCHEDULER_OK=%s|SOURCE_OK=%s|SOURCE_DRIFT=%s|STAGING_BAD=%s|STAGING_WARN=%s|PAYLOAD_LEAKS=%s|RETENTION_STATUS=%s|GLOBAL_DR_PROVEN=%s\\n' \"$backup_status\" \"$dr_proof_status\" \"$control_status\" \"$lifecycle_status\" \"$vm_seen\" \"$app_seen\" \"$fresh\" \"$stale\" \"$resume\" \"$unverified\" \"$control_status\" \"$cloud_ok\" \"$scheduler_ok\" \"$source_ok\" \"$source_drift\" \"$staging_bad\" \"$staging_warn\" \"$payload_leaks\" \"$retention_status\" \"$global_dr_proven\"","HEAD:tasks/backup-control-refresh-v1/assets/runtime/homelab-backup-audit:413:  jq -n --arg task \"$TASK_ID\" --arg change \"$CHANGE_ID\" --arg at \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\" --arg backup \"$backup_status\" --arg control \"$control_status\" --arg dr \"$dr_proof_status\" --arg lifecycle \"$lifecycle_status\" --arg escrow \"$escrow_status\" --arg staging \"$staging_status\" --arg retention \"$retention_status\" --argjson historical \"$historical_gc_proven\" --argjson owner_gc \"$owner_aware_gc_proven\" --argjson staging_bad \"$staging_bad\" --argjson staging_warn \"$staging_warn\" --argjson vm_count \"$vm_seen\" --argjson app_count \"$app_seen\" --argjson fresh \"$fresh\" --argjson stale \"$stale\" --argjson resume \"$resume\" --argjson unverified \"$unverified\" --argjson cloud_ok \"$cloud_ok\" --argjson scheduler_ok \"$scheduler_ok\" --argjson source_ok \"$source_ok\" --argjson source_drift \"$source_drift\" --argjson payload_leaks \"$payload_leaks\" '{schema:\"homelab-backup-unified-audit-v1\",task_id:$task,change_id:$change,updated_at_utc:$at,audit_status:\"OK\",backup_status:$backup,dr_readiness:$dr,dr_proof_status:$dr,control_freshness:$control,lifecycle_status:$lifecycle,vm_count:$vm_count,app_count:$app_count,fresh_count:$fresh,stale_count:$stale,resume_count:$resume,unverified_count:$unverified,cloud_ok_count:$cloud_ok,scheduler_ok_count:$scheduler_ok,source_ok_count:$source_ok,source_drift_count:$source_drift,payload_leaks:$payload_leaks,control_status:$control,control_source_coverage:\"NOT_MACHINE_PROVEN\",staging_status:$staging,staging_bad_count:$staging_bad,staging_warn_count:$staging_warn,staging_node_count:3,escrow_status:$escrow,retention_status:$retention,historical_gc_proven:$historical,owner_aware_gc_proven:$owner_gc,provider_worm_proven:false,provider_worm_skipped_by_policy:true,clean_machine_bootstrap_proven:($dr==\"PROVEN\"),qemu_boot_restore_proven:($dr==\"PROVEN\"),ct_boot_restore_proven:($dr==\"PROVEN\"),full_site_dr_proven:($dr==\"PROVEN\")}' >\"$tmp\"","HEAD:tasks/backup-control-refresh-v1/assets/runtime/homelab-backup-retention-gc:39:    vm130|vm190|vm200) printf 'pve03\\n' ;;","HEAD:tasks/backup-control-refresh-v1/task.json:171:    \"source_head_dynamic_at_lifecycle\": true,","HEAD:tasks/backup-retention-dynamic-pinned-prune-mailru-cleanup-v1/assets/orchestrator:120:  case \"$logical\" in vm110|vm112|vm150|vm170|vm171) owner=pve01;; vm111|vm113|vm160|vm180|vm9130) owner=pve02;; vm130|vm190|vm200) owner=pve03;; *) fail \"TX_LOGICAL_UNEXPECTED_$logical\";; esac","HEAD:tasks/backup-retention-dynamic-pinned-prune-mailru-cleanup-v1/task.json:108:      \"compile\": \"bash -n phases/assets; homelab-admin lint/validate; Python contract test; fake lifecycle harness\"","HEAD:tasks/backup-retention-pinned-scheduled-scope-hotfix-v1/assets/homelab-backup-retention-gc:39:    vm130|vm190|vm200) printf 'pve03\\n' ;;","HEAD:tasks/backup-retention-pinned-scheduled-scope-hotfix-v1/task.json:53:      \"verification\": \"candidate plan read-only plus synthetic pinned-scope lifecycle tests; no scheduled/canary\"","HEAD:tasks/backup-retention-pinned-scheduled-scope-hotfix-v1/task.json:93:    \"no scheduled or canary action is invoked by this hotfix lifecycle\",","HEAD:tasks/backup-retention-pinned-scheduled-scope-hotfix-v1/task.json:94:    \"transaction journal remains empty throughout hotfix lifecycle\",","HEAD:tasks/backup-retention-pinned-scheduled-scope-hotfix-v1/task.json:103:    \"reason\": \"eliminate pre-scheduled TOCTOU by validating exact pinned delete/transaction lifecycle before lock, under backup locks before resume, and after resume before deletion\",","HEAD:tasks/backup-retention-plan-stability-hotfix-v1/assets/homelab-backup-retention-gc:39:    vm130|vm190|vm200) printf 'pve03\\n' ;;","HEAD:tasks/backup-retention-plan-stability-hotfix-v1/tools/runtime-lib.sh:20:assert_plan(){ local p=\"$1\"; [[ -s \"$p\" && ! -L \"$p\" ]] || die PLAN_MISSING; grep -Fq 'CONTRACT|task=backup-retention-safe-gc-v1|policy=OWNER_AWARE_SAFE_GC' \"$p\" || die PLAN_CONTRACT_MISSING; grep -Eq '^KEEP\\|logical=vm200\\|generation=vm200-pve03-[0-9]{8}T[0-9]{6}Z\\|owner=pve03\\|reason=POLICY_NEWEST_2$' \"$p\" || die PLAN_VM200_KEEP_MISSING; awk -F'[=|]' '/^DELETE\\|/{l=\"\"; for(i=1;i<=NF;i++)if($i==\"logical\")l=$(i+1); if(l!~/^vm[0-9]+$/)bad=1} END{exit bad}' \"$p\" || die NON_VM_DELETE_CANDIDATE; }","HEAD:tasks/backup-retention-remote-list-failclosed-hotfix-v1/assets/homelab-backup-retention-gc:39:    vm130|vm190|vm200) printf 'pve03\\n' ;;","HEAD:tasks/backup-retention-remote-stdin-hotfix-v1/assets/homelab-backup-retention-gc:38:    vm130|vm190|vm200) printf 'pve03\\n' ;;","HEAD:tasks/backup-retention-remote-stdin-hotfix-v1/phases/apply.sh:31:  jq -e '.status==\"OK\" and .root_cause_count==0 and .runtime_replaced==true and .new_sha==\"d5e70fca273e67ec272ea44f73558e28fb707902a09e96497a5fb7cecf4e3336\" and .vm200_planned==true and .gc_started==false and .cloud_writes==false' \"$FAILED/apply.json\" >/dev/null || die FAILED_APPLY_EVIDENCE_INVALID","HEAD:tasks/backup-retention-remote-stdin-hotfix-v1/phases/apply.sh:38:jq -n --argjson resumed \"$resumed\" '{status:\"OK\",root_cause_count:0,production_changed:true,runtime_replaced:true,resumed_existing_runtime:$resumed,recovered_failed_apply_run:(if $resumed then \"20260812T054054Z-1692543-apply\" else null end),old_sha:\"7a6f51f4fb360b31b53dcdd16a296670ae35bdad45a3ef8ff5ebd09d3982d518\",new_sha:\"d5e70fca273e67ec272ea44f73558e28fb707902a09e96497a5fb7cecf4e3336\",vm200_planned:true,gc_started:false,cloud_writes:false}' > \"$HOMELAB_RUN_DIR/apply.json\"","HEAD:tasks/backup-retention-remote-stdin-hotfix-v1/phases/dry-run.sh:13:jq -n '{status:\"OK\",root_cause_count:0,production_changed:false,candidate_plan_complete:true,vm200_planned:true,cloud_reads:true,cloud_writes:false,gc_started:false}' > \"$HOMELAB_RUN_DIR/dry-run.json\"","HEAD:tasks/backup-retention-remote-stdin-hotfix-v1/phases/seal.sh:9:jq -e '.status==\"OK\" and .runtime_verified==true and .remote_logicals_visible==true and .vm200_keep_verified==true and .gc_started==false and .cloud_writes==false' \"$V\" >/dev/null || die VERIFY_EVIDENCE_INVALID","HEAD:tasks/backup-retention-remote-stdin-hotfix-v1/phases/seal.sh:10:mkdir -p \"$(dirname \"$SEAL\")\"; tmp=\"${SEAL}.new.$$\"; jq -n --arg task \"$TASK_ID\" --arg change \"$CHANGE_ID\" --arg at \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\" --arg sha \"$NEW_SHA\" '{status:\"SEALED\",task_id:$task,change_id:$change,sealed_at_utc:$at,runtime_sha256:$sha,remote_stdin_isolated:true,vm200_retention_plan_proven:true,gc_executed:false,cloud_writes:false}' > \"$tmp\"; chmod 0644 \"$tmp\"; mv -f -- \"$tmp\" \"$SEAL\"; SS=\"$(sha \"$SEAL\")\"; jq -n --arg status OK --arg seal \"$SEAL\" --arg sha \"$SS\" '{status:$status,root_cause_count:0,production_changed:true,task_seal:$seal,task_seal_sha256:$sha,cloud_writes:false,gc_started:false}' > \"$HOMELAB_RUN_DIR/seal.json\"; echo \"SEAL_STATUS=OK|RETENTION_STDIN_ISOLATED=YES|VM200_PLAN_PROVEN=YES|GC_STARTED=NO|TASK_SEAL_SHA256=$SS\"","HEAD:tasks/backup-retention-remote-stdin-hotfix-v1/phases/verify.sh:11:test ! -e /var/lib/homelab-backup/retention-safe-gc/transactions/vm200","HEAD:tasks/backup-retention-remote-stdin-hotfix-v1/phases/verify.sh:12:jq -n '{status:\"OK\",root_cause_count:0,production_changed:true,runtime_verified:true,remote_logicals_visible:true,vm200_keep_verified:true,gc_started:false,cloud_writes:false}' > \"$HOMELAB_RUN_DIR/verify.json\"","HEAD:tasks/backup-retention-remote-stdin-hotfix-v1/task.json:49:      \"verification\": \"candidate read-only plan includes remote-owned vm200\"","HEAD:tasks/backup-retention-remote-stdin-hotfix-v1/task.json:59:      \"verification\": \"new runtime plan includes remote-owned VMs and vm200 is retained\"","HEAD:tasks/backup-retention-remote-stdin-hotfix-v1/task.json:101:    \"failure_evidence\": \"CR0035 verify plan stopped after first vm111 state and omitted vm200\",","HEAD:tasks/backup-retention-remote-stdin-hotfix-v1/task.json:102:    \"proof_requirement\": \"candidate and installed plan must contain remote-owned vm200 as POLICY_NEWEST_2 while GC remains unexecuted\",","HEAD:tasks/backup-retention-remote-stdin-hotfix-v1/tools/runtime-lib.sh:17:assert_plan(){ local p=\"$1\"; [[ -s \"$p\" && ! -L \"$p\" ]] || die PLAN_MISSING; grep -Fq 'CONTRACT|task=backup-retention-safe-gc-v1|policy=OWNER_AWARE_SAFE_GC' \"$p\" || die PLAN_CONTRACT_MISSING; for l in vm111 vm113 vm130 vm160 vm180 vm190 vm9130 vm200; do awk -v l=\"$l\" -F'|' '$1==\"KEEP\" || $1==\"PROTECT\" || $1==\"DELETE\" || $1==\"RETIRED\" {for(i=1;i<=NF;i++) if($i==\"logical=\" l){found=1}} END{exit !found}' \"$p\" || die \"PLAN_REMOTE_LOGICAL_MISSING_${l}\"; done; grep -Eq '^KEEP\\|logical=vm200\\|generation=vm200-pve03-[0-9]{8}T[0-9]{6}Z\\|owner=pve03\\|reason=POLICY_NEWEST_2$' \"$p\" || die PLAN_VM200_KEEP_MISSING; }","HEAD:tasks/backup-retention-remote-stdin-hotfix-v1/tools/test_contract.py:8:assert \"vm130|vm190|vm200) printf 'pve03\\\\n' ;;\" in asset","HEAD:tasks/backup-retention-safe-gc-v1/assets/homelab-backup-audit:407:  jq -n --arg task \"$TASK_ID\" --arg change \"$CHANGE_ID\" --arg at \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\" --arg backup \"$backup_status\" --arg control \"$control_status\" --arg escrow \"$escrow_status\" --arg staging \"$staging_status\" --arg retention \"$retention_status\" --argjson historical \"$historical_gc_proven\" --argjson owner_gc \"$owner_aware_gc_proven\" --argjson staging_bad \"$staging_bad\" --argjson staging_warn \"$staging_warn\" --argjson vm_count \"$vm_seen\" --argjson app_count \"$app_seen\" --argjson fresh \"$fresh\" --argjson stale \"$stale\" --argjson resume \"$resume\" --argjson unverified \"$unverified\" --argjson cloud_ok \"$cloud_ok\" --argjson scheduler_ok \"$scheduler_ok\" --argjson source_ok \"$source_ok\" --argjson source_drift \"$source_drift\" --argjson payload_leaks \"$payload_leaks\" '{schema:\"homelab-backup-unified-audit-v1\",task_id:$task,change_id:$change,updated_at_utc:$at,audit_status:\"OK\",backup_status:$backup,dr_readiness:\"NOT_PROVEN\",lifecycle_status:\"OPEN\",vm_count:$vm_count,app_count:$app_count,fresh_count:$fresh,stale_count:$stale,resume_count:$resume,unverified_count:$unverified,cloud_ok_count:$cloud_ok,scheduler_ok_count:$scheduler_ok,source_ok_count:$source_ok,source_drift_count:$source_drift,payload_leaks:$payload_leaks,control_status:$control,control_source_coverage:\"NOT_MACHINE_PROVEN\",staging_status:$staging,staging_bad_count:$staging_bad,staging_warn_count:$staging_warn,staging_node_count:3,escrow_status:$escrow,retention_status:$retention,historical_gc_proven:$historical,owner_aware_gc_proven:$owner_gc,provider_worm_proven:false,provider_worm_skipped_by_policy:true,clean_machine_bootstrap_proven:false,qemu_boot_restore_proven:false,full_site_dr_proven:false}' >\"$tmp\"","HEAD:tasks/backup-retention-transaction-resume-hotfix-v1/assets/homelab-backup-retention-gc:39:    vm130|vm190|vm200) printf 'pve03\\n' ;;","HEAD:tasks/backup-unified-monitoring-v1/README.md:5:The monitor separates execution health (`AUDIT_STATUS`), current backup data-plane state (`BACKUP_STATUS`), lifecycle gaps (`LIFECYCLE_STATUS`) and site-DR proof (`DR_READINESS`). It does not start backups, restore guests, mutate cloud objects, or claim retention/WORM/clean-machine/QEMU-boot/full-site-DR proof.","HEAD:tasks/backup-unified-monitoring-v1/assets/homelab-backup-audit:396:  jq -n --arg task \"$TASK_ID\" --arg change \"$CHANGE_ID\" --arg at \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\" --arg backup \"$backup_status\" --arg control \"$control_status\" --arg escrow \"$escrow_status\" --arg staging \"$staging_status\" --argjson staging_bad \"$staging_bad\" --argjson staging_warn \"$staging_warn\" --argjson vm_count \"$vm_seen\" --argjson app_count \"$app_seen\" --argjson fresh \"$fresh\" --argjson stale \"$stale\" --argjson resume \"$resume\" --argjson unverified \"$unverified\" --argjson cloud_ok \"$cloud_ok\" --argjson scheduler_ok \"$scheduler_ok\" --argjson source_ok \"$source_ok\" --argjson source_drift \"$source_drift\" --argjson payload_leaks \"$payload_leaks\" '{schema:\"homelab-backup-unified-audit-v1\",task_id:$task,change_id:$change,updated_at_utc:$at,audit_status:\"OK\",backup_status:$backup,dr_readiness:\"NOT_PROVEN\",lifecycle_status:\"OPEN\",vm_count:$vm_count,app_count:$app_count,fresh_count:$fresh,stale_count:$stale,resume_count:$resume,unverified_count:$unverified,cloud_ok_count:$cloud_ok,scheduler_ok_count:$scheduler_ok,source_ok_count:$source_ok,source_drift_count:$source_drift,payload_leaks:$payload_leaks,control_status:$control,control_source_coverage:\"NOT_MACHINE_PROVEN\",staging_status:$staging,staging_bad_count:$staging_bad,staging_warn_count:$staging_warn,staging_node_count:3,escrow_status:$escrow,retention_status:\"OPEN_NOT_IMPLEMENTED\",historical_gc_proven:false,provider_worm_proven:false,provider_worm_skipped_by_policy:true,clean_machine_bootstrap_proven:false,qemu_boot_restore_proven:false,full_site_dr_proven:false}' >\"$tmp\"","HEAD:tasks/legacy-backup-target-retirement-v1/assets/homelab-backup-audit:398:lifecycle_status=OPEN","HEAD:tasks/legacy-backup-target-retirement-v1/assets/homelab-backup-audit:399:if [[ -s \"$SITE_DR_SEAL\" && ! -L \"$SITE_DR_SEAL\" ]] && [[ \"$(sha256sum \"$SITE_DR_SEAL\" | awk '{print $1}')\" == \"$SITE_DR_SEAL_SHA\" ]] && jq -e '.status==\"SEALED\" and .change_id==\"DR-2026-FINAL\" and .full_site_dr_proven==true and .qemu_boot_restore_proven==true and .ct_boot_restore_proven==true and .provider_worm_proven==false and .provider_worm_skipped_by_policy==true' \"$SITE_DR_SEAL\" >/dev/null; then dr_proof_status=PROVEN; global_dr_proven=YES; lifecycle_status=CLOSED_PROVEN; fi","HEAD:tasks/legacy-backup-target-retirement-v1/assets/homelab-backup-audit:408:printf 'SUMMARY|AUDIT_STATUS=OK|BACKUP_STATUS=%s|DR_PROOF_STATUS=%s|CONTROL_FRESHNESS=%s|LIFECYCLE_STATUS=%s|VM_COUNT=%s|APP_COUNT=%s|FRESH=%s|STALE=%s|RESUME=%s|UNVERIFIED=%s|CONTROL_STATE=%s|CLOUD_OK=%s|SCHEDULER_OK=%s|SOURCE_OK=%s|SOURCE_DRIFT=%s|STAGING_BAD=%s|STAGING_WARN=%s|PAYLOAD_LEAKS=%s|RETENTION_STATUS=%s|GLOBAL_DR_PROVEN=%s\\n' \"$backup_status\" \"$dr_proof_status\" \"$control_status\" \"$lifecycle_status\" \"$vm_seen\" \"$app_seen\" \"$fresh\" \"$stale\" \"$resume\" \"$unverified\" \"$control_status\" \"$cloud_ok\" \"$scheduler_ok\" \"$source_ok\" \"$source_drift\" \"$staging_bad\" \"$staging_warn\" \"$payload_leaks\" \"$retention_status\" \"$global_dr_proven\"","HEAD:tasks/legacy-backup-target-retirement-v1/assets/homelab-backup-audit:413:  jq -n --arg task \"$TASK_ID\" --arg change \"$CHANGE_ID\" --arg at \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\" --arg backup \"$backup_status\" --arg control \"$control_status\" --arg dr \"$dr_proof_status\" --arg lifecycle \"$lifecycle_status\" --arg escrow \"$escrow_status\" --arg staging \"$staging_status\" --arg retention \"$retention_status\" --argjson historical \"$historical_gc_proven\" --argjson owner_gc \"$owner_aware_gc_proven\" --argjson staging_bad \"$staging_bad\" --argjson staging_warn \"$staging_warn\" --argjson vm_count \"$vm_seen\" --argjson app_count \"$app_seen\" --argjson fresh \"$fresh\" --argjson stale \"$stale\" --argjson resume \"$resume\" --argjson unverified \"$unverified\" --argjson cloud_ok \"$cloud_ok\" --argjson scheduler_ok \"$scheduler_ok\" --argjson source_ok \"$source_ok\" --argjson source_drift \"$source_drift\" --argjson payload_leaks \"$payload_leaks\" '{schema:\"homelab-backup-unified-audit-v1\",task_id:$task,change_id:$change,updated_at_utc:$at,audit_status:\"OK\",backup_status:$backup,dr_readiness:$dr,dr_proof_status:$dr,control_freshness:$control,lifecycle_status:$lifecycle,vm_count:$vm_count,app_count:$app_count,fresh_count:$fresh,stale_count:$stale,resume_count:$resume,unverified_count:$unverified,cloud_ok_count:$cloud_ok,scheduler_ok_count:$scheduler_ok,source_ok_count:$source_ok,source_drift_count:$source_drift,payload_leaks:$payload_leaks,control_status:$control,control_source_coverage:\"NOT_MACHINE_PROVEN\",staging_status:$staging,staging_bad_count:$staging_bad,staging_warn_count:$staging_warn,staging_node_count:3,escrow_status:$escrow,retention_status:$retention,historical_gc_proven:$historical,owner_aware_gc_proven:$owner_gc,provider_worm_proven:false,provider_worm_skipped_by_policy:true,clean_machine_bootstrap_proven:($dr==\"PROVEN\"),qemu_boot_restore_proven:($dr==\"PROVEN\"),ct_boot_restore_proven:($dr==\"PROVEN\"),full_site_dr_proven:($dr==\"PROVEN\")}' >\"$tmp\"","HEAD:tasks/legacy-backup-target-retirement-v1/assets/homelab-backup-retention-gc:39:    vm130|vm190|vm200) printf 'pve03\\n' ;;","HEAD:tasks/legacy-backup-target-retirement-v1/tools/runtime-lib.sh:67:assert_ct200_proven(){ local owner out dec gen state ev sha_out remote_sha; resolve_ct200_owner; owner=\"$CT200_OWNER\"; sha_out=\"$(node_exec \"$owner\" sha256sum \"$VM_PROBE\")\" || die CT200_VM_PROBE_SHA_READ_FAILED 69; remote_sha=\"$(awk 'NR==1{print $1}' <<<\"$sha_out\")\"; [[ \"$remote_sha\" =~ ^[0-9a-f]{64}$ ]] || die CT200_VM_PROBE_SHA_FORMAT_INVALID 66; [[ \"$remote_sha\" == \"$VM_PROBE_SHA\" ]] || die CT200_VM_PROBE_SHA_DRIFT 66; out=\"$(node_exec \"$owner\" \"$VM_PROBE\" decision 200)\" || die CT200_FRESHNESS_PROBE_FAILED 69; dec=\"$(awk -F= '$1==\"DECISION\"{v=$2} END{print v}' <<<\"$out\")\"; gen=\"$(awk -F= '$1==\"GENERATION\"{v=$2} END{print v}' <<<\"$out\")\"; state=\"$(awk -F= '$1==\"STATE_FILE\"{v=$2} END{print v}' <<<\"$out\")\"; ev=\"$(awk -F= '$1==\"RESTORE_EVIDENCE\"{v=$2} END{print v}' <<<\"$out\")\"; [[ \"$dec\" == SEALED_PROVEN ]] || die CT200_NOT_SEALED_PROVEN 66; [[ \"$gen\" =~ ^vm200-${owner}-[0-9]{8}T[0-9]{6}Z$ ]] || die CT200_GENERATION_INVALID 66; [[ \"$state\" == \"/var/lib/homelab-backup/cloud-quorum/vm200/$gen.json\" ]] || die CT200_STATE_PATH_INVALID 66; [[ \"$ev\" == \"/var/lib/homelab-backup/vm-restore-validation/vm200/$gen.json\" ]] || die CT200_EVIDENCE_PATH_INVALID 66; node_exec \"$owner\" jq -e --arg l vm200 --arg g \"$gen\" --arg s \"$state\" '.schema==\"homelab-vm-restore-validation-v1\" and .logical_id==$l and .generation==$g and .transport_state==\"SEALED\" and .transport_state_file==$s and .restore_source==\"Cloud A\" and .parts_manifest_verified==true and .payload_sha256_verified==true and .payload_decompression_verified==true and .proxmox_config_extract_verified==true and .archive_recovery_readback_verified==true and .bounded_staging==true and .full_local_payload_written==false and .full_restore_proven==false and .result==\"OK\"' \"$ev\" >/dev/null || die CT200_RESTORE_EVIDENCE_INVALID 66; CT200_OWNER=\"$owner\"; CT200_GENERATION=\"$gen\"; CT200_STATE=\"$state\"; CT200_EVIDENCE=\"$ev\"; }","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/assets/pve03-r8152-lifecycle-helper.sh:5:TASK_ID=pve03-r8152-rx-ring-lifecycle-repair-v1","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/assets/pve03-r8152-lifecycle-helper.sh:14:STAGE=/var/lib/homelab-admin/staging/pve03-r8152-rx-ring-lifecycle-repair-v1","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/assets/pve03-r8152-lifecycle-helper.sh:160:  jq -n --arg before_link \"$before_link\" --arg after_link \"$after_link\" --argjson before_rx \"$before_rx\" --argjson after_rx \"$after_rx\" '{status:\"OK\",production_changed:true,lifecycle_repaired:true,script_replaced:true,service_definition_changed:false,rx_ring_changed:false,before_rx:$before_rx,after_rx:$after_rx,before_link:$before_link,after_link:$after_link,service_result:\"success\",service_active:\"active\",service_substate:\"exited\",link_is_failure_gate:false,link_diagnostic_preserved:true,automatic_rollback_triggered:false}' >\"$RESULT\"","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/assets/pve03-r8152-lifecycle-helper.sh:174:  jq -n --arg link \"$link\" --arg quorate \"$quorate\" --argjson current_rx \"$currx\" --argjson nodes \"$nodes\" '{status:\"OK\",production_changed:true,lifecycle_repaired:true,new_script_active:true,service_definition_changed:false,current_rx:$current_rx,rx_ring_changed:false,link_detected:$link,quorate:$quorate,nodes:$nodes,service_result:\"success\",service_active:\"active\",service_substate:\"exited\",link_is_failure_gate:false,link_diagnostic_preserved:true,rollback_payload_retained:true}' >\"$RESULT\"","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/apply.sh:17:jq -e '.status==\"OK\" and .production_changed==true and .lifecycle_repaired==true and .script_replaced==true and .service_definition_changed==false and .rx_ring_changed==false and .before_rx==4096 and .after_rx==4096 and .service_result==\"success\" and .service_active==\"active\" and .service_substate==\"exited\" and .link_is_failure_gate==false and .link_diagnostic_preserved==true and .automatic_rollback_triggered==false' <<<\"$R\" >/dev/null","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/apply.sh:19:jq -n --argjson remote \"$R\" '{status:\"OK\",root_cause_count:0,production_changed:true,pve03_changed:true,lifecycle_repaired:true,remote_result:$remote,canary_seal_unchanged:true,service_definition_changed:false,rx_ring_changed:false,network_restart_executed:false,vmbr0_changed:false}' >\"$HOMELAB_RUN_DIR/apply.json\"","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/dry-run.sh:16:jq -n '{status:\"OK\",root_cause_count:0,production_changed:false,pve03_changed:false,lifecycle_repair_planned:true,script_replace_planned:true,service_definition_change_planned:false,current_rx:4096,target_rx:4096,rx_change_planned:false,link_failure_gate_remove_planned:true,link_diagnostic_preserve_planned:true,network_restart_planned:false}' >\"$HOMELAB_RUN_DIR/dry-run.json\"","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/prepare.sh:11:asset_helper=\"$HOMELAB_TASK_DIR/assets/pve03-r8152-lifecycle-helper.sh\"","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/seal.sh:16:jq -e '.status==\"OK\" and .lifecycle_repaired==true and .remote_result.current_rx==4096 and .remote_result.service_result==\"success\" and .remote_result.link_is_failure_gate==false and .service_definition_changed==false and .rx_ring_changed==false and .canary_seal_unchanged==true and .network_restart_executed==false and .vmbr0_changed==false and .rollback_payload_retained==true' \"$V\" >/dev/null","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/seal.sh:20:jq -n --arg task \"$TASK_ID\" --arg change \"$CHANGE_ID\" --arg sealed \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\" --arg old \"$OLD_SCRIPT_SHA\" --arg new \"$NEW_SCRIPT_SHA\" --arg unit \"$OLD_SERVICE_SHA\" --arg canary \"$CANARY_SHA\" --arg stage \"$REMOTE_STAGE\" --argjson remote \"$R\" '{status:\"SEALED\",task_id:$task,change_id:$change,sealed_at_utc:$sealed,production_changed:true,pve03_changed:true,lifecycle_repaired:true,service_sha256:$unit,old_script_sha256:$old,new_script_sha256:$new,interface:\"nic1\",driver:\"r8152\",target_rx:4096,current_rx:4096,rx_ring_changed:false,service_definition_changed:false,service_result:\"success\",service_active:\"active\",service_substate:\"exited\",link_is_failure_gate:false,link_diagnostic_preserved:true,network_restart_executed:false,vmbr0_changed:false,canary_seal_sha256:$canary,canary_seal_unchanged:true,rollback_payload_retained:true,remote_rollback_stage:$stage,remote_verify:$remote}' >\"$tmp\"","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/seal.sh:24:jq -n --arg sha \"$ss\" '{status:\"OK\",root_cause_count:0,production_changed:true,lifecycle_repaired:true,task_seal_sha256:$sha}' >\"$HOMELAB_RUN_DIR/seal.json\"","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/verify.sh:16:jq -e '.status==\"OK\" and .lifecycle_repaired==true and .new_script_active==true and .service_definition_changed==false and .current_rx==4096 and .rx_ring_changed==false and .link_detected==\"yes\" and .quorate==\"Yes\" and .nodes==3 and .service_result==\"success\" and .service_active==\"active\" and .service_substate==\"exited\" and .link_is_failure_gate==false and .link_diagnostic_preserved==true and .rollback_payload_retained==true' <<<\"$R\" >/dev/null","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/verify.sh:18:jq -e '.status==\"OK\" and .lifecycle_repaired==true and .remote_result.rx_ring_changed==false and .service_definition_changed==false and .canary_seal_unchanged==true and .network_restart_executed==false and .vmbr0_changed==false' \"$A\" >/dev/null","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/verify.sh:20:jq -n --argjson remote \"$R\" '{status:\"OK\",root_cause_count:0,production_changed:true,pve03_changed:true,lifecycle_repaired:true,remote_result:$remote,canary_seal_unchanged:true,service_definition_changed:false,rx_ring_changed:false,network_restart_executed:false,vmbr0_changed:false,rollback_payload_retained:true}' >\"$HOMELAB_RUN_DIR/verify.json\"","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/task.json:3:  \"task_id\": \"pve03-r8152-rx-ring-lifecycle-repair-v1\",","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/task.json:26:    \"ssh:root@[PRIVATE_IP]:/var/lib/homelab-admin/staging/pve03-r8152-rx-ring-lifecycle-repair-v1\",","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/task.json:29:    \"/var/lib/homelab-admin/seals/pve03-r8152-rx-ring-lifecycle-repair-v1.json\"","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/task.json:32:    \"ssh:root@[PRIVATE_IP]:/var/lib/homelab-admin/staging/pve03-r8152-rx-ring-lifecycle-repair-v1\",","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/task.json:35:    \"/var/lib/homelab-admin/seals/pve03-r8152-rx-ring-lifecycle-repair-v1.json\"","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/task.json:71:      \"verification\": \"lifecycle repair sealed with exact source hashes, RX unchanged and CR0015 canary seal unchanged\"","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/task.json:87:    \"command\": \"HOMELAB_CONTROLLED_APPLY_CONFIRM=pve03-r8152-rx-ring-lifecycle-repair-v1 /opt/homelab-admin/bin/homelab-admin run TASK_DIR rollback\",","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/task.json:128:    \"assets/pve03-r8152-lifecycle-helper.sh\"","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/tools/runtime-lib.sh:2:TASK_ID=pve03-r8152-rx-ring-lifecycle-repair-v1","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/tools/runtime-lib.sh:5:REMOTE_STAGE=/var/lib/homelab-admin/staging/pve03-r8152-rx-ring-lifecycle-repair-v1","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/tools/runtime-lib.sh:6:REMOTE_HELPER=$REMOTE_STAGE/pve03-r8152-lifecycle-helper.sh","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/tools/runtime-lib.sh:17:SEAL=/var/lib/homelab-admin/seals/pve03-r8152-rx-ring-lifecycle-repair-v1.json","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/tools/runtime-lib.sh:25:assert_remote_stage(){ local a h n; a=\"$HOMELAB_TASK_DIR/assets/pve03-r8152-lifecycle-helper.sh\"; n=\"$HOMELAB_TASK_DIR/assets/homelab-pve03-r8152-rx-ring\"; h=\"$(ssh \"${SSH_BASE[@]}\" \"$REMOTE_HOST\" /usr/bin/sha256sum \"$REMOTE_HELPER\" | awk '{print $1}')\"; [[ \"$h\" == \"$(sha \"$a\")\" ]] || die REMOTE_HELPER_SHA_BAD; h=\"$(ssh \"${SSH_BASE[@]}\" \"$REMOTE_HOST\" /usr/bin/sha256sum \"$REMOTE_NEW\" | awk '{print $1}')\"; [[ \"$h\" == \"$NEW_SCRIPT_SHA\" && \"$h\" == \"$(sha \"$n\")\" ]] || die REMOTE_NEW_SHA_BAD; ssh \"${SSH_BASE[@]}\" \"$REMOTE_HOST\" /usr/bin/test -s \"$REMOTE_STAGE/baseline.json\" || die REMOTE_BASELINE_MISSING; }","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/tools/test_contract.py:6:helper=(T/\"assets/pve03-r8152-lifecycle-helper.sh\").read_text(encoding=\"utf-8\")","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/tools/test_contract.py:17:subprocess.run([\"bash\",\"-n\",str(T/\"assets/pve03-r8152-lifecycle-helper.sh\")],check=True)","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/tools/test_contract.py:21:assert task[\"task_id\"]==\"pve03-r8152-rx-ring-lifecycle-repair-v1\"","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/assets/homelab-backup-audit:407:  jq -n --arg task \"$TASK_ID\" --arg change \"$CHANGE_ID\" --arg at \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\" --arg backup \"$backup_status\" --arg control \"$control_status\" --arg escrow \"$escrow_status\" --arg staging \"$staging_status\" --arg retention \"$retention_status\" --argjson historical \"$historical_gc_proven\" --argjson owner_gc \"$owner_aware_gc_proven\" --argjson staging_bad \"$staging_bad\" --argjson staging_warn \"$staging_warn\" --argjson vm_count \"$vm_seen\" --argjson app_count \"$app_seen\" --argjson fresh \"$fresh\" --argjson stale \"$stale\" --argjson resume \"$resume\" --argjson unverified \"$unverified\" --argjson cloud_ok \"$cloud_ok\" --argjson scheduler_ok \"$scheduler_ok\" --argjson source_ok \"$source_ok\" --argjson source_drift \"$source_drift\" --argjson payload_leaks \"$payload_leaks\" '{schema:\"homelab-backup-unified-audit-v1\",task_id:$task,change_id:$change,updated_at_utc:$at,audit_status:\"OK\",backup_status:$backup,dr_readiness:\"NOT_PROVEN\",lifecycle_status:\"OPEN\",vm_count:$vm_count,app_count:$app_count,fresh_count:$fresh,stale_count:$stale,resume_count:$resume,unverified_count:$unverified,cloud_ok_count:$cloud_ok,scheduler_ok_count:$scheduler_ok,source_ok_count:$source_ok,source_drift_count:$source_drift,payload_leaks:$payload_leaks,control_status:$control,control_source_coverage:\"NOT_MACHINE_PROVEN\",staging_status:$staging,staging_bad_count:$staging_bad,staging_warn_count:$staging_warn,staging_node_count:3,escrow_status:$escrow,retention_status:$retention,historical_gc_proven:$historical,owner_aware_gc_proven:$owner_gc,provider_worm_proven:false,provider_worm_skipped_by_policy:true,clean_machine_bootstrap_proven:false,qemu_boot_restore_proven:false,full_site_dr_proven:false}' >\"$tmp\"","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/assets/homelab-backup-retention-gc:38:    vm130|vm190|vm200) printf 'pve03\\n' ;;","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/phases/dry-run.sh:20:grep -Fq 'vm200' \"$RETENTION_ASSET\"","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/phases/rollback.sh:27:jq -n --arg status OK '{status:$status,root_cause_count:0,production_changed:true,ct200_destroyed:true,backup_runtime_restored:true,vm_target_count_restored:12,vm200_cloud_backup_preserved:true,vm200_restore_evidence_preserved:true,old_mvp_preserved:true}' > \"$HOMELAB_RUN_DIR/rollback.json\"","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/phases/verify.sh:24:grep -Eq '^(KEEP|PROTECT|DELETE)\\|logical=vm200\\|' \"$retention_out\" || die RETENTION_VM200_MISSING","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/task.json:45:    \"rclone:pve01-mail-01-crypt:homelab-backups/vm200\",","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/task.json:46:    \"rclone:pve01-mail-02-crypt:homelab-backups/vm200\",","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/task.json:55:    \"ssh:root@[PRIVATE_IP]:/var/lib/homelab-backup/cloud-quorum/vm200\",","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/task.json:56:    \"ssh:root@[PRIVATE_IP]:/var/lib/homelab-backup/vm-restore-validation/vm200\"","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/task.json:73:    \"rclone:pve01-mail-01-crypt:homelab-backups/vm200\",","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/task.json:74:    \"rclone:pve01-mail-02-crypt:homelab-backups/vm200\",","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/task.json:80:    \"ssh:root@[PRIVATE_IP]:/var/lib/homelab-backup/cloud-quorum/vm200\",","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/task.json:81:    \"ssh:root@[PRIVATE_IP]:/var/lib/homelab-backup/vm-restore-validation/vm200\"","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/task.json:107:      \"verification\": \"proves CT boot/DNS, vm200 SEALED_PROVEN, retention owner mapping, 13-target audit and zero runtime source drift\"","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/task.json:112:      \"verification\": \"destroys only exact CT200 configuration and restores exact pre-CR runtime bytes while preserving any sealed vm200 cloud generation/evidence\"","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/task.json:139:    \"verification\": \"CT200 absent; exact old queue/probe/worker/audit/retention bytes restored on all relevant nodes; audit returns vm_count=12 and source_drift_count=0; sealed vm200 cloud backup is preserved fail-safe\"","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/task.json:146:    \"cloud objects outside the new vm200 namespace are not mutated\",","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/task.json:181:    \"initial_vm200_backup_required\": true,","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/tools/test_contract.py:33:assert \"vm130|vm190|vm200) printf 'pve03\\\\n' ;;\" in retention","HEAD:tasks/skladchik-moderator-v2-application-v1/task.json:105:      \"compile\": \"remote CT lifecycle helper\"","HEAD:tasks/skladchik-moderator-v2-application-v1/tools/runtime-lib.sh:28:assert_seals(){ assert_regular \"$INFRA_SEAL\"; [[ \"$(sha \"$INFRA_SEAL\")\" == \"$INFRA_SEAL_SHA\" ]] || die INFRA_SEAL_SHA_MISMATCH; jq -e '.status==\"SEALED\" and .ctid==200 and .vm_target_count==13 and .application_v2_installed==false and .cookie_onboarded==false' \"$INFRA_SEAL\" >/dev/null || die INFRA_SEAL_INVALID; assert_regular \"$RETENTION_SEAL\"; [[ \"$(sha \"$RETENTION_SEAL\")\" == \"$RETENTION_SEAL_SHA\" ]] || die RETENTION_SEAL_SHA_MISMATCH; jq -e '.status==\"SEALED\" and .vm200_retention_plan_proven==true and .gc_executed==false' \"$RETENTION_SEAL\" >/dev/null || die RETENTION_SEAL_INVALID; }","HEAD:tasks/skladchik-reports-monitor-controlled-reauth-v1/task.json:234:    \"operator_refresh_lifecycle\": [","HEAD:tests/test_cr_2026_0012_skladchik_cookie_refresh_runbook.py:36:    def test_full_lifecycle_order_is_explicit(self) -> None:","HEAD:tests/test_cr_2026_0035_skladchik_moderator_ct200.py:20:    def test_vm200_is_canonical_lxc_on_pve03(self) -> None:","HEAD:tests/test_cr_2026_0035_skladchik_moderator_ct200.py:27:    def test_audit_and_retention_include_vm200(self) -> None:","HEAD:tests/test_cr_2026_0035_skladchik_moderator_ct200.py:32:        self.assertIn(\"vm130|vm190|vm200) printf 'pve03\\\\n' ;;\", retention)","HEAD:tests/test_cr_2026_0036_skladchik_moderator_v2.py:455:    def test_db_text_encoding_lifecycle_is_independent_and_rollback_safe(self):","HEAD:tests/test_cr_2026_0036_skladchik_moderator_v2.py:513:    def test_rules_hotfix_lifecycle_restages_live_probe_and_rollback_is_seal_safe(self):","HEAD:tests/test_cr_2026_0036_skladchik_moderator_v2.py:560:    def test_collector_hotfix_lifecycle_is_seal_and_rollback_safe(self):","HEAD:tests/test_cr_2026_0057_control_refresh.py:30:    def test_lifecycle_cloud_boundary(self):","HEAD:tests/test_cr_2026_0057_control_refresh.py:36:    def test_source_worktree_must_be_clean_for_lifecycle(self):","HEAD:tests/test_cr_2026_0066_legacy_backup_target_retirement.py:31:        'assert_host(){ log assert_host; }','assert_stage(){ log assert_stage; }','assert_source_clean(){ log assert_source_clean; }','assert_seals(){ log assert_seals; }','assert_live_old(){ log assert_live_old; }','assert_asset_integrity(){ log assert_asset_integrity; }','assert_approved_diffs_old(){ log assert_approved_diffs_old; }','assert_candidate_semantics(){ log assert_candidate_semantics; }','assert_legacy_layout(){ log assert_legacy_layout; }','assert_no_open_legacy_tx(){ log assert_no_open_legacy_tx; }','assert_known_systemd(){ log assert_known_systemd; }','payload_fingerprint_set(){ PAYLOAD_FINGERPRINT=x; }','systemd_fingerprint_set(){ SYSTEMD_FINGERPRINT=y; }','acquire_locks(){ log acquire_locks; }','assert_no_legacy_process(){ log assert_no_legacy_process; }','assert_ct200_proven(){ CT200_OWNER=pve03; CT200_GENERATION=vm200-pve03-20260814T000000Z; CT200_EVIDENCE=/tmp/evidence; }',f'install_candidates(){{ log install_candidates; return {install_rc}; }}','assert_live_new(){ log assert_live_new; }',f'assert_live_semantics(){{ log assert_live_semantics; {post}; }}','restore_preimages(){ log restore_preimages; return 0; }']","HEAD:tests/test_cr_2026_0066_legacy_backup_target_retirement.py:41:    script=f\"set -Eeuo pipefail; HOMELAB_TASK_DIR={shlex.quote(str(TASK))}; source {shlex.quote(str(lib))}; remote_argv_command jq -e --arg g 'vm200-pve03-20260814T000000Z' '.schema==\\\"homelab-vm-restore-validation-v1\\\" and .generation==$g' '/tmp/evidence file.json'; printf '%s\\\\n' \\\"$REMOTE_COMMAND\\\"\"","HEAD:tests/test_cr_2026_0066_legacy_backup_target_retirement.py:42:    r=subprocess.run(['bash','-c',script],text=True,capture_output=True); self.assertEqual(r.returncode,0,r.stderr); cmd=r.stdout.strip(); probe=f\"set -- {cmd}; printf '<%s>\\\\n' \\\"$@\\\"\"; q=subprocess.run(['sh','-c',probe],text=True,capture_output=True); self.assertEqual(q.returncode,0,q.stderr); self.assertEqual(q.stdout.splitlines(),['<jq>','<-e>','<--arg>','<g>','<vm200-pve03-20260814T000000Z>','<.schema==\"homelab-vm-restore-validation-v1\" and .generation==$g>','</tmp/evidence file.json>'])"],"head":"bcf018f263d9fc607eddd1796e5ef306870c6b7b","head_commit":"bcf018f263d9fc607eddd1796e5ef306870c6b7b|2026-08-14T08:01:48+03:00|fix(CR-2026-0066): harden remote proof and fail-closed scans","hit_files":[{"blob":"b8c98568b40a59c5e452e12835ae1924cba5bab4","path":"changes/CR-2026-0005/plan.md"},{"blob":"17f5adc7d28ce77a2ceeeb26a2541ff10a556958","path":"changes/CR-2026-0006/plan.json"},{"blob":"9faaa5679ff920509f23799ede7f53c8feffb390","path":"changes/CR-2026-0007/plan.json"},{"blob":"69d0bd7ae465aa8bf065d86bfb8d0b1a53ea58ee","path":"changes/CR-2026-0012/plan.json"},{"blob":"c45305eb1066f842fcd621e74ad68a6debd7962d","path":"changes/CR-2026-0030/implementation.md"},{"blob":"9195917b513ef95875bab7c9f9d007a3dbae0dac","path":"changes/CR-2026-0030/tests.md"},{"blob":"470bec45f0ec929fec32615e69b18d75a793347f","path":"changes/CR-2026-0031/risk.md"},{"blob":"043d175b0b3381595ef55ea9322cf58763794f00","path":"changes/CR-2026-0032/README.md"},{"blob":"87fe46bc5f804bd95cfd3f7e83fad2e8afba5b10","path":"changes/CR-2026-0035/implementation.md"},{"blob":"e8b5c8d3e67068b1cd477969ff4b7a6625193db7","path":"changes/CR-2026-0035/risk.md"},{"blob":"77166599150be819387e130677988174a19af59f","path":"changes/CR-2026-0035/tests.md"},{"blob":"ccb02467f67e50f6130ab3dd79f6dfc23f5f045f","path":"changes/CR-2026-0036/implementation.md"},{"blob":"defa021afc732d4e75cce165f7d748bea9317d8f","path":"changes/CR-2026-0049/source-provenance.tsv"},{"blob":"6e8c73d7d1d592bab2b0cb3cae1a551c7a640423","path":"changes/CR-2026-0049/task-package.sha256"},{"blob":"3963f962ced2ca39731680306cd153749616a9b2","path":"changes/CR-2026-0054/implementation.md"},{"blob":"e6e01a0f4a6fddad1dd9665d08d1a97d22c152c2","path":"changes/CR-2026-0054/tests.md"},{"blob":"9322a9c023d35be9f5003cc41ae687f0900f0de7","path":"changes/CR-2026-0057/implementation.md"},{"blob":"3779f6f28b2bdd01e1541121a2f3e5947963c399","path":"changes/CR-2026-0057/tests.md"},{"blob":"a8f4d9dad9be23170b6849b9b6ed9f57b574a68f","path":"changes/CR-2026-0060/implementation.md"},{"blob":"c210e2f145890aa1b04c9fda8593d8394b568b7c","path":"changes/CR-2026-0060/tests.md"},{"blob":"964401ce6097c87e87e0a1a36e5c9e4be136caf7","path":"changes/CR-2026-0064/implementation.md"},{"blob":"d6c047793673a864dc6dbb6b8e5f37c6517f6e29","path":"changes/CR-2026-0064/risk.md"},{"blob":"17c9beed7ec3a4b6114e8e5cccdd10a732a5ef02","path":"changes/CR-2026-0064/tests.md"},{"blob":"53430b7f739fb98897b04b248cf5e9a66c0991c0","path":"docs/superpowers/plans/2026-08-12-vm170-apps-b-retirement-implementation.md"},{"blob":"e0f59a8c442cbcaddaf69a9fc475e86d68f0886f","path":"docs/superpowers/plans/2026-08-13-backup-control-coverage-hardening-implementation.md"},{"blob":"aa99cb4e9568930cac4c84f9867d82bb94a476a1","path":"docs/superpowers/plans/2026-08-13-control-refresh-implementation.md"},{"blob":"8ac672a6f394500463465bc04c12b743ddfb42d8","path":"docs/superpowers/plans/2026-08-13-legacy-backup-target-retirement-implementation.md"},{"blob":"8bf377cec2719d7f8249407471b18fc6095b838a","path":"docs/superpowers/specs/2026-08-12-vm170-apps-b-retirement-design.md"},{"blob":"860a3ded9369f129c3a761cb702a77bad3118efb","path":"docs/superpowers/specs/2026-08-13-backup-control-coverage-hardening-design.md"},{"blob":"b39bb04840862c37c3b5f93d57cf3c8d3682378c","path":"docs/superpowers/specs/2026-08-13-control-refresh-design.md"},{"blob":"36edd4ad024a74760e58a99f251beabafa6f7ad4","path":"docs/superpowers/specs/2026-08-13-legacy-backup-target-retirement-design.md"},{"blob":"1197908146e655657316195a770cae38cef2d6dc","path":"observed/source-snapshots/dependency-map-latest.tsv"},{"blob":"7ca7c24801bffc9bdcb88c20830dec715f4e6f6d","path":"tasks/backup-control-coverage-hardening-v1/assets/homelab-backup-audit"},{"blob":"1769ba9fc3083b65a448e498bfd9714e6832cd7f","path":"tasks/backup-control-final-generation-v1/assets/runtime/homelab-backup-audit"},{"blob":"7ca7c24801bffc9bdcb88c20830dec715f4e6f6d","path":"tasks/backup-control-refresh-v1/assets/runtime/homelab-backup-audit"},{"blob":"8ed6e4ef527c69dff55f444c78e4a19feaf4c879","path":"tasks/backup-control-refresh-v1/assets/runtime/homelab-backup-retention-gc"},{"blob":"ac4d5b1eb6f1adfd14d48ca26ac37227e4c99513","path":"tasks/backup-control-refresh-v1/task.json"},{"blob":"a2bdac617f46db798c2affd210b6b170d7e7cb29","path":"tasks/backup-retention-dynamic-pinned-prune-mailru-cleanup-v1/assets/orchestrator"},{"blob":"a98651a207d8c0543a12829883ee577c7a7a94f3","path":"tasks/backup-retention-dynamic-pinned-prune-mailru-cleanup-v1/task.json"},{"blob":"f37f9d2494a7a2692ebf1d81bf5b19c124e7c18c","path":"tasks/backup-retention-pinned-scheduled-scope-hotfix-v1/assets/homelab-backup-retention-gc"},{"blob":"6ac8e7165549efd504a1edbe4083b8f68f700537","path":"tasks/backup-retention-pinned-scheduled-scope-hotfix-v1/task.json"},{"blob":"76d6c8eb28f2bd249ba469ab77488b03ce022196","path":"tasks/backup-retention-plan-stability-hotfix-v1/assets/homelab-backup-retention-gc"},{"blob":"c631d5b296b8ecd5810fe4cb60c6f4e6ba3b9c62","path":"tasks/backup-retention-plan-stability-hotfix-v1/tools/runtime-lib.sh"},{"blob":"a88c94ca83e168e0c47cdb16ce527f241c17fb67","path":"tasks/backup-retention-remote-list-failclosed-hotfix-v1/assets/homelab-backup-retention-gc"},{"blob":"7738957cb10a77d88e205111fd71a80fa61bd09f","path":"tasks/backup-retention-remote-stdin-hotfix-v1/assets/homelab-backup-retention-gc"},{"blob":"c5c8ee836c5acd690c1edfbad7968a8a03ed941d","path":"tasks/backup-retention-remote-stdin-hotfix-v1/phases/apply.sh"},{"blob":"486b021a5b538927eb09ca037f480d72bce4279a","path":"tasks/backup-retention-remote-stdin-hotfix-v1/phases/dry-run.sh"},{"blob":"cb33dac623282fdd768166135a52cdfde7051741","path":"tasks/backup-retention-remote-stdin-hotfix-v1/phases/seal.sh"},{"blob":"9c4a6b05b20fd97f5ffff4b30fa2f8fe26365f8f","path":"tasks/backup-retention-remote-stdin-hotfix-v1/phases/verify.sh"},{"blob":"2771655d95130aa7368a919a15e09cc837111111","path":"tasks/backup-retention-remote-stdin-hotfix-v1/task.json"},{"blob":"1cdd318a710104eaaca0cbcf732fae0c1291cb4a","path":"tasks/backup-retention-remote-stdin-hotfix-v1/tools/runtime-lib.sh"},{"blob":"942f1e7cc2191a00cb95cef563f41c6a644b6820","path":"tasks/backup-retention-remote-stdin-hotfix-v1/tools/test_contract.py"},{"blob":"1769ba9fc3083b65a448e498bfd9714e6832cd7f","path":"tasks/backup-retention-safe-gc-v1/assets/homelab-backup-audit"},{"blob":"8ed6e4ef527c69dff55f444c78e4a19feaf4c879","path":"tasks/backup-retention-transaction-resume-hotfix-v1/assets/homelab-backup-retention-gc"},{"blob":"9a7c23eb8ddfa7a63e8aa546d5164529e658f023","path":"tasks/backup-unified-monitoring-v1/README.md"},{"blob":"2280847143ad79c71b77db18bdb1c638bde4e7c3","path":"tasks/backup-unified-monitoring-v1/assets/homelab-backup-audit"},{"blob":"d3a69ebfbbf532c4668998d676fc704fbe750b49","path":"tasks/legacy-backup-target-retirement-v1/assets/homelab-backup-audit"},{"blob":"7e7df41a1631b9eff8c644995a04dcd7474e8273","path":"tasks/legacy-backup-target-retirement-v1/assets/homelab-backup-retention-gc"},{"blob":"0d091e9e0b3ed362716eac23f0eb5e67645d15d8","path":"tasks/legacy-backup-target-retirement-v1/tools/runtime-lib.sh"},{"blob":"bb4f027cb2018dbe3883f64c507cfbec150092d0","path":"tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/assets/pve03-r8152-lifecycle-helper.sh"},{"blob":"d4bed407e8afb2dc7a35715928170a4499fd1635","path":"tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/apply.sh"},{"blob":"528cb4ccf43258855fea89a1ddcebc6367803c21","path":"tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/dry-run.sh"},{"blob":"1dc06d6fadccaf4b2bc38b64935d7efc3baf036c","path":"tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/prepare.sh"},{"blob":"0854080ad7ff316a409e05bb6ec383d914ce1695","path":"tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/seal.sh"},{"blob":"61a6c56cd7c972c31b593072b444181c9fe8b1dd","path":"tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/verify.sh"},{"blob":"70fc54a265dabad376c98defa0d7b6a5d8e86abf","path":"tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/task.json"},{"blob":"5304252574b3e31165d11d1ddb07c438e6ce486c","path":"tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/tools/runtime-lib.sh"},{"blob":"6eecf9b78607ac0f2799f01e1ae638ee40ff03c2","path":"tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/tools/test_contract.py"},{"blob":"a425ecd524835c669310302126a1d325ae912dd6","path":"tasks/skladchik-moderator-ct200-infrastructure-v1/assets/homelab-backup-audit"},{"blob":"7738957cb10a77d88e205111fd71a80fa61bd09f","path":"tasks/skladchik-moderator-ct200-infrastructure-v1/assets/homelab-backup-retention-gc"},{"blob":"57b6621ce47cd506c7f5e825b5a6bb3728e6332d","path":"tasks/skladchik-moderator-ct200-infrastructure-v1/phases/dry-run.sh"},{"blob":"c8ce6fc5c414a9673a57160ab0f08b5b147af22b","path":"tasks/skladchik-moderator-ct200-infrastructure-v1/phases/rollback.sh"},{"blob":"b565943a9da98d5fbda211ea89cc69f2f4f51bbf","path":"tasks/skladchik-moderator-ct200-infrastructure-v1/phases/verify.sh"},{"blob":"455d5183f71ce6a8b2a6c34d7e5a7616023d203f","path":"tasks/skladchik-moderator-ct200-infrastructure-v1/task.json"},{"blob":"c4d3eac95a1abe0cde1c7cf29e8fd58b7bd130af","path":"tasks/skladchik-moderator-ct200-infrastructure-v1/tools/test_contract.py"},{"blob":"0e7f38b73fd87672d806a23b60272c6548aac845","path":"tasks/skladchik-moderator-v2-application-v1/task.json"},{"blob":"db72a33d3fe6696895d56ae41778dadc10b6a298","path":"tasks/skladchik-moderator-v2-application-v1/tools/runtime-lib.sh"},{"blob":"68ae87029a1660255df02ff192e5b9206e9a6c05","path":"tasks/skladchik-reports-monitor-controlled-reauth-v1/task.json"},{"blob":"aefe7ac6860ec2107c281485b35c8cba1f1196ef","path":"tests/test_cr_2026_0012_skladchik_cookie_refresh_runbook.py"},{"blob":"4b696b282810207e45bb9d2b351a1d22ee37fe93","path":"tests/test_cr_2026_0035_skladchik_moderator_ct200.py"},{"blob":"6888cd3ef05ced3789bb9564b9c2f3b3d337a8f2","path":"tests/test_cr_2026_0036_skladchik_moderator_v2.py"},{"blob":"2964926a43e0d46571e0d320bd8af437d7f49814","path":"tests/test_cr_2026_0057_control_refresh.py"},{"blob":"b17c15e7a17638917007f2d9d78db1089f9e1a76","path":"tests/test_cr_2026_0066_legacy_backup_target_retirement.py"}],"label":"CR0066_RETIREMENT","path":"/root/homelab-ops-cr-2026-0066"},{"branch":"cr-2026-0058-legacy-backup-target-retirement","exists":true,"grep_count":152,"grep_lines":["HEAD:changes/CR-2026-0005/plan.md:10:8. \u041f\u043e\u0441\u043b\u0435 \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0433\u043e CI \u0438 review \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c lifecycle \u0447\u0435\u0440\u0435\u0437 `homelab-admin`.","HEAD:changes/CR-2026-0006/plan.json:20:    \"homelab-admin-lifecycle\"","HEAD:changes/CR-2026-0007/plan.json:21:    \"homelab-admin-lifecycle\"","HEAD:changes/CR-2026-0012/plan.json:9:  \"lifecycle\": [","HEAD:changes/CR-2026-0030/implementation.md:9:The first controlled apply stopped before capture with `HEALTH_STATE_MISSING`. The v2 task had a v2 state namespace but still referenced the v1 health file and retained hardcoded v1 logical-id literals in lifecycle phases. The correction gives v2 its own `/var/lib/homelab-health/control-bootstrap-v2-cloud-quorum.json` health file and changes all active phase logical-id checks/evidence to `control-bootstrap-v2`. The v1 health/state remain immutable and no failed-apply rollback is required because no generation or cloud mutation occurred.","HEAD:changes/CR-2026-0030/tests.md:6:- failed #401 state directory may exist but must contain zero generation JSON files before lifecycle resume;","HEAD:changes/CR-2026-0031/risk.md:4:Scheduler contention during the 12-target Cloud-A backfill may still stop an apply with rc75, but this no longer creates a dead-end lifecycle state: a subsequent controlled apply can resume from partially installed worker/probe bytes and already-written evidence without recapturing or writing cloud data.","HEAD:changes/CR-2026-0032/README.md:5:This change installs a single canonical audit surface for the current 12 VM/CT and 7 APP backup targets plus CONTROL, cloud health, current payload cleanup, scheduler/lock/process state, staging capacity, escrow presence, retention lifecycle and DR proof boundaries.","HEAD:changes/CR-2026-0035/implementation.md:5:The controlled apply creates CT200 on pve03 using the pinned Debian 13 template, 4 vCPU, 6144 MiB RAM, 1024 MiB swap, 40 GiB local-lvm rootfs, unprivileged mode and nesting. It proves boot and DNS, performs an initial vm200 cloud-quorum backup with restore-validation using the candidate worker before changing live backup runtime, then enrolls vm200 in the canonical VM queue/probe/worker/audit/retention runtime on pve01/pve02/pve03 as required.","HEAD:changes/CR-2026-0035/risk.md:11:- first vm200 SEALED backup and restore evidence before live enrollment;","HEAD:changes/CR-2026-0035/risk.md:13:- rollback preserves any already sealed vm200 cloud generation/evidence rather than deleting recovery data;","HEAD:changes/CR-2026-0035/tests.md:14:- Regression: retention candidate requires SSH stdin isolation and live plan must emit vm200 after hotfix.","HEAD:changes/CR-2026-0035/tests.md:15:- Live hotfix proof requires read-only candidate/post-install retention plans to include remote-owned VMIDs and `KEEP|logical=vm200|...|reason=POLICY_NEWEST_2`.","HEAD:changes/CR-2026-0036/implementation.md:50:- Auth-hotfix verify re-stages the pinned offline selftest before remote verification and removes the transient pve03 stage afterward; this closes the apply-to-verify staging lifecycle defect observed in run 20260812T113300Z-2937839-verify.","HEAD:changes/CR-2026-0049/source-provenance.tsv:4:new-script\ttasks/pve03-r8152-rx-ring-lifecycle-repair-v1/assets/homelab-pve03-r8152-rx-ring\td896dce2f9abdebc5f507fd63e4ef6d1d666452c0263469d3dab4d14a6b229af","HEAD:changes/CR-2026-0049/task-package.sha256:1:d896dce2f9abdebc5f507fd63e4ef6d1d666452c0263469d3dab4d14a6b229af  tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/assets/homelab-pve03-r8152-rx-ring","HEAD:changes/CR-2026-0049/task-package.sha256:2:1d773fb2a9a5fdd198569d8d04d65c4bfc9ce98109fed4148b6e46e50d874778  tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/assets/pve03-r8152-lifecycle-helper.sh","HEAD:changes/CR-2026-0049/task-package.sha256:3:50abd763a56d6da15d003474b4e59410dd2fb0d06c82acee762fb93e458a779d  tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/apply.sh","HEAD:changes/CR-2026-0049/task-package.sha256:4:b8e7df6de169b35b53c51764822faecc40b76767505244fbc5b72ef4dc852771  tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/dry-run.sh","HEAD:changes/CR-2026-0049/task-package.sha256:5:1f2c9da85a67737f86fca0ba41d02e2ed5bd0c75f8ebeffac6784c7f94b06aa3  tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/preflight.sh","HEAD:changes/CR-2026-0049/task-package.sha256:6:c34294d41a3d2ef1033ae674790976043174c1b7269b02bf5738891d8a614aa6  tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/prepare.sh","HEAD:changes/CR-2026-0049/task-package.sha256:7:ee1cd4487210ee9c90bdaf8e17809aaf6e17b1b9419746fcf3ae1557be4c659b  tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/rollback.sh","HEAD:changes/CR-2026-0049/task-package.sha256:8:8b1abc57f61fb46e51aa4b7a90d138dc92bbe1dfec210c4a5a952d3e9ad608a5  tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/seal.sh","HEAD:changes/CR-2026-0049/task-package.sha256:9:1f8916517c7480d63f5e2cb0ee208133583975e4aed7f63c7859d62ef1fb92d6  tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/verify.sh","HEAD:changes/CR-2026-0049/task-package.sha256:10:dd8768072688c206043e23d3ce787feb6a74e696aa7c2595f8679371ba24b930  tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/task.json","HEAD:changes/CR-2026-0049/task-package.sha256:11:c3b5f59dcd22b0f931e7cefd89749d562434396e19ae25aba01f0e116bcdb373  tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/tools/runtime-lib.sh","HEAD:changes/CR-2026-0049/task-package.sha256:12:7118284724c4fb8c21dddd6373adfa7569e2d027ec004a279d85a201b019e8a4  tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/tools/test_contract.py","HEAD:changes/CR-2026-0054/implementation.md:7:The future homelab-admin lifecycle is audit-runtime-only. It stages exact old audit bytes for rollback and does not modify retention runtime, APP/VM queues, dispatcher, systemd schedules, cloud generations, guest state, legacy moderator payload or CONTROL generations.","HEAD:changes/CR-2026-0054/tests.md:15:Expected source result: all PASS/GREEN. Validation only; no homelab-admin lifecycle phase is executed in the source-only scope.","HEAD:changes/CR-2026-0057/implementation.md:5:The CR0057 branch is not statically self-pinned in `source-recovery.tsv`, because a final source commit cannot contain its own future commit hash. Instead CR0054/CR0056 refs are statically pinned, the CR0057 worktree must be clean, and the lifecycle dynamically requires the exact current CR0057 branch HEAD to exist in the all-refs Git bundle. Apply is resume-safe if the quorum transport has already deleted the local archive at `DELETE_AUTHORIZED` or completed `SEALED`.","HEAD:changes/CR-2026-0057/tests.md:3:Required gates: package SHA, bash syntax, in-memory Python compile, CR0057 unittest, task contract test, repository full suite with temporary `PYTHONPYCACHEPREFIX`, `git diff --check`, and real `homelab-admin validate`. Production lifecycle is executed only after all source gates are green.","HEAD:docs/superpowers/plans/2026-08-12-vm170-apps-b-retirement-implementation.md:60:- `tasks/vm170-selected-app-retirement-v1/phases/{preflight,prepare,dry-run,apply,verify,rollback,seal}.sh` \u2014 standard lifecycle.","HEAD:docs/superpowers/plans/2026-08-12-vm170-apps-b-retirement-implementation.md:351:Delete ignored `*.pyc` and empty `__pycache__` directories first. Run `PYTHONDONTWRITEBYTECODE=1 python3 -m pytest -q tests`. The known suite may recreate the CR0029 lifecycle `.pyc`; record that classification, remove it after the successful run, and require zero remaining `*.pyc` before commit.","HEAD:docs/superpowers/plans/2026-08-13-backup-control-coverage-hardening-implementation.md:524:- [ ] **Step 4: Create lifecycle phases**","HEAD:docs/superpowers/plans/2026-08-13-control-refresh-implementation.md:9:**Tech Stack:** Bash, Python 3, jq, git bundle, tar/gzip, sha256sum, rclone, `homelab-admin` schema v2 controlled lifecycle, Python `unittest`.","HEAD:docs/superpowers/plans/2026-08-13-control-refresh-implementation.md:27:- The generated ops bundle must contain the CR0057 source branch at the exact CR0057 source HEAD used for the lifecycle.","HEAD:docs/superpowers/plans/2026-08-13-control-refresh-implementation.md:41:- Every lifecycle phase is a separate operator command; do not combine `prepare`, `dry-run`, `apply`, `verify`, or `seal`.","HEAD:docs/superpowers/plans/2026-08-13-control-refresh-implementation.md:49:- `tasks/backup-control-refresh-v1/task.json` \u2014 controlled-task contract, source-of-truth pins, reads/writes, lifecycle phase map, runtime matrix and no-change assertions.","HEAD:docs/superpowers/plans/2026-08-13-control-refresh-implementation.md:67:- `changes/CR-2026-0057/implementation.md` \u2014 implemented design and lifecycle behavior.","HEAD:docs/superpowers/plans/2026-08-13-control-refresh-implementation.md:69:- `changes/CR-2026-0057/tests.md` \u2014 exact tests and expected lifecycle gates.","HEAD:docs/superpowers/plans/2026-08-13-control-refresh-implementation.md:298:- [ ] **Step 1: Add failing lifecycle contract tests**","HEAD:docs/superpowers/plans/2026-08-13-control-refresh-implementation.md:325:Exact lifecycle:","HEAD:docs/superpowers/plans/2026-08-13-control-refresh-implementation.md:344:Expected: all green; no lifecycle phase has been run.","HEAD:docs/superpowers/plans/2026-08-13-control-refresh-implementation.md:350:git commit -m \"feat(CR-2026-0057): add CONTROL refresh lifecycle\"","HEAD:docs/superpowers/plans/2026-08-13-control-refresh-implementation.md:367:- Produces: auditable CR0057 source package ready for controlled lifecycle.","HEAD:docs/superpowers/plans/2026-08-13-legacy-backup-target-retirement-implementation.md:9:**Tech Stack:** Bash, Python 3, jq, sha256sum, systemd read-only inspection, `homelab-admin` schema v2 controlled lifecycle, Python `unittest`.","HEAD:docs/superpowers/plans/2026-08-13-legacy-backup-target-retirement-implementation.md:29:- MODERATOR-CR0035 generation `vm200-pve03-20260812T050910Z` is historical evidence only and MUST NOT be a CR0058 freshness pin.","HEAD:docs/superpowers/plans/2026-08-13-legacy-backup-target-retirement-implementation.md:31:- Latest read-only witness before source construction (#837): generation `vm200-pve03-20260813T013518Z`, restore-evidence SHA256 `d4824c806b573c2ba430772ee3da019227d69a16a97e45a5c9ef6b2270e09c0c`. This is diagnostic provenance, not a static lifecycle pin.","HEAD:docs/superpowers/plans/2026-08-13-legacy-backup-target-retirement-implementation.md:124:Declare exact reads/writes, five runtime mutation paths, lifecycle phases, new seal path `/var/lib/homelab-admin/seals/legacy-backup-target-retirement-v1.json`, no-change assertions, runtime matrix, source-of-truth pins and CT200 replacement evidence.","HEAD:docs/superpowers/plans/2026-08-13-legacy-backup-target-retirement-implementation.md:203:- [ ] **Step 1: Add failing lifecycle tests**","HEAD:docs/superpowers/plans/2026-08-13-legacy-backup-target-retirement-implementation.md:221:- [ ] **Step 3: Implement lifecycle**","HEAD:docs/superpowers/plans/2026-08-13-legacy-backup-target-retirement-implementation.md:278:git commit -m \"feat(CR-2026-0058): add controlled legacy backup target retirement lifecycle\"","HEAD:docs/superpowers/plans/2026-08-13-legacy-backup-target-retirement-implementation.md:318:- [ ] **Step 4: Exercise lifecycle in fake/runtime harness**","HEAD:docs/superpowers/specs/2026-08-12-vm170-apps-b-retirement-design.md:283:- apply-to-verify phase artifact lifecycle;","HEAD:docs/superpowers/specs/2026-08-13-backup-control-coverage-hardening-design.md:242:- use `homelab-admin` controlled lifecycle only;","HEAD:docs/superpowers/specs/2026-08-13-control-refresh-design.md:101:- full controlled lifecycle completes through seal;","HEAD:docs/superpowers/specs/2026-08-13-legacy-backup-target-retirement-design.md:16:- MODERATOR-CR0035 historically proved generation `vm200-pve03-20260812T050910Z`; that value is historical evidence, not a CR0058 freshness pin.","HEAD:docs/superpowers/specs/2026-08-13-legacy-backup-target-retirement-design.md:18:- Latest read-only observation before source construction (#837) was generation `vm200-pve03-20260813T013518Z`, evidence SHA256 `d4824c806b573c2ba430772ee3da019227d69a16a97e45a5c9ef6b2270e09c0c`; this is a witness, not a static lifecycle pin.","HEAD:docs/superpowers/specs/2026-08-13-legacy-backup-target-retirement-design.md:198:- fake/runtime lifecycle exercise for preflight through seal;","HEAD:observed/source-snapshots/dependency-map-latest.tsv:11:npmplus-edge\t192.168.50.24\tcritical\tnpmplus-edge\tok\thomelab-pve01-app-npmplus-edge-20260715T012136Z\tedge-vm,dns,backup\tok","HEAD:tasks/backup-control-coverage-hardening-v1/assets/homelab-backup-audit:398:lifecycle_status=OPEN","HEAD:tasks/backup-control-coverage-hardening-v1/assets/homelab-backup-audit:399:if [[ -s \"$SITE_DR_SEAL\" && ! -L \"$SITE_DR_SEAL\" ]] && [[ \"$(sha256sum \"$SITE_DR_SEAL\" | awk '{print $1}')\" == \"$SITE_DR_SEAL_SHA\" ]] && jq -e '.status==\"SEALED\" and .change_id==\"DR-2026-FINAL\" and .full_site_dr_proven==true and .qemu_boot_restore_proven==true and .ct_boot_restore_proven==true and .provider_worm_proven==false and .provider_worm_skipped_by_policy==true' \"$SITE_DR_SEAL\" >/dev/null; then dr_proof_status=PROVEN; global_dr_proven=YES; lifecycle_status=CLOSED_PROVEN; fi","HEAD:tasks/backup-control-coverage-hardening-v1/assets/homelab-backup-audit:408:printf 'SUMMARY|AUDIT_STATUS=OK|BACKUP_STATUS=%s|DR_PROOF_STATUS=%s|CONTROL_FRESHNESS=%s|LIFECYCLE_STATUS=%s|VM_COUNT=%s|APP_COUNT=%s|FRESH=%s|STALE=%s|RESUME=%s|UNVERIFIED=%s|CONTROL_STATE=%s|CLOUD_OK=%s|SCHEDULER_OK=%s|SOURCE_OK=%s|SOURCE_DRIFT=%s|STAGING_BAD=%s|STAGING_WARN=%s|PAYLOAD_LEAKS=%s|RETENTION_STATUS=%s|GLOBAL_DR_PROVEN=%s\\n' \"$backup_status\" \"$dr_proof_status\" \"$control_status\" \"$lifecycle_status\" \"$vm_seen\" \"$app_seen\" \"$fresh\" \"$stale\" \"$resume\" \"$unverified\" \"$control_status\" \"$cloud_ok\" \"$scheduler_ok\" \"$source_ok\" \"$source_drift\" \"$staging_bad\" \"$staging_warn\" \"$payload_leaks\" \"$retention_status\" \"$global_dr_proven\"","HEAD:tasks/backup-control-coverage-hardening-v1/assets/homelab-backup-audit:413:  jq -n --arg task \"$TASK_ID\" --arg change \"$CHANGE_ID\" --arg at \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\" --arg backup \"$backup_status\" --arg control \"$control_status\" --arg dr \"$dr_proof_status\" --arg lifecycle \"$lifecycle_status\" --arg escrow \"$escrow_status\" --arg staging \"$staging_status\" --arg retention \"$retention_status\" --argjson historical \"$historical_gc_proven\" --argjson owner_gc \"$owner_aware_gc_proven\" --argjson staging_bad \"$staging_bad\" --argjson staging_warn \"$staging_warn\" --argjson vm_count \"$vm_seen\" --argjson app_count \"$app_seen\" --argjson fresh \"$fresh\" --argjson stale \"$stale\" --argjson resume \"$resume\" --argjson unverified \"$unverified\" --argjson cloud_ok \"$cloud_ok\" --argjson scheduler_ok \"$scheduler_ok\" --argjson source_ok \"$source_ok\" --argjson source_drift \"$source_drift\" --argjson payload_leaks \"$payload_leaks\" '{schema:\"homelab-backup-unified-audit-v1\",task_id:$task,change_id:$change,updated_at_utc:$at,audit_status:\"OK\",backup_status:$backup,dr_readiness:$dr,dr_proof_status:$dr,control_freshness:$control,lifecycle_status:$lifecycle,vm_count:$vm_count,app_count:$app_count,fresh_count:$fresh,stale_count:$stale,resume_count:$resume,unverified_count:$unverified,cloud_ok_count:$cloud_ok,scheduler_ok_count:$scheduler_ok,source_ok_count:$source_ok,source_drift_count:$source_drift,payload_leaks:$payload_leaks,control_status:$control,control_source_coverage:\"NOT_MACHINE_PROVEN\",staging_status:$staging,staging_bad_count:$staging_bad,staging_warn_count:$staging_warn,staging_node_count:3,escrow_status:$escrow,retention_status:$retention,historical_gc_proven:$historical,owner_aware_gc_proven:$owner_gc,provider_worm_proven:false,provider_worm_skipped_by_policy:true,clean_machine_bootstrap_proven:($dr==\"PROVEN\"),qemu_boot_restore_proven:($dr==\"PROVEN\"),ct_boot_restore_proven:($dr==\"PROVEN\"),full_site_dr_proven:($dr==\"PROVEN\")}' >\"$tmp\"","HEAD:tasks/backup-control-final-generation-v1/assets/runtime/homelab-backup-audit:407:  jq -n --arg task \"$TASK_ID\" --arg change \"$CHANGE_ID\" --arg at \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\" --arg backup \"$backup_status\" --arg control \"$control_status\" --arg escrow \"$escrow_status\" --arg staging \"$staging_status\" --arg retention \"$retention_status\" --argjson historical \"$historical_gc_proven\" --argjson owner_gc \"$owner_aware_gc_proven\" --argjson staging_bad \"$staging_bad\" --argjson staging_warn \"$staging_warn\" --argjson vm_count \"$vm_seen\" --argjson app_count \"$app_seen\" --argjson fresh \"$fresh\" --argjson stale \"$stale\" --argjson resume \"$resume\" --argjson unverified \"$unverified\" --argjson cloud_ok \"$cloud_ok\" --argjson scheduler_ok \"$scheduler_ok\" --argjson source_ok \"$source_ok\" --argjson source_drift \"$source_drift\" --argjson payload_leaks \"$payload_leaks\" '{schema:\"homelab-backup-unified-audit-v1\",task_id:$task,change_id:$change,updated_at_utc:$at,audit_status:\"OK\",backup_status:$backup,dr_readiness:\"NOT_PROVEN\",lifecycle_status:\"OPEN\",vm_count:$vm_count,app_count:$app_count,fresh_count:$fresh,stale_count:$stale,resume_count:$resume,unverified_count:$unverified,cloud_ok_count:$cloud_ok,scheduler_ok_count:$scheduler_ok,source_ok_count:$source_ok,source_drift_count:$source_drift,payload_leaks:$payload_leaks,control_status:$control,control_source_coverage:\"NOT_MACHINE_PROVEN\",staging_status:$staging,staging_bad_count:$staging_bad,staging_warn_count:$staging_warn,staging_node_count:3,escrow_status:$escrow,retention_status:$retention,historical_gc_proven:$historical,owner_aware_gc_proven:$owner_gc,provider_worm_proven:false,provider_worm_skipped_by_policy:true,clean_machine_bootstrap_proven:false,qemu_boot_restore_proven:false,full_site_dr_proven:false}' >\"$tmp\"","HEAD:tasks/backup-control-refresh-v1/assets/runtime/homelab-backup-audit:398:lifecycle_status=OPEN","HEAD:tasks/backup-control-refresh-v1/assets/runtime/homelab-backup-audit:399:if [[ -s \"$SITE_DR_SEAL\" && ! -L \"$SITE_DR_SEAL\" ]] && [[ \"$(sha256sum \"$SITE_DR_SEAL\" | awk '{print $1}')\" == \"$SITE_DR_SEAL_SHA\" ]] && jq -e '.status==\"SEALED\" and .change_id==\"DR-2026-FINAL\" and .full_site_dr_proven==true and .qemu_boot_restore_proven==true and .ct_boot_restore_proven==true and .provider_worm_proven==false and .provider_worm_skipped_by_policy==true' \"$SITE_DR_SEAL\" >/dev/null; then dr_proof_status=PROVEN; global_dr_proven=YES; lifecycle_status=CLOSED_PROVEN; fi","HEAD:tasks/backup-control-refresh-v1/assets/runtime/homelab-backup-audit:408:printf 'SUMMARY|AUDIT_STATUS=OK|BACKUP_STATUS=%s|DR_PROOF_STATUS=%s|CONTROL_FRESHNESS=%s|LIFECYCLE_STATUS=%s|VM_COUNT=%s|APP_COUNT=%s|FRESH=%s|STALE=%s|RESUME=%s|UNVERIFIED=%s|CONTROL_STATE=%s|CLOUD_OK=%s|SCHEDULER_OK=%s|SOURCE_OK=%s|SOURCE_DRIFT=%s|STAGING_BAD=%s|STAGING_WARN=%s|PAYLOAD_LEAKS=%s|RETENTION_STATUS=%s|GLOBAL_DR_PROVEN=%s\\n' \"$backup_status\" \"$dr_proof_status\" \"$control_status\" \"$lifecycle_status\" \"$vm_seen\" \"$app_seen\" \"$fresh\" \"$stale\" \"$resume\" \"$unverified\" \"$control_status\" \"$cloud_ok\" \"$scheduler_ok\" \"$source_ok\" \"$source_drift\" \"$staging_bad\" \"$staging_warn\" \"$payload_leaks\" \"$retention_status\" \"$global_dr_proven\"","HEAD:tasks/backup-control-refresh-v1/assets/runtime/homelab-backup-audit:413:  jq -n --arg task \"$TASK_ID\" --arg change \"$CHANGE_ID\" --arg at \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\" --arg backup \"$backup_status\" --arg control \"$control_status\" --arg dr \"$dr_proof_status\" --arg lifecycle \"$lifecycle_status\" --arg escrow \"$escrow_status\" --arg staging \"$staging_status\" --arg retention \"$retention_status\" --argjson historical \"$historical_gc_proven\" --argjson owner_gc \"$owner_aware_gc_proven\" --argjson staging_bad \"$staging_bad\" --argjson staging_warn \"$staging_warn\" --argjson vm_count \"$vm_seen\" --argjson app_count \"$app_seen\" --argjson fresh \"$fresh\" --argjson stale \"$stale\" --argjson resume \"$resume\" --argjson unverified \"$unverified\" --argjson cloud_ok \"$cloud_ok\" --argjson scheduler_ok \"$scheduler_ok\" --argjson source_ok \"$source_ok\" --argjson source_drift \"$source_drift\" --argjson payload_leaks \"$payload_leaks\" '{schema:\"homelab-backup-unified-audit-v1\",task_id:$task,change_id:$change,updated_at_utc:$at,audit_status:\"OK\",backup_status:$backup,dr_readiness:$dr,dr_proof_status:$dr,control_freshness:$control,lifecycle_status:$lifecycle,vm_count:$vm_count,app_count:$app_count,fresh_count:$fresh,stale_count:$stale,resume_count:$resume,unverified_count:$unverified,cloud_ok_count:$cloud_ok,scheduler_ok_count:$scheduler_ok,source_ok_count:$source_ok,source_drift_count:$source_drift,payload_leaks:$payload_leaks,control_status:$control,control_source_coverage:\"NOT_MACHINE_PROVEN\",staging_status:$staging,staging_bad_count:$staging_bad,staging_warn_count:$staging_warn,staging_node_count:3,escrow_status:$escrow,retention_status:$retention,historical_gc_proven:$historical,owner_aware_gc_proven:$owner_gc,provider_worm_proven:false,provider_worm_skipped_by_policy:true,clean_machine_bootstrap_proven:($dr==\"PROVEN\"),qemu_boot_restore_proven:($dr==\"PROVEN\"),ct_boot_restore_proven:($dr==\"PROVEN\"),full_site_dr_proven:($dr==\"PROVEN\")}' >\"$tmp\"","HEAD:tasks/backup-control-refresh-v1/assets/runtime/homelab-backup-retention-gc:39:    vm130|vm190|vm200) printf 'pve03\\n' ;;","HEAD:tasks/backup-control-refresh-v1/task.json:171:    \"source_head_dynamic_at_lifecycle\": true,","HEAD:tasks/backup-retention-plan-stability-hotfix-v1/assets/homelab-backup-retention-gc:39:    vm130|vm190|vm200) printf 'pve03\\n' ;;","HEAD:tasks/backup-retention-plan-stability-hotfix-v1/tools/runtime-lib.sh:20:assert_plan(){ local p=\"$1\"; [[ -s \"$p\" && ! -L \"$p\" ]] || die PLAN_MISSING; grep -Fq 'CONTRACT|task=backup-retention-safe-gc-v1|policy=OWNER_AWARE_SAFE_GC' \"$p\" || die PLAN_CONTRACT_MISSING; grep -Eq '^KEEP\\|logical=vm200\\|generation=vm200-pve03-[0-9]{8}T[0-9]{6}Z\\|owner=pve03\\|reason=POLICY_NEWEST_2$' \"$p\" || die PLAN_VM200_KEEP_MISSING; awk -F'[=|]' '/^DELETE\\|/{l=\"\"; for(i=1;i<=NF;i++)if($i==\"logical\")l=$(i+1); if(l!~/^vm[0-9]+$/)bad=1} END{exit bad}' \"$p\" || die NON_VM_DELETE_CANDIDATE; }","HEAD:tasks/backup-retention-remote-stdin-hotfix-v1/assets/homelab-backup-retention-gc:38:    vm130|vm190|vm200) printf 'pve03\\n' ;;","HEAD:tasks/backup-retention-remote-stdin-hotfix-v1/phases/apply.sh:31:  jq -e '.status==\"OK\" and .root_cause_count==0 and .runtime_replaced==true and .new_sha==\"d5e70fca273e67ec272ea44f73558e28fb707902a09e96497a5fb7cecf4e3336\" and .vm200_planned==true and .gc_started==false and .cloud_writes==false' \"$FAILED/apply.json\" >/dev/null || die FAILED_APPLY_EVIDENCE_INVALID","HEAD:tasks/backup-retention-remote-stdin-hotfix-v1/phases/apply.sh:38:jq -n --argjson resumed \"$resumed\" '{status:\"OK\",root_cause_count:0,production_changed:true,runtime_replaced:true,resumed_existing_runtime:$resumed,recovered_failed_apply_run:(if $resumed then \"20260812T054054Z-1692543-apply\" else null end),old_sha:\"7a6f51f4fb360b31b53dcdd16a296670ae35bdad45a3ef8ff5ebd09d3982d518\",new_sha:\"d5e70fca273e67ec272ea44f73558e28fb707902a09e96497a5fb7cecf4e3336\",vm200_planned:true,gc_started:false,cloud_writes:false}' > \"$HOMELAB_RUN_DIR/apply.json\"","HEAD:tasks/backup-retention-remote-stdin-hotfix-v1/phases/dry-run.sh:13:jq -n '{status:\"OK\",root_cause_count:0,production_changed:false,candidate_plan_complete:true,vm200_planned:true,cloud_reads:true,cloud_writes:false,gc_started:false}' > \"$HOMELAB_RUN_DIR/dry-run.json\"","HEAD:tasks/backup-retention-remote-stdin-hotfix-v1/phases/seal.sh:9:jq -e '.status==\"OK\" and .runtime_verified==true and .remote_logicals_visible==true and .vm200_keep_verified==true and .gc_started==false and .cloud_writes==false' \"$V\" >/dev/null || die VERIFY_EVIDENCE_INVALID","HEAD:tasks/backup-retention-remote-stdin-hotfix-v1/phases/seal.sh:10:mkdir -p \"$(dirname \"$SEAL\")\"; tmp=\"${SEAL}.new.$$\"; jq -n --arg task \"$TASK_ID\" --arg change \"$CHANGE_ID\" --arg at \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\" --arg sha \"$NEW_SHA\" '{status:\"SEALED\",task_id:$task,change_id:$change,sealed_at_utc:$at,runtime_sha256:$sha,remote_stdin_isolated:true,vm200_retention_plan_proven:true,gc_executed:false,cloud_writes:false}' > \"$tmp\"; chmod 0644 \"$tmp\"; mv -f -- \"$tmp\" \"$SEAL\"; SS=\"$(sha \"$SEAL\")\"; jq -n --arg status OK --arg seal \"$SEAL\" --arg sha \"$SS\" '{status:$status,root_cause_count:0,production_changed:true,task_seal:$seal,task_seal_sha256:$sha,cloud_writes:false,gc_started:false}' > \"$HOMELAB_RUN_DIR/seal.json\"; echo \"SEAL_STATUS=OK|RETENTION_STDIN_ISOLATED=YES|VM200_PLAN_PROVEN=YES|GC_STARTED=NO|TASK_SEAL_SHA256=$SS\"","HEAD:tasks/backup-retention-remote-stdin-hotfix-v1/phases/verify.sh:11:test ! -e /var/lib/homelab-backup/retention-safe-gc/transactions/vm200","HEAD:tasks/backup-retention-remote-stdin-hotfix-v1/phases/verify.sh:12:jq -n '{status:\"OK\",root_cause_count:0,production_changed:true,runtime_verified:true,remote_logicals_visible:true,vm200_keep_verified:true,gc_started:false,cloud_writes:false}' > \"$HOMELAB_RUN_DIR/verify.json\"","HEAD:tasks/backup-retention-remote-stdin-hotfix-v1/task.json:49:      \"verification\": \"candidate read-only plan includes remote-owned vm200\"","HEAD:tasks/backup-retention-remote-stdin-hotfix-v1/task.json:59:      \"verification\": \"new runtime plan includes remote-owned VMs and vm200 is retained\"","HEAD:tasks/backup-retention-remote-stdin-hotfix-v1/task.json:101:    \"failure_evidence\": \"CR0035 verify plan stopped after first vm111 state and omitted vm200\",","HEAD:tasks/backup-retention-remote-stdin-hotfix-v1/task.json:102:    \"proof_requirement\": \"candidate and installed plan must contain remote-owned vm200 as POLICY_NEWEST_2 while GC remains unexecuted\",","HEAD:tasks/backup-retention-remote-stdin-hotfix-v1/tools/runtime-lib.sh:17:assert_plan(){ local p=\"$1\"; [[ -s \"$p\" && ! -L \"$p\" ]] || die PLAN_MISSING; grep -Fq 'CONTRACT|task=backup-retention-safe-gc-v1|policy=OWNER_AWARE_SAFE_GC' \"$p\" || die PLAN_CONTRACT_MISSING; for l in vm111 vm113 vm130 vm160 vm180 vm190 vm9130 vm200; do awk -v l=\"$l\" -F'|' '$1==\"KEEP\" || $1==\"PROTECT\" || $1==\"DELETE\" || $1==\"RETIRED\" {for(i=1;i<=NF;i++) if($i==\"logical=\" l){found=1}} END{exit !found}' \"$p\" || die \"PLAN_REMOTE_LOGICAL_MISSING_${l}\"; done; grep -Eq '^KEEP\\|logical=vm200\\|generation=vm200-pve03-[0-9]{8}T[0-9]{6}Z\\|owner=pve03\\|reason=POLICY_NEWEST_2$' \"$p\" || die PLAN_VM200_KEEP_MISSING; }","HEAD:tasks/backup-retention-remote-stdin-hotfix-v1/tools/test_contract.py:8:assert \"vm130|vm190|vm200) printf 'pve03\\\\n' ;;\" in asset","HEAD:tasks/backup-retention-safe-gc-v1/assets/homelab-backup-audit:407:  jq -n --arg task \"$TASK_ID\" --arg change \"$CHANGE_ID\" --arg at \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\" --arg backup \"$backup_status\" --arg control \"$control_status\" --arg escrow \"$escrow_status\" --arg staging \"$staging_status\" --arg retention \"$retention_status\" --argjson historical \"$historical_gc_proven\" --argjson owner_gc \"$owner_aware_gc_proven\" --argjson staging_bad \"$staging_bad\" --argjson staging_warn \"$staging_warn\" --argjson vm_count \"$vm_seen\" --argjson app_count \"$app_seen\" --argjson fresh \"$fresh\" --argjson stale \"$stale\" --argjson resume \"$resume\" --argjson unverified \"$unverified\" --argjson cloud_ok \"$cloud_ok\" --argjson scheduler_ok \"$scheduler_ok\" --argjson source_ok \"$source_ok\" --argjson source_drift \"$source_drift\" --argjson payload_leaks \"$payload_leaks\" '{schema:\"homelab-backup-unified-audit-v1\",task_id:$task,change_id:$change,updated_at_utc:$at,audit_status:\"OK\",backup_status:$backup,dr_readiness:\"NOT_PROVEN\",lifecycle_status:\"OPEN\",vm_count:$vm_count,app_count:$app_count,fresh_count:$fresh,stale_count:$stale,resume_count:$resume,unverified_count:$unverified,cloud_ok_count:$cloud_ok,scheduler_ok_count:$scheduler_ok,source_ok_count:$source_ok,source_drift_count:$source_drift,payload_leaks:$payload_leaks,control_status:$control,control_source_coverage:\"NOT_MACHINE_PROVEN\",staging_status:$staging,staging_bad_count:$staging_bad,staging_warn_count:$staging_warn,staging_node_count:3,escrow_status:$escrow,retention_status:$retention,historical_gc_proven:$historical,owner_aware_gc_proven:$owner_gc,provider_worm_proven:false,provider_worm_skipped_by_policy:true,clean_machine_bootstrap_proven:false,qemu_boot_restore_proven:false,full_site_dr_proven:false}' >\"$tmp\"","HEAD:tasks/backup-retention-transaction-resume-hotfix-v1/assets/homelab-backup-retention-gc:39:    vm130|vm190|vm200) printf 'pve03\\n' ;;","HEAD:tasks/backup-unified-monitoring-v1/README.md:5:The monitor separates execution health (`AUDIT_STATUS`), current backup data-plane state (`BACKUP_STATUS`), lifecycle gaps (`LIFECYCLE_STATUS`) and site-DR proof (`DR_READINESS`). It does not start backups, restore guests, mutate cloud objects, or claim retention/WORM/clean-machine/QEMU-boot/full-site-DR proof.","HEAD:tasks/backup-unified-monitoring-v1/assets/homelab-backup-audit:396:  jq -n --arg task \"$TASK_ID\" --arg change \"$CHANGE_ID\" --arg at \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\" --arg backup \"$backup_status\" --arg control \"$control_status\" --arg escrow \"$escrow_status\" --arg staging \"$staging_status\" --argjson staging_bad \"$staging_bad\" --argjson staging_warn \"$staging_warn\" --argjson vm_count \"$vm_seen\" --argjson app_count \"$app_seen\" --argjson fresh \"$fresh\" --argjson stale \"$stale\" --argjson resume \"$resume\" --argjson unverified \"$unverified\" --argjson cloud_ok \"$cloud_ok\" --argjson scheduler_ok \"$scheduler_ok\" --argjson source_ok \"$source_ok\" --argjson source_drift \"$source_drift\" --argjson payload_leaks \"$payload_leaks\" '{schema:\"homelab-backup-unified-audit-v1\",task_id:$task,change_id:$change,updated_at_utc:$at,audit_status:\"OK\",backup_status:$backup,dr_readiness:\"NOT_PROVEN\",lifecycle_status:\"OPEN\",vm_count:$vm_count,app_count:$app_count,fresh_count:$fresh,stale_count:$stale,resume_count:$resume,unverified_count:$unverified,cloud_ok_count:$cloud_ok,scheduler_ok_count:$scheduler_ok,source_ok_count:$source_ok,source_drift_count:$source_drift,payload_leaks:$payload_leaks,control_status:$control,control_source_coverage:\"NOT_MACHINE_PROVEN\",staging_status:$staging,staging_bad_count:$staging_bad,staging_warn_count:$staging_warn,staging_node_count:3,escrow_status:$escrow,retention_status:\"OPEN_NOT_IMPLEMENTED\",historical_gc_proven:false,provider_worm_proven:false,provider_worm_skipped_by_policy:true,clean_machine_bootstrap_proven:false,qemu_boot_restore_proven:false,full_site_dr_proven:false}' >\"$tmp\"","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/assets/pve03-r8152-lifecycle-helper.sh:5:TASK_ID=pve03-r8152-rx-ring-lifecycle-repair-v1","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/assets/pve03-r8152-lifecycle-helper.sh:14:STAGE=/var/lib/homelab-admin/staging/pve03-r8152-rx-ring-lifecycle-repair-v1","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/assets/pve03-r8152-lifecycle-helper.sh:160:  jq -n --arg before_link \"$before_link\" --arg after_link \"$after_link\" --argjson before_rx \"$before_rx\" --argjson after_rx \"$after_rx\" '{status:\"OK\",production_changed:true,lifecycle_repaired:true,script_replaced:true,service_definition_changed:false,rx_ring_changed:false,before_rx:$before_rx,after_rx:$after_rx,before_link:$before_link,after_link:$after_link,service_result:\"success\",service_active:\"active\",service_substate:\"exited\",link_is_failure_gate:false,link_diagnostic_preserved:true,automatic_rollback_triggered:false}' >\"$RESULT\"","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/assets/pve03-r8152-lifecycle-helper.sh:174:  jq -n --arg link \"$link\" --arg quorate \"$quorate\" --argjson current_rx \"$currx\" --argjson nodes \"$nodes\" '{status:\"OK\",production_changed:true,lifecycle_repaired:true,new_script_active:true,service_definition_changed:false,current_rx:$current_rx,rx_ring_changed:false,link_detected:$link,quorate:$quorate,nodes:$nodes,service_result:\"success\",service_active:\"active\",service_substate:\"exited\",link_is_failure_gate:false,link_diagnostic_preserved:true,rollback_payload_retained:true}' >\"$RESULT\"","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/apply.sh:17:jq -e '.status==\"OK\" and .production_changed==true and .lifecycle_repaired==true and .script_replaced==true and .service_definition_changed==false and .rx_ring_changed==false and .before_rx==4096 and .after_rx==4096 and .service_result==\"success\" and .service_active==\"active\" and .service_substate==\"exited\" and .link_is_failure_gate==false and .link_diagnostic_preserved==true and .automatic_rollback_triggered==false' <<<\"$R\" >/dev/null","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/apply.sh:19:jq -n --argjson remote \"$R\" '{status:\"OK\",root_cause_count:0,production_changed:true,pve03_changed:true,lifecycle_repaired:true,remote_result:$remote,canary_seal_unchanged:true,service_definition_changed:false,rx_ring_changed:false,network_restart_executed:false,vmbr0_changed:false}' >\"$HOMELAB_RUN_DIR/apply.json\"","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/dry-run.sh:16:jq -n '{status:\"OK\",root_cause_count:0,production_changed:false,pve03_changed:false,lifecycle_repair_planned:true,script_replace_planned:true,service_definition_change_planned:false,current_rx:4096,target_rx:4096,rx_change_planned:false,link_failure_gate_remove_planned:true,link_diagnostic_preserve_planned:true,network_restart_planned:false}' >\"$HOMELAB_RUN_DIR/dry-run.json\"","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/prepare.sh:11:asset_helper=\"$HOMELAB_TASK_DIR/assets/pve03-r8152-lifecycle-helper.sh\"","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/seal.sh:16:jq -e '.status==\"OK\" and .lifecycle_repaired==true and .remote_result.current_rx==4096 and .remote_result.service_result==\"success\" and .remote_result.link_is_failure_gate==false and .service_definition_changed==false and .rx_ring_changed==false and .canary_seal_unchanged==true and .network_restart_executed==false and .vmbr0_changed==false and .rollback_payload_retained==true' \"$V\" >/dev/null","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/seal.sh:20:jq -n --arg task \"$TASK_ID\" --arg change \"$CHANGE_ID\" --arg sealed \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\" --arg old \"$OLD_SCRIPT_SHA\" --arg new \"$NEW_SCRIPT_SHA\" --arg unit \"$OLD_SERVICE_SHA\" --arg canary \"$CANARY_SHA\" --arg stage \"$REMOTE_STAGE\" --argjson remote \"$R\" '{status:\"SEALED\",task_id:$task,change_id:$change,sealed_at_utc:$sealed,production_changed:true,pve03_changed:true,lifecycle_repaired:true,service_sha256:$unit,old_script_sha256:$old,new_script_sha256:$new,interface:\"nic1\",driver:\"r8152\",target_rx:4096,current_rx:4096,rx_ring_changed:false,service_definition_changed:false,service_result:\"success\",service_active:\"active\",service_substate:\"exited\",link_is_failure_gate:false,link_diagnostic_preserved:true,network_restart_executed:false,vmbr0_changed:false,canary_seal_sha256:$canary,canary_seal_unchanged:true,rollback_payload_retained:true,remote_rollback_stage:$stage,remote_verify:$remote}' >\"$tmp\"","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/seal.sh:24:jq -n --arg sha \"$ss\" '{status:\"OK\",root_cause_count:0,production_changed:true,lifecycle_repaired:true,task_seal_sha256:$sha}' >\"$HOMELAB_RUN_DIR/seal.json\"","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/verify.sh:16:jq -e '.status==\"OK\" and .lifecycle_repaired==true and .new_script_active==true and .service_definition_changed==false and .current_rx==4096 and .rx_ring_changed==false and .link_detected==\"yes\" and .quorate==\"Yes\" and .nodes==3 and .service_result==\"success\" and .service_active==\"active\" and .service_substate==\"exited\" and .link_is_failure_gate==false and .link_diagnostic_preserved==true and .rollback_payload_retained==true' <<<\"$R\" >/dev/null","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/verify.sh:18:jq -e '.status==\"OK\" and .lifecycle_repaired==true and .remote_result.rx_ring_changed==false and .service_definition_changed==false and .canary_seal_unchanged==true and .network_restart_executed==false and .vmbr0_changed==false' \"$A\" >/dev/null","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/verify.sh:20:jq -n --argjson remote \"$R\" '{status:\"OK\",root_cause_count:0,production_changed:true,pve03_changed:true,lifecycle_repaired:true,remote_result:$remote,canary_seal_unchanged:true,service_definition_changed:false,rx_ring_changed:false,network_restart_executed:false,vmbr0_changed:false,rollback_payload_retained:true}' >\"$HOMELAB_RUN_DIR/verify.json\"","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/task.json:3:  \"task_id\": \"pve03-r8152-rx-ring-lifecycle-repair-v1\",","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/task.json:26:    \"ssh:root@[PRIVATE_IP]:/var/lib/homelab-admin/staging/pve03-r8152-rx-ring-lifecycle-repair-v1\",","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/task.json:29:    \"/var/lib/homelab-admin/seals/pve03-r8152-rx-ring-lifecycle-repair-v1.json\"","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/task.json:32:    \"ssh:root@[PRIVATE_IP]:/var/lib/homelab-admin/staging/pve03-r8152-rx-ring-lifecycle-repair-v1\",","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/task.json:35:    \"/var/lib/homelab-admin/seals/pve03-r8152-rx-ring-lifecycle-repair-v1.json\"","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/task.json:71:      \"verification\": \"lifecycle repair sealed with exact source hashes, RX unchanged and CR0015 canary seal unchanged\"","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/task.json:87:    \"command\": \"HOMELAB_CONTROLLED_APPLY_CONFIRM=pve03-r8152-rx-ring-lifecycle-repair-v1 /opt/homelab-admin/bin/homelab-admin run TASK_DIR rollback\",","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/task.json:128:    \"assets/pve03-r8152-lifecycle-helper.sh\"","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/tools/runtime-lib.sh:2:TASK_ID=pve03-r8152-rx-ring-lifecycle-repair-v1","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/tools/runtime-lib.sh:5:REMOTE_STAGE=/var/lib/homelab-admin/staging/pve03-r8152-rx-ring-lifecycle-repair-v1","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/tools/runtime-lib.sh:6:REMOTE_HELPER=$REMOTE_STAGE/pve03-r8152-lifecycle-helper.sh","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/tools/runtime-lib.sh:17:SEAL=/var/lib/homelab-admin/seals/pve03-r8152-rx-ring-lifecycle-repair-v1.json","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/tools/runtime-lib.sh:25:assert_remote_stage(){ local a h n; a=\"$HOMELAB_TASK_DIR/assets/pve03-r8152-lifecycle-helper.sh\"; n=\"$HOMELAB_TASK_DIR/assets/homelab-pve03-r8152-rx-ring\"; h=\"$(ssh \"${SSH_BASE[@]}\" \"$REMOTE_HOST\" /usr/bin/sha256sum \"$REMOTE_HELPER\" | awk '{print $1}')\"; [[ \"$h\" == \"$(sha \"$a\")\" ]] || die REMOTE_HELPER_SHA_BAD; h=\"$(ssh \"${SSH_BASE[@]}\" \"$REMOTE_HOST\" /usr/bin/sha256sum \"$REMOTE_NEW\" | awk '{print $1}')\"; [[ \"$h\" == \"$NEW_SCRIPT_SHA\" && \"$h\" == \"$(sha \"$n\")\" ]] || die REMOTE_NEW_SHA_BAD; ssh \"${SSH_BASE[@]}\" \"$REMOTE_HOST\" /usr/bin/test -s \"$REMOTE_STAGE/baseline.json\" || die REMOTE_BASELINE_MISSING; }","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/tools/test_contract.py:6:helper=(T/\"assets/pve03-r8152-lifecycle-helper.sh\").read_text(encoding=\"utf-8\")","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/tools/test_contract.py:17:subprocess.run([\"bash\",\"-n\",str(T/\"assets/pve03-r8152-lifecycle-helper.sh\")],check=True)","HEAD:tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/tools/test_contract.py:21:assert task[\"task_id\"]==\"pve03-r8152-rx-ring-lifecycle-repair-v1\"","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/assets/homelab-backup-audit:407:  jq -n --arg task \"$TASK_ID\" --arg change \"$CHANGE_ID\" --arg at \"$(date -u +%Y-%m-%dT%H:%M:%SZ)\" --arg backup \"$backup_status\" --arg control \"$control_status\" --arg escrow \"$escrow_status\" --arg staging \"$staging_status\" --arg retention \"$retention_status\" --argjson historical \"$historical_gc_proven\" --argjson owner_gc \"$owner_aware_gc_proven\" --argjson staging_bad \"$staging_bad\" --argjson staging_warn \"$staging_warn\" --argjson vm_count \"$vm_seen\" --argjson app_count \"$app_seen\" --argjson fresh \"$fresh\" --argjson stale \"$stale\" --argjson resume \"$resume\" --argjson unverified \"$unverified\" --argjson cloud_ok \"$cloud_ok\" --argjson scheduler_ok \"$scheduler_ok\" --argjson source_ok \"$source_ok\" --argjson source_drift \"$source_drift\" --argjson payload_leaks \"$payload_leaks\" '{schema:\"homelab-backup-unified-audit-v1\",task_id:$task,change_id:$change,updated_at_utc:$at,audit_status:\"OK\",backup_status:$backup,dr_readiness:\"NOT_PROVEN\",lifecycle_status:\"OPEN\",vm_count:$vm_count,app_count:$app_count,fresh_count:$fresh,stale_count:$stale,resume_count:$resume,unverified_count:$unverified,cloud_ok_count:$cloud_ok,scheduler_ok_count:$scheduler_ok,source_ok_count:$source_ok,source_drift_count:$source_drift,payload_leaks:$payload_leaks,control_status:$control,control_source_coverage:\"NOT_MACHINE_PROVEN\",staging_status:$staging,staging_bad_count:$staging_bad,staging_warn_count:$staging_warn,staging_node_count:3,escrow_status:$escrow,retention_status:$retention,historical_gc_proven:$historical,owner_aware_gc_proven:$owner_gc,provider_worm_proven:false,provider_worm_skipped_by_policy:true,clean_machine_bootstrap_proven:false,qemu_boot_restore_proven:false,full_site_dr_proven:false}' >\"$tmp\"","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/assets/homelab-backup-retention-gc:38:    vm130|vm190|vm200) printf 'pve03\\n' ;;","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/phases/dry-run.sh:20:grep -Fq 'vm200' \"$RETENTION_ASSET\"","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/phases/rollback.sh:27:jq -n --arg status OK '{status:$status,root_cause_count:0,production_changed:true,ct200_destroyed:true,backup_runtime_restored:true,vm_target_count_restored:12,vm200_cloud_backup_preserved:true,vm200_restore_evidence_preserved:true,old_mvp_preserved:true}' > \"$HOMELAB_RUN_DIR/rollback.json\"","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/phases/verify.sh:24:grep -Eq '^(KEEP|PROTECT|DELETE)\\|logical=vm200\\|' \"$retention_out\" || die RETENTION_VM200_MISSING","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/task.json:45:    \"rclone:pve01-mail-01-crypt:homelab-backups/vm200\",","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/task.json:46:    \"rclone:pve01-mail-02-crypt:homelab-backups/vm200\",","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/task.json:55:    \"ssh:root@[PRIVATE_IP]:/var/lib/homelab-backup/cloud-quorum/vm200\",","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/task.json:56:    \"ssh:root@[PRIVATE_IP]:/var/lib/homelab-backup/vm-restore-validation/vm200\"","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/task.json:73:    \"rclone:pve01-mail-01-crypt:homelab-backups/vm200\",","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/task.json:74:    \"rclone:pve01-mail-02-crypt:homelab-backups/vm200\",","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/task.json:80:    \"ssh:root@[PRIVATE_IP]:/var/lib/homelab-backup/cloud-quorum/vm200\",","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/task.json:81:    \"ssh:root@[PRIVATE_IP]:/var/lib/homelab-backup/vm-restore-validation/vm200\"","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/task.json:107:      \"verification\": \"proves CT boot/DNS, vm200 SEALED_PROVEN, retention owner mapping, 13-target audit and zero runtime source drift\"","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/task.json:112:      \"verification\": \"destroys only exact CT200 configuration and restores exact pre-CR runtime bytes while preserving any sealed vm200 cloud generation/evidence\"","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/task.json:139:    \"verification\": \"CT200 absent; exact old queue/probe/worker/audit/retention bytes restored on all relevant nodes; audit returns vm_count=12 and source_drift_count=0; sealed vm200 cloud backup is preserved fail-safe\"","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/task.json:146:    \"cloud objects outside the new vm200 namespace are not mutated\",","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/task.json:181:    \"initial_vm200_backup_required\": true,","HEAD:tasks/skladchik-moderator-ct200-infrastructure-v1/tools/test_contract.py:33:assert \"vm130|vm190|vm200) printf 'pve03\\\\n' ;;\" in retention","HEAD:tasks/skladchik-moderator-v2-application-v1/task.json:105:      \"compile\": \"remote CT lifecycle helper\"","HEAD:tasks/skladchik-moderator-v2-application-v1/tools/runtime-lib.sh:28:assert_seals(){ assert_regular \"$INFRA_SEAL\"; [[ \"$(sha \"$INFRA_SEAL\")\" == \"$INFRA_SEAL_SHA\" ]] || die INFRA_SEAL_SHA_MISMATCH; jq -e '.status==\"SEALED\" and .ctid==200 and .vm_target_count==13 and .application_v2_installed==false and .cookie_onboarded==false' \"$INFRA_SEAL\" >/dev/null || die INFRA_SEAL_INVALID; assert_regular \"$RETENTION_SEAL\"; [[ \"$(sha \"$RETENTION_SEAL\")\" == \"$RETENTION_SEAL_SHA\" ]] || die RETENTION_SEAL_SHA_MISMATCH; jq -e '.status==\"SEALED\" and .vm200_retention_plan_proven==true and .gc_executed==false' \"$RETENTION_SEAL\" >/dev/null || die RETENTION_SEAL_INVALID; }","HEAD:tasks/skladchik-reports-monitor-controlled-reauth-v1/task.json:234:    \"operator_refresh_lifecycle\": [","HEAD:tests/test_cr_2026_0012_skladchik_cookie_refresh_runbook.py:36:    def test_full_lifecycle_order_is_explicit(self) -> None:","HEAD:tests/test_cr_2026_0035_skladchik_moderator_ct200.py:20:    def test_vm200_is_canonical_lxc_on_pve03(self) -> None:","HEAD:tests/test_cr_2026_0035_skladchik_moderator_ct200.py:27:    def test_audit_and_retention_include_vm200(self) -> None:","HEAD:tests/test_cr_2026_0035_skladchik_moderator_ct200.py:32:        self.assertIn(\"vm130|vm190|vm200) printf 'pve03\\\\n' ;;\", retention)","HEAD:tests/test_cr_2026_0036_skladchik_moderator_v2.py:455:    def test_db_text_encoding_lifecycle_is_independent_and_rollback_safe(self):","HEAD:tests/test_cr_2026_0036_skladchik_moderator_v2.py:513:    def test_rules_hotfix_lifecycle_restages_live_probe_and_rollback_is_seal_safe(self):","HEAD:tests/test_cr_2026_0036_skladchik_moderator_v2.py:560:    def test_collector_hotfix_lifecycle_is_seal_and_rollback_safe(self):","HEAD:tests/test_cr_2026_0057_control_refresh.py:30:    def test_lifecycle_cloud_boundary(self):","HEAD:tests/test_cr_2026_0057_control_refresh.py:36:    def test_source_worktree_must_be_clean_for_lifecycle(self):"],"head":"4b427f5f0406cab6757cf8889fd479a62d218261","head_commit":"4b427f5f0406cab6757cf8889fd479a62d218261|2026-08-13T10:45:11+03:00|docs(CR-2026-0058): make CT200 replacement proof owner-aware","hit_files":[{"blob":"b8c98568b40a59c5e452e12835ae1924cba5bab4","path":"changes/CR-2026-0005/plan.md"},{"blob":"17f5adc7d28ce77a2ceeeb26a2541ff10a556958","path":"changes/CR-2026-0006/plan.json"},{"blob":"9faaa5679ff920509f23799ede7f53c8feffb390","path":"changes/CR-2026-0007/plan.json"},{"blob":"69d0bd7ae465aa8bf065d86bfb8d0b1a53ea58ee","path":"changes/CR-2026-0012/plan.json"},{"blob":"c45305eb1066f842fcd621e74ad68a6debd7962d","path":"changes/CR-2026-0030/implementation.md"},{"blob":"9195917b513ef95875bab7c9f9d007a3dbae0dac","path":"changes/CR-2026-0030/tests.md"},{"blob":"470bec45f0ec929fec32615e69b18d75a793347f","path":"changes/CR-2026-0031/risk.md"},{"blob":"043d175b0b3381595ef55ea9322cf58763794f00","path":"changes/CR-2026-0032/README.md"},{"blob":"87fe46bc5f804bd95cfd3f7e83fad2e8afba5b10","path":"changes/CR-2026-0035/implementation.md"},{"blob":"e8b5c8d3e67068b1cd477969ff4b7a6625193db7","path":"changes/CR-2026-0035/risk.md"},{"blob":"77166599150be819387e130677988174a19af59f","path":"changes/CR-2026-0035/tests.md"},{"blob":"ccb02467f67e50f6130ab3dd79f6dfc23f5f045f","path":"changes/CR-2026-0036/implementation.md"},{"blob":"defa021afc732d4e75cce165f7d748bea9317d8f","path":"changes/CR-2026-0049/source-provenance.tsv"},{"blob":"6e8c73d7d1d592bab2b0cb3cae1a551c7a640423","path":"changes/CR-2026-0049/task-package.sha256"},{"blob":"3963f962ced2ca39731680306cd153749616a9b2","path":"changes/CR-2026-0054/implementation.md"},{"blob":"e6e01a0f4a6fddad1dd9665d08d1a97d22c152c2","path":"changes/CR-2026-0054/tests.md"},{"blob":"9322a9c023d35be9f5003cc41ae687f0900f0de7","path":"changes/CR-2026-0057/implementation.md"},{"blob":"3779f6f28b2bdd01e1541121a2f3e5947963c399","path":"changes/CR-2026-0057/tests.md"},{"blob":"53430b7f739fb98897b04b248cf5e9a66c0991c0","path":"docs/superpowers/plans/2026-08-12-vm170-apps-b-retirement-implementation.md"},{"blob":"e0f59a8c442cbcaddaf69a9fc475e86d68f0886f","path":"docs/superpowers/plans/2026-08-13-backup-control-coverage-hardening-implementation.md"},{"blob":"aa99cb4e9568930cac4c84f9867d82bb94a476a1","path":"docs/superpowers/plans/2026-08-13-control-refresh-implementation.md"},{"blob":"8ac672a6f394500463465bc04c12b743ddfb42d8","path":"docs/superpowers/plans/2026-08-13-legacy-backup-target-retirement-implementation.md"},{"blob":"8bf377cec2719d7f8249407471b18fc6095b838a","path":"docs/superpowers/specs/2026-08-12-vm170-apps-b-retirement-design.md"},{"blob":"860a3ded9369f129c3a761cb702a77bad3118efb","path":"docs/superpowers/specs/2026-08-13-backup-control-coverage-hardening-design.md"},{"blob":"b39bb04840862c37c3b5f93d57cf3c8d3682378c","path":"docs/superpowers/specs/2026-08-13-control-refresh-design.md"},{"blob":"36edd4ad024a74760e58a99f251beabafa6f7ad4","path":"docs/superpowers/specs/2026-08-13-legacy-backup-target-retirement-design.md"},{"blob":"1197908146e655657316195a770cae38cef2d6dc","path":"observed/source-snapshots/dependency-map-latest.tsv"},{"blob":"7ca7c24801bffc9bdcb88c20830dec715f4e6f6d","path":"tasks/backup-control-coverage-hardening-v1/assets/homelab-backup-audit"},{"blob":"1769ba9fc3083b65a448e498bfd9714e6832cd7f","path":"tasks/backup-control-final-generation-v1/assets/runtime/homelab-backup-audit"},{"blob":"7ca7c24801bffc9bdcb88c20830dec715f4e6f6d","path":"tasks/backup-control-refresh-v1/assets/runtime/homelab-backup-audit"},{"blob":"8ed6e4ef527c69dff55f444c78e4a19feaf4c879","path":"tasks/backup-control-refresh-v1/assets/runtime/homelab-backup-retention-gc"},{"blob":"ac4d5b1eb6f1adfd14d48ca26ac37227e4c99513","path":"tasks/backup-control-refresh-v1/task.json"},{"blob":"76d6c8eb28f2bd249ba469ab77488b03ce022196","path":"tasks/backup-retention-plan-stability-hotfix-v1/assets/homelab-backup-retention-gc"},{"blob":"c631d5b296b8ecd5810fe4cb60c6f4e6ba3b9c62","path":"tasks/backup-retention-plan-stability-hotfix-v1/tools/runtime-lib.sh"},{"blob":"7738957cb10a77d88e205111fd71a80fa61bd09f","path":"tasks/backup-retention-remote-stdin-hotfix-v1/assets/homelab-backup-retention-gc"},{"blob":"c5c8ee836c5acd690c1edfbad7968a8a03ed941d","path":"tasks/backup-retention-remote-stdin-hotfix-v1/phases/apply.sh"},{"blob":"486b021a5b538927eb09ca037f480d72bce4279a","path":"tasks/backup-retention-remote-stdin-hotfix-v1/phases/dry-run.sh"},{"blob":"cb33dac623282fdd768166135a52cdfde7051741","path":"tasks/backup-retention-remote-stdin-hotfix-v1/phases/seal.sh"},{"blob":"9c4a6b05b20fd97f5ffff4b30fa2f8fe26365f8f","path":"tasks/backup-retention-remote-stdin-hotfix-v1/phases/verify.sh"},{"blob":"2771655d95130aa7368a919a15e09cc837111111","path":"tasks/backup-retention-remote-stdin-hotfix-v1/task.json"},{"blob":"1cdd318a710104eaaca0cbcf732fae0c1291cb4a","path":"tasks/backup-retention-remote-stdin-hotfix-v1/tools/runtime-lib.sh"},{"blob":"942f1e7cc2191a00cb95cef563f41c6a644b6820","path":"tasks/backup-retention-remote-stdin-hotfix-v1/tools/test_contract.py"},{"blob":"1769ba9fc3083b65a448e498bfd9714e6832cd7f","path":"tasks/backup-retention-safe-gc-v1/assets/homelab-backup-audit"},{"blob":"8ed6e4ef527c69dff55f444c78e4a19feaf4c879","path":"tasks/backup-retention-transaction-resume-hotfix-v1/assets/homelab-backup-retention-gc"},{"blob":"9a7c23eb8ddfa7a63e8aa546d5164529e658f023","path":"tasks/backup-unified-monitoring-v1/README.md"},{"blob":"2280847143ad79c71b77db18bdb1c638bde4e7c3","path":"tasks/backup-unified-monitoring-v1/assets/homelab-backup-audit"},{"blob":"bb4f027cb2018dbe3883f64c507cfbec150092d0","path":"tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/assets/pve03-r8152-lifecycle-helper.sh"},{"blob":"d4bed407e8afb2dc7a35715928170a4499fd1635","path":"tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/apply.sh"},{"blob":"528cb4ccf43258855fea89a1ddcebc6367803c21","path":"tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/dry-run.sh"},{"blob":"1dc06d6fadccaf4b2bc38b64935d7efc3baf036c","path":"tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/prepare.sh"},{"blob":"0854080ad7ff316a409e05bb6ec383d914ce1695","path":"tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/seal.sh"},{"blob":"61a6c56cd7c972c31b593072b444181c9fe8b1dd","path":"tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/phases/verify.sh"},{"blob":"70fc54a265dabad376c98defa0d7b6a5d8e86abf","path":"tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/task.json"},{"blob":"5304252574b3e31165d11d1ddb07c438e6ce486c","path":"tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/tools/runtime-lib.sh"},{"blob":"6eecf9b78607ac0f2799f01e1ae638ee40ff03c2","path":"tasks/pve03-r8152-rx-ring-lifecycle-repair-v1/tools/test_contract.py"},{"blob":"a425ecd524835c669310302126a1d325ae912dd6","path":"tasks/skladchik-moderator-ct200-infrastructure-v1/assets/homelab-backup-audit"},{"blob":"7738957cb10a77d88e205111fd71a80fa61bd09f","path":"tasks/skladchik-moderator-ct200-infrastructure-v1/assets/homelab-backup-retention-gc"},{"blob":"57b6621ce47cd506c7f5e825b5a6bb3728e6332d","path":"tasks/skladchik-moderator-ct200-infrastructure-v1/phases/dry-run.sh"},{"blob":"c8ce6fc5c414a9673a57160ab0f08b5b147af22b","path":"tasks/skladchik-moderator-ct200-infrastructure-v1/phases/rollback.sh"},{"blob":"b565943a9da98d5fbda211ea89cc69f2f4f51bbf","path":"tasks/skladchik-moderator-ct200-infrastructure-v1/phases/verify.sh"},{"blob":"455d5183f71ce6a8b2a6c34d7e5a7616023d203f","path":"tasks/skladchik-moderator-ct200-infrastructure-v1/task.json"},{"blob":"c4d3eac95a1abe0cde1c7cf29e8fd58b7bd130af","path":"tasks/skladchik-moderator-ct200-infrastructure-v1/tools/test_contract.py"},{"blob":"0e7f38b73fd87672d806a23b60272c6548aac845","path":"tasks/skladchik-moderator-v2-application-v1/task.json"},{"blob":"db72a33d3fe6696895d56ae41778dadc10b6a298","path":"tasks/skladchik-moderator-v2-application-v1/tools/runtime-lib.sh"},{"blob":"68ae87029a1660255df02ff192e5b9206e9a6c05","path":"tasks/skladchik-reports-monitor-controlled-reauth-v1/task.json"},{"blob":"aefe7ac6860ec2107c281485b35c8cba1f1196ef","path":"tests/test_cr_2026_0012_skladchik_cookie_refresh_runbook.py"},{"blob":"4b696b282810207e45bb9d2b351a1d22ee37fe93","path":"tests/test_cr_2026_0035_skladchik_moderator_ct200.py"},{"blob":"6888cd3ef05ced3789bb9564b9c2f3b3d337a8f2","path":"tests/test_cr_2026_0036_skladchik_moderator_v2.py"},{"blob":"2964926a43e0d46571e0d320bd8af437d7f49814","path":"tests/test_cr_2026_0057_control_refresh.py"}],"label":"CR0058_RETIREMENT","path":"/root/homelab-ops-cr-2026-0058"}]
RELEVANT_GIT_HISTORY=["c6114944985f813794821629f889d7a8c6677743|2026-09-01T06:26:03Z||Merge pull request 'CR0106 harden Gitea reconciler token lifecycle' (#44) from cr-2026-0106-gitea-reconciler-token-lifecycle-hardening into main","1d63b2607eea5dd5a8a390cd8b22e07a39aed7be|2026-09-01T09:16:48+03:00||CR0106 harden Gitea reconciler token lifecycle","69acde73c234db97f6e2e080a0f725e8abd970d6|2026-09-01T08:27:21+03:00||CR0106 define Gitea reconciler token lifecycle contract (RED)","34d76b1cfd4071d94290edac50a31a8c0d4c11c8|2026-08-14T17:19:33+03:00| (cr-2026-0072-gfs-retention)|fix(CR-2026-0072): close GFS runtime hash dependency graph","7706ef27f79851e7b8e4a7a96359882280d851f1|2026-08-14T17:09:54+03:00||fix(CR-2026-0072): make GFS capacity guard partial-snapshot safe and fail-fast","5c827ac4cdc98802c9b3a63c95ea8b68be296dd8|2026-08-14T14:11:05+03:00||feat(CR-2026-0072): add completed-period GFS retention","dbf8266d5f2bc4c87024ea8f0eb5f0e8922c7519|2026-08-14T12:04:14+03:00| (cr-2026-0070-backup-target-lifecycle-registry)|fix(CR-2026-0070): make approved diffs Git-whitespace safe","e749d9c8965e1672088630e5fd51f8a6a6dafc48|2026-08-14T07:49:09+03:00||feat(CR-2026-0066): retire legacy APP backup target on current baseline","2c2f378aec7dc4ac23c633a31f738a850fface56|2026-08-13T20:37:13+03:00| (cr-2026-0065-backup-retention-dynamic-pinned-prune-mailru-cleanup)|fix(CR-2026-0065): make pre-transaction repin crash-recoverable","b81ff4933b3521aba703122ae7212e05d3dcbf56|2026-08-13T20:26:43+03:00||fix(CR-2026-0065): align pinned state SHA with canonical retention semantics","2649ed17a513fba92255d3afb31136995370702e|2026-08-13T20:21:13+03:00||feat(CR-2026-0065): dynamic pinned retention prune and Mail.ru cleanup","d3a11bde0e73ddfd7049693782d44100c0c1130e|2026-08-13T18:14:01+03:00| (cr-2026-0064-backup-retention-pinned-scheduled-scope-hotfix)|fix(CR-2026-0064): make expected runtime diff ERR-trap safe","c5391b12df42b9d948221c7cd617550b519fea5f|2026-08-13T18:04:33+03:00||fix(CR-2026-0064): pin scheduled retention scope across lock transition","1a0e4ce27b94bbfbf7b60829974a728b5eba3ad2|2026-08-13T10:36:00+03:00| (cr-2026-0060-backup-retention-remote-list-failclosed-hotfix)|fix(CR-2026-0060): fail closed on retention remote listing errors","8419463d497abbe1de724235c5fee80fc373e85b|2026-08-13T10:35:38+03:00||docs(CR-2026-0058): add legacy backup target retirement implementation plan","e999f21d0f831c62b6b9b4c37b0ae8766f1b2f38|2026-08-13T10:16:03+03:00||docs(CR-2026-0058): design legacy backup target retirement","a3e5b6c4c12ab1c87ae8b32efc1d120b33ccc81c|2026-08-13T08:51:54+03:00||fix(CR-2026-0054): follow sealed CR0055 retention runtime","b69b63f531fb71eb95ab147bbfce57591f90e0a4|2026-08-13T08:51:17+03:00| (cr-2026-0056-backup-retention-transaction-resume-hotfix)|fix(CR-2026-0056): resume retention transactions before empty-plan return","902126179efd488e20938a091dcee36109829b86|2026-08-13T08:29:23+03:00| (cr-2026-0055-backup-retention-plan-stability-hotfix)|fix(CR-2026-0055): stabilize retention delete-set comparison","0c859469afa77510448a0a3809bc7bd988b18e92|2026-08-12T23:16:37+03:00||CR-2026-0047: add VM170 retirement controlled lifecycle","801579bd301ad0b28f462f462919660b38041344|2026-08-12T21:10:15+03:00| (cr-2026-0049-pve03-r8152-lifecycle-repair)|feat(CR-2026-0049): repair pve03 r8152 lifecycle semantics","c7a72a516b74e73b07df646374fa938eac055f32|2026-08-12T08:46:42+03:00| (cr-2026-0035-skladchik-moderator-ct200)|fix(CR-2026-0035): make retention hotfix apply resumable","c959df1be49714f8e00bfcf20c002ac71fcc6625|2026-08-12T08:33:25+03:00||fix(CR-2026-0035): isolate retention remote stdin","e72551bfd2db727067efae4dcc3f00de0bd04e6d|2026-08-11T11:30:51+03:00||CR-2026-0034: capture final CONTROL after monitoring and retention","42fd895f421ebc177006c5eb4173f7b4f40ad47f|2026-08-11T09:52:10+03:00| (cr-2026-0033-backup-retention-safe-gc)|fix(CR-2026-0033): accept git-normalized source executable mode","89c13f59c7c27150cb795fab0febd18c5b55662d|2026-08-11T09:36:35+03:00||CR-2026-0033: add owner-aware safe retention GC"]
CR0072_HEAD_STAT=["34d76b1 (HEAD -> cr-2026-0072-gfs-retention) fix(CR-2026-0072): close GFS runtime hash dependency graph"," changes/CR-2026-0072/implementation.md             |  2 +"," changes/CR-2026-0072/package.sha256                | 22 +++++-----"," changes/CR-2026-0072/risk.md                       |  2 +"," changes/CR-2026-0072/source-provenance.tsv         |  3 ++"," changes/CR-2026-0072/tests.md                      |  2 +"," errors/regression-cases.json                       |  7 ++++"," .../homelab-backup-retention-gc.diff               |  6 +--"," .../assets/homelab-backup-retention-gc             |  2 +-"," tasks/backup-gfs-retention-v1/task.json            |  3 +-"," tasks/backup-gfs-retention-v1/tools/runtime-lib.sh |  2 +-"," .../backup-gfs-retention-v1/tools/test_contract.py | 47 +++++++++++++---------"," tests/test_cr_2026_0072_gfs_retention.py           | 12 +++++-"," 12 files changed, 73 insertions(+), 37 deletions(-)"]
CR0072_RELEVANT_PATCH_LINES=["commit 34d76b1cfd4071d94290edac50a31a8c0d4c11c8","Author:     homelab-ops-bootstrap <root@pve01.gram1.ru>","AuthorDate: Fri Aug 14 17:19:33 2026 +0300","Commit:     homelab-ops-bootstrap <root@pve01.gram1.ru>","CommitDate: Fri Aug 14 17:19:33 2026 +0300","    fix(CR-2026-0072): close GFS runtime hash dependency graph","diff --git a/changes/CR-2026-0072/implementation.md b/changes/CR-2026-0072/implementation.md","--- a/changes/CR-2026-0072/implementation.md","+++ b/changes/CR-2026-0072/implementation.md","@@ -5,3 +5,5 @@ Install a separate GFS policy/helper and a retention runtime preserving all CR00"," CMD-907 exposed a cross-layer contract defect: CR0071 observability snapshots may legitimately omit a target while it is RESUME/UNVERIFIED, but the first capacity guard required every critical VM in only the newest snapshot. Capacity sizing now uses the maximum positive size seen for each critical VM in bounded recent history (48h), while current cloud free space must come from a recent snapshot (4h). Missing-never-seen and stale-per-target inputs still fail closed.","diff --git a/changes/CR-2026-0072/package.sha256 b/changes/CR-2026-0072/package.sha256","--- a/changes/CR-2026-0072/package.sha256","+++ b/changes/CR-2026-0072/package.sha256","@@ -1,13 +1,13 @@","-fe2df1ef9f21f675ed838f037a29d2ebfb4185cb331f59bbd0e3bd5324c8e4d4  tasks/backup-gfs-retention-v1/assets/approved-diffs/homelab-backup-retention-gc.diff","+a1548ace3148e2eb441d88a51c39a907b1fadb266ab2893df88a62fb56c2d502  tasks/backup-gfs-retention-v1/assets/approved-diffs/homelab-backup-retention-gc.diff"," ea6526bec7d7591bef876799cecddff4849631a936edc9f593b47211fbad715c  tasks/backup-gfs-retention-v1/assets/gfs-retention.json"," 6b7ec1ab3ee1c540a9113b5620c3b4b5a50de6536f3a069d31b2e1243f23bafa  tasks/backup-gfs-retention-v1/assets/homelab-backup-gfs-policy","-494906d747b62a6492ccbd105e59a49cf244b5a13770159073c150e55e2dd1c5  tasks/backup-gfs-retention-v1/assets/homelab-backup-retention-gc","+4bc3ba9bcb0dfd7d0497104e2b41d11e82a32f9567cd511ee5302fefdb3699a5  tasks/backup-gfs-retention-v1/assets/homelab-backup-retention-gc"," 1e7eeec3c314c78c8085c04d4acf083e7f68beacdb0565ccae32fd9ebdc1773b  tasks/backup-gfs-retention-v1/phases/apply.sh"," 79ea9be32836a30f2fe02cf51e9ecea4e950c71c09a3b86ee7b29bcef6fb09e7  tasks/backup-gfs-retention-v1/phases/dry-run.sh"," 2aa749a57f0d3769b0252093659cd1f4c330054e4ba23b8b87a52528481b2ff9  tasks/backup-gfs-retention-v1/phases/preflight.sh","@@ -15,8 +15,8 @@ ea6526bec7d7591bef876799cecddff4849631a936edc9f593b47211fbad715c  tasks/backup-g"," f0e7ff8c7d1b402bfb12a1f395aa7b7583898480f3a7cc563e2ba00d5367d966  tasks/backup-gfs-retention-v1/phases/rollback.sh"," a98a10c737bdcf33f820f1f9c9858b821f8d7a29094237a47301087a19774f3f  tasks/backup-gfs-retention-v1/phases/seal.sh"," 9c15680750983437ad56679bd6be60e260c778fb4c2f4a0f6afcbd47c65fb266  tasks/backup-gfs-retention-v1/phases/verify.sh","-2063a58463c3e3a2b9ef75c5d6d8cc9ce01bed9eb0b9f336e441fad0b034be4b  tasks/backup-gfs-retention-v1/task.json","+cddef5fb6c9ca667fd198b777a1118ebefdbd177d6ccfa6544798abd8a20bc06  tasks/backup-gfs-retention-v1/task.json"," c40a1ef0555263219fb0a78b7dffffd10435818dd313438faee8eaad14b9f6c6  tasks/backup-gfs-retention-v1/tools/capacity_guard.py","-d8f17255f75332f7150b1ffae35aeb39aca2ccf0df20e5a0756310898b81b62f  tasks/backup-gfs-retention-v1/tools/runtime-lib.sh","-5da038162ef5fac00317cf12055b833ef6bb6fe58baae4afe0f0ed1fcce77460  tasks/backup-gfs-retention-v1/tools/test_contract.py","+5fb5bae9b59f4de1c6ffde7a28462877dcb3c352453b449612dbd47ad0963e82  tasks/backup-gfs-retention-v1/tools/runtime-lib.sh","+1afb2e72ac627bc1767642866d03485c27bc7723e50950d9864250d715cbaf93  tasks/backup-gfs-retention-v1/tools/test_contract.py","diff --git a/changes/CR-2026-0072/risk.md b/changes/CR-2026-0072/risk.md","--- a/changes/CR-2026-0072/risk.md","+++ b/changes/CR-2026-0072/risk.md","@@ -5,3 +5,5 @@ Main destructive risk is accidentally broadening DELETE. Candidate plan must rem"," Capacity risk is bounded conservatively: for each critical VM use the maximum archive size observed in the last 48 hours, multiply the sum by all 10 possible GFS buckets, and require the result to consume no more than 50% of free space on the tighter cloud. The newest observability snapshot may be partial during a normal backup; partiality alone is not a capacity failure. A critical VM with no recent size sample, a stale cloud snapshot, malformed history, or insufficient capacity still fails closed.","diff --git a/changes/CR-2026-0072/source-provenance.tsv b/changes/CR-2026-0072/source-provenance.tsv","--- a/changes/CR-2026-0072/source-provenance.tsv","+++ b/changes/CR-2026-0072/source-provenance.tsv","@@ -4,3 +4,6 @@ old_retention_sha256\t5698c4b03cde557ed103f7f9c51bec17a4ff969ab96a1cb89a7be4ce8e8","diff --git a/changes/CR-2026-0072/tests.md b/changes/CR-2026-0072/tests.md","--- a/changes/CR-2026-0072/tests.md","+++ b/changes/CR-2026-0072/tests.md","@@ -1,3 +1,5 @@","diff --git a/errors/regression-cases.json b/errors/regression-cases.json","--- a/errors/regression-cases.json","+++ b/errors/regression-cases.json","@@ -576,6 +576,13 @@","       \"root_cause\": \"The mutable apply path waited for backup locks before evaluating a read-only capacity prerequisite.\",","       \"source\": \"CR0072 CMD-907 long lock wait\",","       \"symptom\": \"An operator can wait through a long backup window only for apply to fail immediately afterward on a condition that was knowable before waiting.\"","     }","diff --git a/tasks/backup-gfs-retention-v1/assets/approved-diffs/homelab-backup-retention-gc.diff b/tasks/backup-gfs-retention-v1/assets/approved-diffs/homelab-backup-retention-gc.diff","--- a/tasks/backup-gfs-retention-v1/assets/approved-diffs/homelab-backup-retention-gc.diff","+++ b/tasks/backup-gfs-retention-v1/assets/approved-diffs/homelab-backup-retention-gc.diff","@@ -1,8 +1,8 @@","-+++ /mnt/data/cr0072_pkg/cr0072-source-900-v1/payload/tasks/backup-gfs-retention-v1/assets/homelab-backup-retention-gc\t2026-08-14 10:43:44.424824102 +0000"," +GFS_HELPER=\"${HOMELAB_BACKUP_GFS_POLICY_HELPER:-/usr/local/libexec/homelab-backup-gfs-policy}\""," +GFS_POLICY=\"${HOMELAB_BACKUP_GFS_POLICY:-/etc/homelab-backup/gfs-retention.json}\"","diff --git a/tasks/backup-gfs-retention-v1/assets/homelab-backup-retention-gc b/tasks/backup-gfs-retention-v1/assets/homelab-backup-retention-gc","--- a/tasks/backup-gfs-retention-v1/assets/homelab-backup-retention-gc","+++ b/tasks/backup-gfs-retention-v1/assets/homelab-backup-retention-gc","@@ -21,7 +21,7 @@ APP_PROBE=/usr/local/libexec/homelab-app-cloud-quorum-freshness-probe"," GFS_HELPER=\"${HOMELAB_BACKUP_GFS_POLICY_HELPER:-/usr/local/libexec/homelab-backup-gfs-policy}\""," GFS_POLICY=\"${HOMELAB_BACKUP_GFS_POLICY:-/etc/homelab-backup/gfs-retention.json}\"","diff --git a/tasks/backup-gfs-retention-v1/task.json b/tasks/backup-gfs-retention-v1/task.json","--- a/tasks/backup-gfs-retention-v1/task.json","+++ b/tasks/backup-gfs-retention-v1/task.json","@@ -115,6 +115,7 @@","     \"capacity_guard_cloud_max_age_seconds\": 14400,","     \"capacity_guard_max_free_fraction_milli\": 500,","     \"capacity_guard_target_max_age_seconds\": 172800,","     \"change_id\": \"CR-2026-0072\",","     \"cloud_deletes\": false,","     \"cloud_writes\": false,","@@ -126,7 +127,7 @@","     \"gfs_policy_sha256\": \"ea6526bec7d7591bef876799cecddff4849631a936edc9f593b47211fbad715c\",","     \"monthly_completed_buckets\": 6,","     \"new_delete_candidates\": false,","     \"old_retention_sha256\": \"5698c4b03cde557ed103f7f9c51bec17a4ff969ab96a1cb89a7be4ce8e810437\",","     \"retention_scheduled\": false,","     \"systemd_changed\": false,","diff --git a/tasks/backup-gfs-retention-v1/tools/runtime-lib.sh b/tasks/backup-gfs-retention-v1/tools/runtime-lib.sh","--- a/tasks/backup-gfs-retention-v1/tools/runtime-lib.sh","+++ b/tasks/backup-gfs-retention-v1/tools/runtime-lib.sh","@@ -23,7 +23,7 @@ CR0070_SHA=b843b84c66c739ec42e8454b8a996eb827364fb6c938a8ce86e4e5ac7c16c0b8","diff --git a/tasks/backup-gfs-retention-v1/tools/test_contract.py b/tasks/backup-gfs-retention-v1/tools/test_contract.py","--- a/tasks/backup-gfs-retention-v1/tools/test_contract.py","+++ b/tasks/backup-gfs-retention-v1/tools/test_contract.py","@@ -1,27 +1,36 @@","-T=Path(sys.argv[1]); task=json.loads((T/'task.json').read_text()); rt=(T/'assets/homelab-backup-retention-gc').read_text(); lib=(T/'tools/runtime-lib.sh').read_text(); ap=(T/'phases/apply.sh').read_text(); pol=json.loads((T/'assets/gfs-retention.json').read_text())"," assert task['task_id']=='backup-gfs-retention-v1' and task['source_of_truth']['change_id']=='CR-2026-0072'","-assert pol['critical_vm_logicals']==['vm110','vm111','vm112','vm113','vm130','vm150','vm160','vm170','vm200']","+pol=json.loads((T/'assets/gfs-retention.json').read_text())"," assert pol['weekly_buckets']==4 and pol['monthly_buckets']==6 and pol['completed_periods_only'] is True","+assert len(pol['critical_vm_logicals'])==9 and pol['capacity_guard_max_free_fraction_milli']==500","-for x in ['pinned_assert_delete_scope','resume_transactions','REMOTE_LIST_FAILED_','PLAN_CHANGED_AFTER_LOCK','RETIRED_PRESERVE','stable_delete_set']:","+assert 'REMOTE_SET_MISMATCH' in ret and 'LOCKED_PRE_RESUME' in ret and 'LOCKED_POST_RESUME' in ret and 'RETIRED_PRESERVE' in ret","+helper_sha=sha(T/'assets/homelab-backup-gfs-policy')","+policy_sha=sha(T/'assets/gfs-retention.json')","diff --git a/tests/test_cr_2026_0072_gfs_retention.py b/tests/test_cr_2026_0072_gfs_retention.py","--- a/tests/test_cr_2026_0072_gfs_retention.py","+++ b/tests/test_cr_2026_0072_gfs_retention.py","@@ -37,6 +37,16 @@ class Tst(unittest.TestCase):","+  hs=sha(T/'assets/homelab-backup-gfs-policy'); ps=sha(T/'assets/gfs-retention.json'); cs=sha(T/'tools/capacity_guard.py'); rs=sha(T/'assets/homelab-backup-retention-gc')","-  ids={z['id'] for z in json.loads((ROOT/'errors/regression-cases.json').read_text())['cases']}; self.assertTrue({'REG-088-GFS-COMPLETED-PERIODS-ONLY','REG-089-GFS-DELETE-SET-MONOTONIC','REG-090-GFS-CAPACITY-GUARD','REG-091-GFS-RETENTION-HARDENING-PRESERVED','REG-092-GFS-PARTIAL-OBSERVABILITY-SNAPSHOT','REG-093-GFS-CAPACITY-FAILFAST-BEFORE-LOCK-WAIT'} <= ids)","+  ids={z['id'] for z in json.loads((ROOT/'errors/regression-cases.json').read_text())['cases']}; self.assertTrue({'REG-088-GFS-COMPLETED-PERIODS-ONLY','REG-089-GFS-DELETE-SET-MONOTONIC','REG-090-GFS-CAPACITY-GUARD','REG-091-GFS-RETENTION-HARDENING-PRESERVED','REG-092-GFS-PARTIAL-OBSERVABILITY-SNAPSHOT','REG-093-GFS-CAPACITY-FAILFAST-BEFORE-LOCK-WAIT','REG-094-GFS-HASH-DEPENDENCY-CLOSURE'} <= ids)"]
CLUSTER_FOCUS_INVENTORY=[{"name":"core-apps","node":"pve01","status":"running","template":0,"type":"qemu","vmid":170},{"name":"monitoring","node":"pve01","status":"running","template":0,"type":"qemu","vmid":171},{"name":"homelab-ops-worker","node":"pve03","status":"running","template":0,"type":"qemu","vmid":190},{"name":"edge-cold-standby","node":"pve02","status":"stopped","template":0,"type":"qemu","vmid":9130}]
NO_MUTATION=true
NO_GIT_FETCH=true
NO_RESET=true
NO_CHECKOUT=true
NO_SERVICE_ACTION=true
NO_BACKUP_STARTED=true
NO_RESTORE_STARTED=true
NO_RETENTION_RUN_STARTED=true
NO_DELETE=true
NO_MAIL_SENT=true
PROVENANCE_DURATION_SEC=1.282
TASK_RESULT=PASS_HOMELAB_BACKUP_GFS_POLICY_PROVENANCE_READONLY
HOMELAB_RESULT_CONTRACT={"changes_made":false,"command_id":"SUPPORT-260921-HOMELAB-BACKUP-GFS-POLICY-PROVENANCE-READONLY-1014R1","rollback_restored":null,"rollback_started":false,"status":"OK","version":1}
WORKERS2_BACKUP_GFS_POLICY_PROVENANCE_END=1

OUTPUT_END
CHAT_OUTPUT_END
