fix: list Bedrock and Bedrock Runtime operations in the AWS operation coverage inventory

Bedrock and Bedrock Runtime dispatch through REST route tables, so the gateway inventory never named them and the coverage report left both services out. Embed their pinned Smithy models, derive their operations from the route tables, and publish a coverage page for each. The request generator kept the constraint sites of a map key whose value could not be generated, so a rejection case targeted a map that was not in the request. Bedrock's document-valued maps are the first to hit it.
2026-11-03 01:33:37 +00:00 · 2026-11-02 14:37:28 +10:00
4008 changed files with 126814 additions and 299162 deletions
@@ -1,3 +0,0 @@
-# The committed bundle carries the AWS SDK's template strings verbatim,
-# including trailing spaces that are part of their values.
-spinifex/runtime/roles/spinifexui/frontend/dist/** -whitespace
@@ -19,8 +19,8 @@
  </defs>
  <rect width="900" height="480" fill="url(#bg)" rx="12"/>

-  <text x="24" y="30" font-family="'Segoe UI', system-ui, sans-serif" font-size="11" fill="#a1a1aa" letter-spacing="2.5" font-weight="600">NGINX + ALB · PUBLIC SUBNETS · SPREAD ACROSS NODES</text>
-  <text x="876" y="30" font-family="'SF Mono', ui-monospace, monospace" font-size="10" fill="#71717a" text-anchor="end">10.20.0.0/16 · server_count = 3</text>
+  <text x="24" y="30" font-family="'Segoe UI', system-ui, sans-serif" font-size="11" fill="#a1a1aa" letter-spacing="2.5" font-weight="600">NGINX + ALB · VPC WITH PUBLIC AND PRIVATE SUBNETS</text>
+  <text x="876" y="30" font-family="'SF Mono', ui-monospace, monospace" font-size="10" fill="#71717a" text-anchor="end">10.20.0.0/16 · multi-AZ</text>

  <!-- Internet -->
  <rect x="350" y="54" width="200" height="40" rx="8" fill="url(#inet-grad)" stroke="#3fb950" stroke-width="1.1" stroke-opacity="0.55"/>
@@ -41,45 +41,58 @@
  <line x1="230" y1="184" x2="230" y2="202" stroke="#DC2626" stroke-width="1" stroke-dasharray="3,3" opacity="0.6"/>
  <line x1="670" y1="184" x2="670" y2="202" stroke="#DC2626" stroke-width="1" stroke-dasharray="3,3" opacity="0.6"/>

+  <!-- public_a -->
  <g transform="translate(108, 202)">
-    <rect width="244" height="150" rx="8" fill="url(#pub-grad)" stroke="#3fb950" stroke-width="1.2" stroke-opacity="0.55"/>
+    <rect width="244" height="104" rx="8" fill="url(#pub-grad)" stroke="#3fb950" stroke-width="1.2" stroke-opacity="0.55"/>
    <text x="20" y="24" font-family="'SF Mono', ui-monospace, monospace" font-size="12" fill="#3fb950" font-weight="700">public_a</text>
-    <text x="224" y="24" font-family="'Segoe UI', sans-serif" font-size="9.5" fill="#7ee787" text-anchor="end">10.20.1.0/24</text>
+    <text x="224" y="24" font-family="'Segoe UI', sans-serif" font-size="9.5" fill="#7ee787" text-anchor="end">az-a</text>
    <line x1="16" y1="32" x2="228" y2="32" stroke="#3fb950" stroke-opacity="0.3" stroke-width="0.5"/>
-    <rect x="22" y="42" width="200" height="22" rx="4" fill="#3fb9501a" stroke="#3fb950" stroke-opacity="0.5" stroke-width="0.6"/>
-    <text x="122" y="57" font-family="'SF Mono', ui-monospace, monospace" font-size="10.5" fill="#7ee787" text-anchor="middle" font-weight="600">ALB ENI</text>
-    <rect x="22" y="70" width="200" height="36" rx="4" fill="#3fb9501a" stroke="#3fb950" stroke-opacity="0.5" stroke-width="0.6"/>
-    <text x="122" y="86" font-family="'SF Mono', ui-monospace, monospace" font-size="10.5" fill="#7ee787" text-anchor="middle" font-weight="600">nginx-alb-1</text>
-    <text x="122" y="100" font-family="'Segoe UI', sans-serif" font-size="9.5" fill="#a1a1aa" text-anchor="middle">public IP · Ubuntu · cloud-init</text>
-    <rect x="22" y="110" width="200" height="36" rx="4" fill="#3fb9501a" stroke="#3fb950" stroke-opacity="0.5" stroke-width="0.6"/>
-    <text x="122" y="126" font-family="'SF Mono', ui-monospace, monospace" font-size="10.5" fill="#7ee787" text-anchor="middle" font-weight="600">nginx-alb-3</text>
-    <text x="122" y="140" font-family="'Segoe UI', sans-serif" font-size="9.5" fill="#a1a1aa" text-anchor="middle">public IP · Ubuntu · cloud-init</text>
+
+    <rect x="20" y="42" width="200" height="22" rx="4" fill="#3fb9501a" stroke="#3fb950" stroke-opacity="0.5" stroke-width="0.6"/>
+    <text x="120" y="57" font-family="'SF Mono', ui-monospace, monospace" font-size="10.5" fill="#7ee787" text-anchor="middle" font-weight="600">ALB ENI</text>
+
+    <rect x="20" y="70" width="200" height="22" rx="4" fill="#3fb9501a" stroke="#3fb950" stroke-opacity="0.5" stroke-width="0.6"/>
+    <text x="120" y="85" font-family="'SF Mono', ui-monospace, monospace" font-size="10.5" fill="#7ee787" text-anchor="middle" font-weight="600">NAT GW</text>
  </g>

+  <!-- public_b -->
  <g transform="translate(548, 202)">
-    <rect width="244" height="150" rx="8" fill="url(#pub-grad)" stroke="#3fb950" stroke-width="1.2" stroke-opacity="0.55"/>
+    <rect width="244" height="104" rx="8" fill="url(#pub-grad)" stroke="#3fb950" stroke-width="1.2" stroke-opacity="0.55"/>
    <text x="20" y="24" font-family="'SF Mono', ui-monospace, monospace" font-size="12" fill="#3fb950" font-weight="700">public_b</text>
-    <text x="224" y="24" font-family="'Segoe UI', sans-serif" font-size="9.5" fill="#7ee787" text-anchor="end">10.20.2.0/24</text>
+    <text x="224" y="24" font-family="'Segoe UI', sans-serif" font-size="9.5" fill="#7ee787" text-anchor="end">az-b</text>
    <line x1="16" y1="32" x2="228" y2="32" stroke="#3fb950" stroke-opacity="0.3" stroke-width="0.5"/>
-    <rect x="22" y="42" width="200" height="22" rx="4" fill="#3fb9501a" stroke="#3fb950" stroke-opacity="0.5" stroke-width="0.6"/>
-    <text x="122" y="57" font-family="'SF Mono', ui-monospace, monospace" font-size="10.5" fill="#7ee787" text-anchor="middle" font-weight="600">ALB ENI</text>
-    <rect x="22" y="70" width="200" height="36" rx="4" fill="#3fb9501a" stroke="#3fb950" stroke-opacity="0.5" stroke-width="0.6"/>
-    <text x="122" y="86" font-family="'SF Mono', ui-monospace, monospace" font-size="10.5" fill="#7ee787" text-anchor="middle" font-weight="600">nginx-alb-2</text>
-    <text x="122" y="100" font-family="'Segoe UI', sans-serif" font-size="9.5" fill="#a1a1aa" text-anchor="middle">public IP · Ubuntu · cloud-init</text>
+
+    <rect x="20" y="56" width="200" height="22" rx="4" fill="#3fb9501a" stroke="#3fb950" stroke-opacity="0.5" stroke-width="0.6"/>
+    <text x="120" y="71" font-family="'SF Mono', ui-monospace, monospace" font-size="10.5" fill="#7ee787" text-anchor="middle" font-weight="600">ALB ENI</text>
  </g>

-  <!-- spread placement group -->
-  <rect x="108" y="372" width="684" height="88" rx="8" fill="url(#priv-grad)" stroke="#a855f7" stroke-width="1.2" stroke-opacity="0.55"/>
-  <text x="128" y="394" font-family="'SF Mono', ui-monospace, monospace" font-size="12" fill="#c084fc" font-weight="700">nginx-alb-spread</text>
-  <text x="772" y="394" font-family="'Segoe UI', sans-serif" font-size="9.5" fill="#d8b4fe" text-anchor="end">placement group · strategy spread · one server per node</text>
-  <line x1="124" y1="402" x2="776" y2="402" stroke="#a855f7" stroke-opacity="0.3" stroke-width="0.5"/>
-  <rect x="128" y="412" width="204" height="36" rx="5" fill="#a855f71a" stroke="#a855f7" stroke-opacity="0.5" stroke-width="0.6"/>
-  <text x="230" y="428" font-family="'SF Mono', ui-monospace, monospace" font-size="11" fill="#d8b4fe" text-anchor="middle" font-weight="700">node1</text>
-  <text x="230" y="442" font-family="'Segoe UI', sans-serif" font-size="9.5" fill="#a1a1aa" text-anchor="middle">one web server</text>
-  <rect x="348" y="412" width="204" height="36" rx="5" fill="#a855f71a" stroke="#a855f7" stroke-opacity="0.5" stroke-width="0.6"/>
-  <text x="450" y="428" font-family="'SF Mono', ui-monospace, monospace" font-size="11" fill="#d8b4fe" text-anchor="middle" font-weight="700">node2</text>
-  <text x="450" y="442" font-family="'Segoe UI', sans-serif" font-size="9.5" fill="#a1a1aa" text-anchor="middle">one web server</text>
-  <rect x="568" y="412" width="204" height="36" rx="5" fill="#a855f71a" stroke="#a855f7" stroke-opacity="0.5" stroke-width="0.6"/>
-  <text x="670" y="428" font-family="'SF Mono', ui-monospace, monospace" font-size="11" fill="#d8b4fe" text-anchor="middle" font-weight="700">node3</text>
-  <text x="670" y="442" font-family="'Segoe UI', sans-serif" font-size="9.5" fill="#a1a1aa" text-anchor="middle">one web server</text>
+  <!-- SNAT arrow from public_a NAT → private row -->
+  <line x1="230" y1="306" x2="230" y2="340" stroke="#F87171" stroke-width="1.2" stroke-dasharray="3,3" opacity="0.65"/>
+  <polygon points="226,336 234,336 230,344" fill="#F87171" opacity="0.8"/>
+  <rect x="256" y="314" width="240" height="20" rx="10" fill="#0a0a0a" stroke="#F87171" stroke-width="0.6" stroke-opacity="0.55"/>
+  <text x="376" y="328" font-family="'SF Mono', ui-monospace, monospace" font-size="10" fill="#FCA5A5" text-anchor="middle">SNAT for private subnets (egress)</text>
+
+  <!-- private_a -->
+  <g transform="translate(108, 350)">
+    <rect width="244" height="104" rx="8" fill="url(#priv-grad)" stroke="#a855f7" stroke-width="1.2" stroke-opacity="0.55"/>
+    <text x="20" y="24" font-family="'SF Mono', ui-monospace, monospace" font-size="12" fill="#c084fc" font-weight="700">private_a</text>
+    <text x="224" y="24" font-family="'Segoe UI', sans-serif" font-size="9.5" fill="#d8b4fe" text-anchor="end">az-a</text>
+    <line x1="16" y1="32" x2="228" y2="32" stroke="#a855f7" stroke-opacity="0.3" stroke-width="0.5"/>
+
+    <rect x="20" y="44" width="200" height="48" rx="5" fill="#a855f71a" stroke="#a855f7" stroke-opacity="0.5" stroke-width="0.6"/>
+    <text x="120" y="64" font-family="'SF Mono', ui-monospace, monospace" font-size="11" fill="#d8b4fe" text-anchor="middle" font-weight="700">nginx_1</text>
+    <text x="120" y="80" font-family="'Segoe UI', sans-serif" font-size="9.5" fill="#a1a1aa" text-anchor="middle">Debian 12 · cloud-init</text>
+  </g>
+
+  <!-- private_b -->
+  <g transform="translate(548, 350)">
+    <rect width="244" height="104" rx="8" fill="url(#priv-grad)" stroke="#a855f7" stroke-width="1.2" stroke-opacity="0.55"/>
+    <text x="20" y="24" font-family="'SF Mono', ui-monospace, monospace" font-size="12" fill="#c084fc" font-weight="700">private_b</text>
+    <text x="224" y="24" font-family="'Segoe UI', sans-serif" font-size="9.5" fill="#d8b4fe" text-anchor="end">az-b</text>
+    <line x1="16" y1="32" x2="228" y2="32" stroke="#a855f7" stroke-opacity="0.3" stroke-width="0.5"/>
+
+    <rect x="20" y="44" width="200" height="48" rx="5" fill="#a855f71a" stroke="#a855f7" stroke-opacity="0.5" stroke-width="0.6"/>
+    <text x="120" y="64" font-family="'SF Mono', ui-monospace, monospace" font-size="11" fill="#d8b4fe" text-anchor="middle" font-weight="700">nginx_2</text>
+    <text x="120" y="80" font-family="'Segoe UI', sans-serif" font-size="9.5" fill="#a1a1aa" text-anchor="middle">Debian 12 · cloud-init</text>
+  </g>
 </svg>
@@ -1,110 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="900" height="580" viewBox="0 0 900 580">
-  <defs>
-    <linearGradient id="bg" x1="0%" y1="0%" x2="100%" y2="100%">
-      <stop offset="0%" style="stop-color:#0a0a0a"/>
-      <stop offset="100%" style="stop-color:#0d1117"/>
-    </linearGradient>
-    <linearGradient id="vpc-grad" x1="0%" y1="0%" x2="0%" y2="100%">
-      <stop offset="0%" style="stop-color:#58a6ff14"/>
-      <stop offset="100%" style="stop-color:#58a6ff05"/>
-    </linearGradient>
-    <linearGradient id="node-grad" x1="0%" y1="0%" x2="0%" y2="100%">
-      <stop offset="0%" style="stop-color:#3fb9501f"/>
-      <stop offset="100%" style="stop-color:#3fb95008"/>
-    </linearGradient>
-    <linearGradient id="svc-grad" x1="0%" y1="0%" x2="0%" y2="100%">
-      <stop offset="0%" style="stop-color:#a855f71f"/>
-      <stop offset="100%" style="stop-color:#a855f708"/>
-    </linearGradient>
-    <marker id="arrow" viewBox="0 0 10 10" refX="8" refY="5" markerWidth="7" markerHeight="7" orient="auto-start-reverse">
-      <path d="M0,0 L10,5 L0,10 z" fill="#71717a"/>
-    </marker>
-  </defs>
-  <rect width="900" height="580" fill="url(#bg)" rx="12"/>
-  <text x="24" y="30" font-family="'Segoe UI', system-ui, sans-serif" font-size="11" fill="#a1a1aa" letter-spacing="2.5" font-weight="600">SPINIFEX ON VULTR · ONE NODE OR THREE</text>
-  <text x="876" y="30" font-family="'SF Mono', ui-monospace, monospace" font-size="10" fill="#71717a" text-anchor="end">--nodes 1 or 3 · vx1-g-16c-64g or bare metal</text>
-  <rect x="30" y="52" width="250" height="56" rx="8" fill="#e4e4e70d" stroke="#e4e4e7" stroke-width="1.1" stroke-opacity="0.6"/>
-  <text x="155.0" y="76" font-family="'SF Mono', ui-monospace, monospace" font-size="12.5" fill="#e4e4e7" text-anchor="middle" font-weight="700">Your machine</text>
-  <text x="155.0" y="94" font-family="'Segoe UI', system-ui, sans-serif" font-size="10" fill="#a1a1aa" text-anchor="middle">deploy-vultr.sh · OpenTofu or Terraform</text>
-  <rect x="325" y="52" width="250" height="56" rx="8" fill="#3fb9500d" stroke="#3fb950" stroke-width="1.1" stroke-opacity="0.6"/>
-  <text x="450.0" y="76" font-family="'SF Mono', ui-monospace, monospace" font-size="12.5" fill="#3fb950" text-anchor="middle" font-weight="700">Internet</text>
-  <text x="450.0" y="94" font-family="'Segoe UI', system-ui, sans-serif" font-size="10" fill="#7ee787" text-anchor="middle">customers reach your EC2 and load balancers</text>
-  <rect x="620" y="52" width="250" height="56" rx="8" fill="#58a6ff12" stroke="#58a6ff" stroke-width="1.1" stroke-opacity="0.6"/>
-  <text x="745.0" y="76" font-family="'SF Mono', ui-monospace, monospace" font-size="12.5" fill="#79c0ff" text-anchor="middle" font-weight="700">Vultr API</text>
-  <text x="745.0" y="94" font-family="'Segoe UI', system-ui, sans-serif" font-size="10" fill="#a5d6ff" text-anchor="middle">VPC · servers · reserved IPs</text>
-  <rect x="30" y="160" width="840" height="400" rx="10" fill="url(#vpc-grad)" stroke="#58a6ff" stroke-width="1.2" stroke-opacity="0.55" stroke-dasharray="6,4"/>
-  <text x="50" y="184" font-family="'SF Mono', ui-monospace, monospace" font-size="12" fill="#79c0ff" font-weight="700">Vultr VPC</text>
-  <text x="850" y="184" font-family="'SF Mono', ui-monospace, monospace" font-size="10" fill="#58a6ff" text-anchor="end">private network 10.10.8.0/24</text>
-  <line x1="155" y1="108" x2="155" y2="158" stroke="#71717a" stroke-width="1.2" opacity="0.8" marker-end="url(#arrow)"/>
-  <text x="165" y="138" font-family="'Segoe UI', system-ui, sans-serif" font-size="10" fill="#a1a1aa" text-anchor="start">Terraform builds · SSH installs</text>
-  <line x1="450" y1="108" x2="450" y2="158" stroke="#71717a" stroke-width="1.2" opacity="0.8" marker-end="url(#arrow)"/>
-  <text x="460" y="138" font-family="'Segoe UI', system-ui, sans-serif" font-size="10" fill="#a1a1aa" text-anchor="start">reserved IPs</text>
-  <line x1="745" y1="158" x2="745" y2="110" stroke="#71717a" stroke-width="1.2" opacity="0.8" marker-end="url(#arrow)"/>
-  <text x="735" y="138" font-family="'Segoe UI', system-ui, sans-serif" font-size="10" fill="#a1a1aa" text-anchor="end">Spinifex calls the API</text>
-  <rect x="60" y="205" width="250" height="118" rx="8" fill="url(#node-grad)" stroke="#3fb950" stroke-width="1.2" stroke-opacity="0.6"/>
-  <text x="78" y="229" font-family="'SF Mono', ui-monospace, monospace" font-size="12.5" fill="#3fb950" font-weight="700">node1</text>
-  <text x="292" y="229" font-family="'Segoe UI', system-ui, sans-serif" font-size="9.5" fill="#7ee787" text-anchor="end">Ubuntu 24.04 · Spinifex</text>
-  <line x1="74" y1="237" x2="296" y2="237" stroke="#3fb950" stroke-opacity="0.3" stroke-width="0.6"/>
-  <rect x="76" y="250" width="74" height="24" rx="5" fill="#3fb9501a" stroke="#3fb950" stroke-opacity="0.5" stroke-width="0.6"/>
-  <text x="113.0" y="266" font-family="'SF Mono', ui-monospace, monospace" font-size="10.5" fill="#7ee787" text-anchor="middle">AWS API</text>
-  <rect x="160" y="250" width="60" height="24" rx="5" fill="#3fb9501a" stroke="#3fb950" stroke-opacity="0.5" stroke-width="0.6"/>
-  <text x="190.0" y="266" font-family="'SF Mono', ui-monospace, monospace" font-size="10.5" fill="#7ee787" text-anchor="middle">EBS</text>
-  <rect x="230" y="250" width="60" height="24" rx="5" fill="#3fb9501a" stroke="#3fb950" stroke-opacity="0.5" stroke-width="0.6"/>
-  <text x="260.0" y="266" font-family="'SF Mono', ui-monospace, monospace" font-size="10.5" fill="#7ee787" text-anchor="middle">S3</text>
-  <text x="185" y="300" font-family="'Segoe UI', system-ui, sans-serif" font-size="9.5" fill="#a1a1aa" text-anchor="middle">VPC networking · your instances</text>
-  <rect x="325" y="205" width="250" height="118" rx="8" fill="url(#node-grad)" stroke="#3fb950" stroke-width="1.2" stroke-opacity="0.6" stroke-dasharray="5,3"/>
-  <text x="343" y="229" font-family="'SF Mono', ui-monospace, monospace" font-size="12.5" fill="#3fb950" font-weight="700">node2</text>
-  <text x="557" y="229" font-family="'Segoe UI', system-ui, sans-serif" font-size="9.5" fill="#7ee787" text-anchor="end">with --nodes 3</text>
-  <line x1="339" y1="237" x2="561" y2="237" stroke="#3fb950" stroke-opacity="0.3" stroke-width="0.6"/>
-  <rect x="341" y="250" width="74" height="24" rx="5" fill="#3fb9501a" stroke="#3fb950" stroke-opacity="0.5" stroke-width="0.6"/>
-  <text x="378.0" y="266" font-family="'SF Mono', ui-monospace, monospace" font-size="10.5" fill="#7ee787" text-anchor="middle">AWS API</text>
-  <rect x="425" y="250" width="60" height="24" rx="5" fill="#3fb9501a" stroke="#3fb950" stroke-opacity="0.5" stroke-width="0.6"/>
-  <text x="455.0" y="266" font-family="'SF Mono', ui-monospace, monospace" font-size="10.5" fill="#7ee787" text-anchor="middle">EBS</text>
-  <rect x="495" y="250" width="60" height="24" rx="5" fill="#3fb9501a" stroke="#3fb950" stroke-opacity="0.5" stroke-width="0.6"/>
-  <text x="525.0" y="266" font-family="'SF Mono', ui-monospace, monospace" font-size="10.5" fill="#7ee787" text-anchor="middle">S3</text>
-  <text x="450" y="300" font-family="'Segoe UI', system-ui, sans-serif" font-size="9.5" fill="#a1a1aa" text-anchor="middle">VPC networking · your instances</text>
-  <rect x="590" y="205" width="250" height="118" rx="8" fill="url(#node-grad)" stroke="#3fb950" stroke-width="1.2" stroke-opacity="0.6" stroke-dasharray="5,3"/>
-  <text x="608" y="229" font-family="'SF Mono', ui-monospace, monospace" font-size="12.5" fill="#3fb950" font-weight="700">node3</text>
-  <text x="822" y="229" font-family="'Segoe UI', system-ui, sans-serif" font-size="9.5" fill="#7ee787" text-anchor="end">with --nodes 3</text>
-  <line x1="604" y1="237" x2="826" y2="237" stroke="#3fb950" stroke-opacity="0.3" stroke-width="0.6"/>
-  <rect x="606" y="250" width="74" height="24" rx="5" fill="#3fb9501a" stroke="#3fb950" stroke-opacity="0.5" stroke-width="0.6"/>
-  <text x="643.0" y="266" font-family="'SF Mono', ui-monospace, monospace" font-size="10.5" fill="#7ee787" text-anchor="middle">AWS API</text>
-  <rect x="690" y="250" width="60" height="24" rx="5" fill="#3fb9501a" stroke="#3fb950" stroke-opacity="0.5" stroke-width="0.6"/>
-  <text x="720.0" y="266" font-family="'SF Mono', ui-monospace, monospace" font-size="10.5" fill="#7ee787" text-anchor="middle">EBS</text>
-  <rect x="760" y="250" width="60" height="24" rx="5" fill="#3fb9501a" stroke="#3fb950" stroke-opacity="0.5" stroke-width="0.6"/>
-  <text x="790.0" y="266" font-family="'SF Mono', ui-monospace, monospace" font-size="10.5" fill="#7ee787" text-anchor="middle">S3</text>
-  <text x="715" y="300" font-family="'Segoe UI', system-ui, sans-serif" font-size="9.5" fill="#a1a1aa" text-anchor="middle">VPC networking · your instances</text>
-  <line x1="310" y1="264" x2="325" y2="264" stroke="#58a6ff" stroke-width="1.6" stroke-dasharray="3,3" opacity="0.9"/>
-  <line x1="575" y1="264" x2="590" y2="264" stroke="#58a6ff" stroke-width="1.6" stroke-dasharray="3,3" opacity="0.9"/>
-  <text x="450" y="348" font-family="'Segoe UI', system-ui, sans-serif" font-size="10" fill="#79c0ff" text-anchor="middle">nodes cluster over the private network: control plane, EBS replicas and S3 shards</text>
-  <rect x="60" y="370" width="780" height="166" rx="8" fill="url(#svc-grad)" stroke="#a855f7" stroke-width="1.2" stroke-opacity="0.55"/>
-  <text x="80" y="394" font-family="'SF Mono', ui-monospace, monospace" font-size="12" fill="#c084fc" font-weight="700">AWS services across the fleet</text>
-  <text x="820" y="394" font-family="'Segoe UI', system-ui, sans-serif" font-size="9.5" fill="#d8b4fe" text-anchor="end">spread across the nodes; with three, moved to a survivor if one fails</text>
-  <line x1="76" y1="402" x2="824" y2="402" stroke="#a855f7" stroke-opacity="0.3" stroke-width="0.6"/>
-  <rect x="76" y="418" width="86" height="52" rx="6" fill="#a855f71a" stroke="#a855f7" stroke-opacity="0.5" stroke-width="0.6"/>
-  <text x="119.0" y="440" font-family="'SF Mono', ui-monospace, monospace" font-size="11.5" fill="#d8b4fe" text-anchor="middle" font-weight="700">EC2</text>
-  <text x="119.0" y="457" font-family="'Segoe UI', system-ui, sans-serif" font-size="9" fill="#a1a1aa" text-anchor="middle">instances</text>
-  <rect x="169" y="418" width="86" height="52" rx="6" fill="#a855f71a" stroke="#a855f7" stroke-opacity="0.5" stroke-width="0.6"/>
-  <text x="212.0" y="440" font-family="'SF Mono', ui-monospace, monospace" font-size="11.5" fill="#d8b4fe" text-anchor="middle" font-weight="700">ALB / NLB</text>
-  <text x="212.0" y="457" font-family="'Segoe UI', system-ui, sans-serif" font-size="9" fill="#a1a1aa" text-anchor="middle">load balancers</text>
-  <rect x="262" y="418" width="86" height="52" rx="6" fill="#a855f71a" stroke="#a855f7" stroke-opacity="0.5" stroke-width="0.6"/>
-  <text x="305.0" y="440" font-family="'SF Mono', ui-monospace, monospace" font-size="11.5" fill="#d8b4fe" text-anchor="middle" font-weight="700">EKS</text>
-  <text x="305.0" y="457" font-family="'Segoe UI', system-ui, sans-serif" font-size="9" fill="#a1a1aa" text-anchor="middle">Kubernetes</text>
-  <rect x="355" y="418" width="86" height="52" rx="6" fill="#a855f71a" stroke="#a855f7" stroke-opacity="0.5" stroke-width="0.6"/>
-  <text x="398.0" y="440" font-family="'SF Mono', ui-monospace, monospace" font-size="11.5" fill="#d8b4fe" text-anchor="middle" font-weight="700">ECS</text>
-  <text x="398.0" y="457" font-family="'Segoe UI', system-ui, sans-serif" font-size="9" fill="#a1a1aa" text-anchor="middle">containers</text>
-  <rect x="448" y="418" width="86" height="52" rx="6" fill="#a855f71a" stroke="#a855f7" stroke-opacity="0.5" stroke-width="0.6"/>
-  <text x="491.0" y="440" font-family="'SF Mono', ui-monospace, monospace" font-size="11.5" fill="#d8b4fe" text-anchor="middle" font-weight="700">RDS</text>
-  <text x="491.0" y="457" font-family="'Segoe UI', system-ui, sans-serif" font-size="9" fill="#a1a1aa" text-anchor="middle">databases</text>
-  <rect x="541" y="418" width="86" height="52" rx="6" fill="#a855f71a" stroke="#a855f7" stroke-opacity="0.5" stroke-width="0.6"/>
-  <text x="584.0" y="440" font-family="'SF Mono', ui-monospace, monospace" font-size="11.5" fill="#d8b4fe" text-anchor="middle" font-weight="700">S3</text>
-  <text x="584.0" y="457" font-family="'Segoe UI', system-ui, sans-serif" font-size="9" fill="#a1a1aa" text-anchor="middle">object storage</text>
-  <rect x="634" y="418" width="86" height="52" rx="6" fill="#a855f71a" stroke="#a855f7" stroke-opacity="0.5" stroke-width="0.6"/>
-  <text x="677.0" y="440" font-family="'SF Mono', ui-monospace, monospace" font-size="11.5" fill="#d8b4fe" text-anchor="middle" font-weight="700">EBS</text>
-  <text x="677.0" y="457" font-family="'Segoe UI', system-ui, sans-serif" font-size="9" fill="#a1a1aa" text-anchor="middle">volumes</text>
-  <rect x="727" y="418" width="86" height="52" rx="6" fill="#a855f71a" stroke="#a855f7" stroke-opacity="0.5" stroke-width="0.6"/>
-  <text x="770.0" y="440" font-family="'SF Mono', ui-monospace, monospace" font-size="11.5" fill="#d8b4fe" text-anchor="middle" font-weight="700">IAM</text>
-  <text x="770.0" y="457" font-family="'Segoe UI', system-ui, sans-serif" font-size="9" fill="#a1a1aa" text-anchor="middle">access</text>
-  <text x="450" y="500" font-family="'Segoe UI', system-ui, sans-serif" font-size="10.5" fill="#a1a1aa" text-anchor="middle">Use the AWS CLI, SDKs and Terraform against your own endpoint, unmodified.</text>
-  <text x="450" y="520" font-family="'Segoe UI', system-ui, sans-serif" font-size="9.5" fill="#71717a" text-anchor="middle">Public addresses are Vultr reserved IPs, attached to the node each resource runs on.</text>
-</svg>
@@ -8,8 +8,7 @@
    "arch": "x86_64",
    "runner": "ci-single",
    "extra": "",
-    "suite": "",
-    "timeout_minutes": 60
+    "suite": ""
  },
  {
    "cell": 2,
@@ -20,8 +19,7 @@
    "arch": "x86_64",
    "runner": "ci-single",
    "extra": "",
-    "suite": "",
-    "timeout_minutes": 60
+    "suite": ""
  },
  {
    "cell": 3,
@@ -32,8 +30,7 @@
    "arch": "x86_64",
    "runner": "ci-single",
    "extra": "",
-    "suite": "",
-    "timeout_minutes": 60
+    "suite": ""
  },
  {
    "cell": 8,
@@ -168,7 +165,7 @@
    "runner": "ci-multi",
    "extra": "",
    "suite": "instancerecovery",
-    "timeout_minutes": 125
+    "timeout_minutes": 105
  },
  {
    "cell": 32,
@@ -193,61 +190,5 @@
    "extra": "",
    "suite": "kvquorum",
    "timeout_minutes": 55
-  },
-  {
-    "cell": 34,
-    "install": "binary",
-    "topo": "single",
-    "net": "dhcp",
-    "host": "oracle-10",
-    "arch": "x86_64",
-    "runner": "ci-single",
-    "extra": "",
-    "suite": "",
-    "timeout_minutes": 60
-  },
-  {
-    "cell": 35,
-    "install": "binary",
-    "topo": "single",
-    "net": "static",
-    "host": "oracle-10",
-    "arch": "x86_64",
-    "runner": "ci-single",
-    "extra": "reboot-single",
-    "suite": ""
-  },
-  {
-    "cell": 36,
-    "install": "binary",
-    "topo": "single",
-    "net": "nat",
-    "host": "oracle-10",
-    "arch": "x86_64",
-    "runner": "ci-single",
-    "extra": "nat-single",
-    "suite": ""
-  },
-  {
-    "cell": 37,
-    "install": "binary",
-    "topo": "real-multi",
-    "net": "dhcp",
-    "host": "oracle-10",
-    "arch": "x86_64",
-    "runner": "ci-multi",
-    "extra": "",
-    "suite": ""
-  },
-  {
-    "cell": 38,
-    "install": "binary",
-    "topo": "real-multi",
-    "net": "nat",
-    "host": "oracle-10",
-    "arch": "x86_64",
-    "runner": "ci-multi",
-    "extra": "nat-multi",
-    "suite": ""
  }
 ]
@@ -16,10 +16,6 @@
 - Evidence added or rechecked:
 - ADR-0008 lifecycle register / ADR-0001 migration-record / bead updates:

-## Mulga design
-
-<!-- One line, so a reviewer knows whether the design records in the private mulga repository need to change. Write either "Updated: <mulga PR or bead id>" or "Not needed: <reason>". This is a reminder, not a gate. -->
-
 ## Community Contribution License

 - [ ] All community contributions in this pull request are licensed to Mulga under the terms of the [Apache License 2.0](https://www.apache.org/licenses/LICENSE-2.0). By creating this pull request I represent that I have the right to license these contributions to Mulga under the Apache License 2.0.
@@ -1,66 +0,0 @@
-#!/usr/bin/env bash
-# Usage: hypervisor-disk-preflight.sh <env.tfvars>
-#
-# Fails fast when a hypervisor named in the tofu env is short of disk, before
-# `tofu apply` tries to define a domain there. libvirt writes each domain's XML
-# under /etc/libvirt/qemu on the root filesystem and its disks into the pool, and
-# a full one fails the apply minutes in as "Domain Creation Failed".
-#
-# Hosts are reached the way the libvirt provider reaches them (ssh <user>@<name>,
-# resolved through ~/.ssh/config). A host that cannot be reached is reported and
-# skipped: tofu's own error for it is clearer than anything said here.
-#
-# Env: HV_SSH_USER (tf-user), HV_MIN_ROOT_FREE_MB (1024), HV_MIN_POOL_FREE_GB (20).
-set -uo pipefail
-
-tfvars="${1:?usage: $0 <env.tfvars>}"
-user="${HV_SSH_USER:-tf-user}"
-min_root_kb=$(( ${HV_MIN_ROOT_FREE_MB:-1024} * 1024 ))
-min_pool_kb=$(( ${HV_MIN_POOL_FREE_GB:-20} * 1024 * 1024 ))
-
-if [ ! -r "$tfvars" ]; then
-  echo "::error::hypervisor disk preflight: cannot read $tfvars" >&2
-  exit 1
-fi
-
-# One node per line in every env file: { name = "...", ..., storage_pool = "..." }.
-pairs=$(grep -v '^[[:space:]]*#' "$tfvars" |
-  sed -nE 's/.*name[[:space:]]*=[[:space:]]*"([^"]+)".*storage_pool[[:space:]]*=[[:space:]]*"([^"]+)".*/\1 \2/p')
-if [ -z "$pairs" ]; then
-  echo "::warning::hypervisor disk preflight: no nodes with a storage_pool in $tfvars; nothing checked"
-  exit 0
-fi
-
-# Prints "<root-avail-kb> <pool-avail-kb> <pool-path>" for the pool named in $1.
-# shellcheck disable=SC2016 # expanded on the hypervisor, not here
-remote='set -u
-root=$(df -Pk /etc/libvirt/qemu | awk "NR==2{print \$4}")
-path=$(virsh -c qemu:///system pool-dumpxml "$1" 2>/dev/null | sed -n "s:.*<path>\(.*\)</path>.*:\1:p" | head -n1)
-pool=-
-[ -n "$path" ] && pool=$(df -Pk "$path" | awk "NR==2{print \$4}")
-echo "$root $pool ${path:--}"'
-
-fail=0
-while read -r host pool; do
-  [ -n "$host" ] || continue
-  if ! out=$(ssh -o BatchMode=yes -o ConnectTimeout=10 "${user}@${host}" bash -s -- "$pool" <<<"$remote" 2>&1); then
-    echo "::warning::hypervisor disk preflight: cannot reach $host ($out); its disk is unchecked"
-    continue
-  fi
-  read -r root_kb pool_kb pool_path <<<"$(tail -n1 <<<"$out")"
-  if ! [[ "$root_kb" =~ ^[0-9]+$ ]]; then
-    echo "::warning::hypervisor disk preflight: unexpected answer from $host: $out"
-    continue
-  fi
-  echo "$host: root fs $((root_kb / 1024)) MiB free; pool $pool ($pool_path) $([[ "$pool_kb" =~ ^[0-9]+$ ]] && echo "$((pool_kb / 1024 / 1024)) GiB free" || echo "not found")"
-  if [ "$root_kb" -lt "$min_root_kb" ]; then
-    echo "::error::hypervisor $host has $((root_kb / 1024)) MiB free on the filesystem holding /etc/libvirt/qemu (need ${HV_MIN_ROOT_FREE_MB:-1024} MiB): libvirt cannot write a domain definition there. Free space on $host before re-running." >&2
-    fail=1
-  fi
-  if [[ "$pool_kb" =~ ^[0-9]+$ ]] && [ "$pool_kb" -lt "$min_pool_kb" ]; then
-    echo "::error::hypervisor $host has $((pool_kb / 1024 / 1024)) GiB free in storage pool $pool at $pool_path (need ${HV_MIN_POOL_FREE_GB:-20} GiB): the node's disk cannot grow. Free space on $host before re-running." >&2
-    fail=1
-  fi
-done <<<"$pairs"
-
-exit "$fail"
@@ -1,87 +0,0 @@
-#!/bin/sh
-# hypervisor-disk-preflight_test.sh — drives hypervisor-disk-preflight.sh against
-# a stub ssh that answers for each hypervisor from a canned file, so every
-# verdict is checked without a real host.
-set -eu
-
-SCRIPT_DIR=$(CDPATH='' cd -- "$(dirname -- "$0")" && pwd)
-PREFLIGHT="$SCRIPT_DIR/hypervisor-disk-preflight.sh"
-TMP=$(mktemp -d)
-trap 'rm -rf "$TMP"' EXIT
-
-fails=0
-pass() { echo "  ok   - $1"; }
-fail() { echo "  FAIL - $1"; fails=$((fails + 1)); }
-
-# The stub answers "<root-kb> <pool-kb> <path>" from $FAKE/<host>, or exits 255
-# when that host has no file, the way ssh does for a host it cannot reach.
-mkdir -p "$TMP/bin" "$TMP/hosts"
-cat > "$TMP/bin/ssh" <<'STUB'
-#!/bin/sh
-for a in "$@"; do case $a in *@*) host=${a#*@} ;; esac; done
-cat >/dev/null
-if [ -f "$FAKE/$host" ]; then cat "$FAKE/$host"; exit 0; fi
-echo "ssh: Could not resolve hostname $host" >&2
-exit 255
-STUB
-chmod +x "$TMP/bin/ssh"
-PATH="$TMP/bin:$PATH"
-FAKE="$TMP/hosts"
-export PATH FAKE
-
-cat > "$TMP/env.tfvars" <<'TFVARS'
-nodes = [
-  { name = "wattle", wan_ip = "192.0.2.1", storage_pool = "drive1-pool", base_image = "/x.qcow2" },
-  # { name = "retired", wan_ip = "192.0.2.9", storage_pool = "drive1-pool", base_image = "/x.qcow2" },
-  { name = "banksia", wan_ip = "192.0.2.2", storage_pool = "nvme1-pool", base_image = "/x.qcow2" },
-]
-TFVARS
-
-GiB=1048576
-plenty="$((50 * GiB)) $((200 * GiB)) /mnt/drive1/pool"
-
-# run <label> <want-rc> <want-text>
-run() {
-    rc=0
-    out=$(bash "$PREFLIGHT" "$TMP/env.tfvars" 2>&1) || rc=$?
-    if [ "$rc" -ne "$2" ]; then
-        fail "$1: exit $rc, want $2"
-        echo "$out" | sed 's/^/        /'
-        return
-    fi
-    case $out in
-        *"$3"*) pass "$1" ;;
-        *) fail "$1: output lacks '$3'"; echo "$out" | sed 's/^/        /' ;;
-    esac
-}
-
-echo "-- hypervisor-disk-preflight.sh"
-
-echo "$plenty" > "$FAKE/wattle"
-echo "$plenty" > "$FAKE/banksia"
-run "every host has room" 0 "banksia: root fs 51200 MiB free"
-
-echo "0 $((200 * GiB)) /mnt/drive1/pool" > "$FAKE/wattle"
-run "a full root filesystem fails fast" 1 "::error::hypervisor wattle has 0 MiB free on the filesystem holding /etc/libvirt/qemu"
-
-echo "$plenty" > "$FAKE/wattle"
-echo "$((50 * GiB)) $((3 * GiB)) /mnt/nvme1/pool" > "$FAKE/banksia"
-run "a nearly full pool fails fast" 1 "::error::hypervisor banksia has 3 GiB free in storage pool nvme1-pool"
-
-echo "$plenty" > "$FAKE/banksia"
-rm -f "$FAKE/wattle"
-run "an unreachable host is reported, not failed" 0 "::warning::hypervisor disk preflight: cannot reach wattle"
-
-echo "$plenty" > "$FAKE/wattle"
-echo "$((50 * GiB)) - -" > "$FAKE/banksia"
-run "a pool libvirt does not know is reported, not failed" 0 "pool nvme1-pool (-) not found"
-
-echo "0 0 /x" > "$FAKE/retired"
-echo "$plenty" > "$FAKE/banksia"
-run "a commented-out node is never checked" 0 "wattle: root fs"
-
-if [ "$fails" -ne 0 ]; then
-    echo "$fails failure(s)"
-    exit 1
-fi
-echo "  hypervisor-disk-preflight ok"
@@ -1,36 +0,0 @@
-#!/usr/bin/env python3
-"""Warn when a PR body has no filled "Mulga design" line. Reads PR_BODY; never fails the job."""
-
-import os
-import re
-
-COMMENT_RE = re.compile(r"<!--.*?-->", re.S)
-SECTION_RE = re.compile(r"^#{1,6}\s*Mulga design\s*$", re.I)
-LINE_RE = re.compile(r"^\s*(Updated|Not needed)\s*:\s*(.*?)\s*$", re.I)
-PLACEHOLDER_RE = re.compile(r"<[^<>]*>")
-
-
-def filled(body):
-    inside = False
-    for line in COMMENT_RE.sub("", body or "").splitlines():
-        if SECTION_RE.match(line):
-            inside = True
-        elif inside and line.lstrip().startswith("#"):
-            return False
-        elif inside:
-            m = LINE_RE.match(line)
-            if m and PLACEHOLDER_RE.sub("", m.group(2)).strip():
-                return True
-    return False
-
-
-def main():
-    if filled(os.environ.get("PR_BODY", "")):
-        print("The Mulga design line is filled in.")
-    else:
-        print('::warning title=Mulga design::Add a line under "## Mulga design": "Updated: <mulga PR or bead id>" or "Not needed: <reason>".')
-    return 0
-
-
-if __name__ == "__main__":
-    raise SystemExit(main())
@@ -28,9 +28,6 @@
 # that runs identically on either, and because a quota left switched on would
 # cap every suite sharing the environment — so it must be proved to restore
 # itself wherever it runs, not only on one node.
-# route53 belongs to both topologies because every node serves every hosted
-# zone from one shared bucket: on one node it proves the zone loads at all, on
-# three that each node's sync reaches the same set.
 # storagefault runs last in both lists and belongs to both topologies, for
 # different reasons. On one node it is RS(1,0), so freezing the only predastore
 # is a total outage and the guest-survival assertion is unambiguous. On three it
@@ -40,7 +37,7 @@
 # received. It is last because it SIGSTOPs a cluster-wide
 # service: anything sharing the environment would see the same outage and report
 # a failure that says nothing about itself.
-E2E_SUITES_SINGLE="single iam cert eks ecs storagegrowth partialblock rds quota route53 storagefault"
+E2E_SUITES_SINGLE="single iam cert eks ecs storagegrowth partialblock rds quota storagefault"

 # Suites runnable against a multi-node environment.
 #
@@ -60,7 +57,7 @@ E2E_SUITES_SINGLE="single iam cert eks ecs storagegrowth partialblock rds quota
 # replicated rather than sitting on one node, so it runs before the pair that
 # take a node away — a cluster whose buckets are already wrong should report
 # that, not report a recovery failing.
-E2E_SUITES_MULTI="multinode lb cert quota route53 kvquorum lbrecovery instancerecovery storagefault"
+E2E_SUITES_MULTI="multinode lb cert quota kvquorum lbrecovery instancerecovery storagefault"

 # grep -xE alternation form, for narrowing a requested set to the eligible one.
 E2E_SUITES_SINGLE_RE="$(printf '%s' "${E2E_SUITES_SINGLE}" | tr ' ' '|')"
@@ -117,9 +114,8 @@ e2e_suite_timeout() {
    # storage case waits for a pause measured at 4m47s and then holds four
    # minutes to prove nothing moved. Three tests, each taking a node away and
    # bringing it back, and the partition case adds a lease validity, a lease
-    # TTL and a boot on top of everything the other two wait for. The data
-    # test lets its guest age past the pending watchdog twice, about 20 more.
-    instancerecovery) echo "110m" ;;
+    # TTL and a boot on top of everything the other two wait for.
+    instancerecovery) echo "90m" ;;
    # lbrecovery pays for a load balancer twice: once to stand one up with two
    # backends placed around it, and once for the recovery itself — a stale
    # owner, a lease, a boot, HAProxy's own start, and its health checks against
@@ -130,10 +126,6 @@ e2e_suite_timeout() {
    # budget on a node stopping and starting: seven units down, a raft election,
    # and the whole service stack back up with every stream caught up.
    kvquorum) echo "40m" ;;
-    # single is the broadest suite and finishes, it does not hang: passing runs
-    # took 24-29m, and an Oracle host ran out at 30m inside the last test's
-    # cleanup. The default left it no headroom at all.
-    single) echo "40m" ;;
    *) echo "30m" ;;
  esac
 }
@@ -1,23 +0,0 @@
-import unittest
-
-from mulga_design_check import filled
-
-
-class FilledTest(unittest.TestCase):
-    def test_accepts_either_form(self):
-        self.assertTrue(filled("## Mulga design\nUpdated: mulga#275"))
-        self.assertTrue(filled("## Mulga design\n\nnot needed: internal refactor\n## Next"))
-
-    def test_rejects_unanswered(self):
-        self.assertFalse(filled(""))
-        self.assertFalse(filled("## Mulga design\n<!-- Updated: x -->"))
-        self.assertFalse(filled("## Mulga design\nUpdated: <mulga PR or bead id>"))
-        self.assertFalse(filled("## Mulga design\nUpdated:"))
-
-    def test_scoped_to_the_section(self):
-        self.assertFalse(filled("Updated: mulga#1"))
-        self.assertFalse(filled("## Mulga design\n## Other\nUpdated: mulga#1"))
-
-
-if __name__ == "__main__":
-    unittest.main()
@@ -1,34 +0,0 @@
-#!/usr/bin/env bash
-# Usage: wait-for-memory.sh <MiB>
-#
-# Waits until the runner's MemAvailable reaches <MiB>, then returns. Runners on
-# one host share its RAM, and a neighbour's build holds several GiB for a few
-# minutes, so one sample taken during it is not a verdict on the host.
-# Gives up after MEM_WAIT_TIMEOUT_S and names the biggest processes.
-#
-# Env: MEM_WAIT_TIMEOUT_S (900), MEM_WAIT_POLL_S (30), MEMINFO (/proc/meminfo).
-set -uo pipefail
-
-want_mb="${1:?usage: $0 <MiB>}"
-timeout_s="${MEM_WAIT_TIMEOUT_S:-900}"
-poll_s="${MEM_WAIT_POLL_S:-30}"
-meminfo="${MEMINFO:-/proc/meminfo}"
-
-avail_mb() { awk '/^MemAvailable:/ {print int($2 / 1024)}' "$meminfo"; }
-
-start=$SECONDS
-while :; do
-  have=$(avail_mb)
-  if [ -n "$have" ] && [ "$have" -ge "$want_mb" ]; then
-    echo "memory: ${have} MiB available, need ${want_mb} MiB"
-    exit 0
-  fi
-  waited=$(( SECONDS - start ))
-  if [ "$waited" -ge "$timeout_s" ]; then
-    echo "::error::need ${want_mb} MiB available, have ${have:-unknown} MiB after waiting ${waited}s"
-    ps -eo rss,pid,args --sort=-rss | head -11 | cut -c1-200
-    exit 1
-  fi
-  echo "memory: ${have:-unknown} MiB available, need ${want_mb} MiB; waiting (${waited}s of ${timeout_s}s)"
-  sleep "$poll_s"
-done
@@ -1,47 +0,0 @@
-#!/bin/sh
-# wait-for-memory_test.sh — drives wait-for-memory.sh against a fake meminfo
-# that a background writer changes mid-wait, so each verdict is checked without
-# a loaded host.
-set -eu
-
-SCRIPT_DIR=$(CDPATH='' cd -- "$(dirname -- "$0")" && pwd)
-WAIT="$SCRIPT_DIR/wait-for-memory.sh"
-TMP=$(mktemp -d)
-trap 'rm -rf "$TMP"' EXIT
-
-fails=0
-pass() { echo "  ok   - $1"; }
-fail() { echo "  FAIL - $1"; fails=$((fails + 1)); }
-
-meminfo() { printf 'MemTotal:       65536000 kB\nMemAvailable:   %s kB\n' "$(( $1 * 1024 ))" > "$TMP/meminfo"; }
-MEMINFO="$TMP/meminfo"
-MEM_WAIT_POLL_S=1
-export MEMINFO MEM_WAIT_POLL_S
-
-meminfo 30000
-if MEM_WAIT_TIMEOUT_S=5 bash "$WAIT" 26624 > "$TMP/out" 2>&1; then
-  pass "enough memory returns at once"
-else
-  fail "enough memory returns at once: $(cat "$TMP/out")"
-fi
-
-meminfo 21577
-( sleep 2; meminfo 30000 ) &
-if MEM_WAIT_TIMEOUT_S=20 bash "$WAIT" 26624 > "$TMP/out" 2>&1 && grep -q waiting "$TMP/out"; then
-  pass "memory freed mid-wait is admitted"
-else
-  fail "memory freed mid-wait is admitted: $(cat "$TMP/out")"
-fi
-wait
-
-meminfo 21577
-if MEM_WAIT_TIMEOUT_S=2 bash "$WAIT" 26624 > "$TMP/out" 2>&1; then
-  fail "memory that never frees fails: exited 0"
-elif grep -q '::error::need 26624 MiB available, have 21577 MiB' "$TMP/out" && grep -q 'RSS' "$TMP/out"; then
-  pass "memory that never frees fails and names the biggest processes"
-else
-  fail "memory that never frees fails and names the biggest processes: $(cat "$TMP/out")"
-fi
-
-[ "$fails" -eq 0 ] || { echo "wait-for-memory: $fails failed"; exit 1; }
-echo "wait-for-memory: all passed"
@@ -18,11 +18,6 @@ workflows:
        - 'actions/create-github-app-token@v3.3.0'
        - 'actions/upload-artifact@v7.0.2'
        - 'hashicorp/setup-terraform@v4.0.1'
-    '.github/workflows/e2e-cloudvendor-vultr.yml':
-        - 'actions/checkout@v7.0.1'
-        - 'actions/create-github-app-token@v3.3.0'
-        - 'actions/upload-artifact@v7.0.2'
-        - 'hashicorp/setup-terraform@v4.0.1'
    '.github/workflows/e2e-ddil.yml':
        - 'actions/checkout@v7.0.1'
        - 'actions/create-github-app-token@v3.3.0'
@@ -50,8 +45,6 @@ workflows:
    '.github/workflows/image-scripts.yml':
        - 'actions/checkout@v7.0.1'
        - 'actions/setup-go@v7.0.0'
-    '.github/workflows/mulga-design.yml':
-        - 'actions/checkout@v7.0.1'
    '.github/workflows/perf-3node.yml':
        - 'actions/checkout@v7.0.1'
        - 'actions/create-github-app-token@v3.3.0'
@@ -80,7 +73,6 @@ workflows:
    '.github/workflows/ui.yml':
        - 'actions/checkout@v7.0.1'
        - 'actions/setup-node@v7.1.0'
-        - 'actions/upload-artifact@v7.0.2'
        - 'pnpm/action-setup@v6.1.0'
 dependencies:
    'actions/cache@v6.1.0':
@@ -2,8 +2,7 @@ name: Apt Packages

 # Path-filtered like image-scripts.yml: this resolves setup.sh's runtime package
 # list against each supported suite's real indices, so a renamed, dropped, or
-# ambiguously virtual package fails here rather than on a user's machine. The
-# dnf job does the same for Oracle Linux, through setup.sh's own repo setup.
+# ambiguously virtual package fails here rather than on a user's machine.
 on:
  push:
    branches:
@@ -12,7 +11,6 @@ on:
    paths:
      - scripts/setup.sh
      - scripts/lint-apt-packages.sh
-      - scripts/lint-dnf-packages.sh
      - .github/workflows/apt-packages.yml
  pull_request:
    branches:
@@ -21,7 +19,6 @@ on:
    paths:
      - scripts/setup.sh
      - scripts/lint-apt-packages.sh
-      - scripts/lint-dnf-packages.sh
      - .github/workflows/apt-packages.yml
  workflow_dispatch:

@@ -47,14 +44,3 @@ jobs:

      - name: Resolve runtime package list
        run: ./scripts/lint-apt-packages.sh ${{ matrix.image }}
-
-  dnf_packages:
-    name: Resolve dnf list (oraclelinux:10)
-    runs-on: ubuntu-26.04
-
-    steps:
-      - name: Checkout Code
-        uses: actions/checkout@v7.0.1
-
-      - name: Resolve runtime package list
-        run: ./scripts/lint-dnf-packages.sh oraclelinux:10
@@ -102,9 +102,9 @@ jobs:
        env:
          GH_TOKEN: ${{ github.token }}

-      - name: Build microVM artifacts (lb-agent + kernel + initramfs + qboot + SQS store and worker images)
+      - name: Build microVM artifacts (lb-agent + kernel + initramfs)
        if: steps.version.outputs.exists != 'true'
-        run: cd spinifex && make build-microvm-image build-sqs-worker-microvm-image
+        run: cd spinifex && make build-microvm-image

      - name: Build amd64 Tarball
        if: steps.version.outputs.exists != 'true'
@@ -144,7 +144,6 @@ jobs:
              --notes-file "$RUNNER_TEMP/notes.md" \
              "dist/spinifex-$TAG-linux-amd64.tar.gz" \
              "dist/spinifex-$TAG-linux-amd64.tar.gz.sha256" \
-              dist/qboot-*.tar.gz \
              "scripts/setup.sh"

      # The assertion that matters. A prerelease must never become the latest
@@ -1,142 +0,0 @@
-name: E2E Cloud Vendor Vultr
-
-# On demand only. Deploys a ref to Vultr with deploy-vultr.sh, runs the same
-# published Terraform workbooks as the hypervisor nightly and OCI, and destroys
-# the deployment, failing if anything is left billing.
-on:
-  workflow_dispatch:
-    inputs:
-      nodes:
-        description: "1 or 3 nodes"
-        required: false
-        default: "1"
-        type: choice
-        options: ["1", "3"]
-      plan:
-        description: "Vultr plan: vx1-g-16c-64g (VM) or vbm-8c-64gb-amd (bare metal)"
-        required: false
-        default: vx1-g-16c-64g
-      region:
-        description: "Vultr region"
-        required: false
-        default: ord
-      workbooks:
-        description: "Space-separated workbooks (blank = the driver's full list)"
-        required: false
-      source:
-        description: "tree (build this ref) or release (the published installer)"
-        required: false
-        default: tree
-        type: choice
-        options: [tree, release]
-      channel:
-        description: "With source=release: latest, or dev for the newest prerelease"
-        required: false
-        default: latest
-      keep_on_fail:
-        description: "Leave a failed deployment up to inspect. It keeps billing."
-        required: false
-        type: boolean
-        default: false
-      runner:
-        description: "Runner label (blank = the VULTR_E2E_RUNNER variable, else ubuntu-26.04)"
-        required: false
-
-permissions:
-  contents: read
-
-# Deployments are named per run, but the account's reserved-IP quota is shared,
-# so a second dispatch queues rather than competing with the first.
-concurrency:
-  group: e2e-vultr
-  cancel-in-progress: false
-
-jobs:
-  vultr:
-    # Hosted by default: the job only drives Terraform and SSH. The API key's
-    # access control must admit this runner, so a hosted runner needs a key
-    # whose list holds 0.0.0.0/0; a self-hosted runner can use a fixed address.
-    runs-on: ${{ inputs.runner || vars.VULTR_E2E_RUNNER || 'ubuntu-26.04' }}
-    timeout-minutes: 240
-    env:
-      VULTR_NAME: e2e-${{ github.run_id }}
-      VULTR_NODES: ${{ inputs.nodes }}
-      VULTR_PLAN: ${{ inputs.plan }}
-      VULTR_REGION: ${{ inputs.region }}
-      VULTR_SOURCE: ${{ inputs.source }}
-      VULTR_CHANNEL: ${{ inputs.channel }}
-      VULTR_ARTIFACT_DIR: ${{ github.workspace }}/e2e-vultr
-      SPX_REF: ${{ github.ref_name }}
-    steps:
-      - uses: actions/checkout@v7.0.1
-        with:
-          path: spinifex
-          fetch-depth: 0
-
-      - uses: actions/create-github-app-token@v3.3.0
-        id: app-token
-        with:
-          client-id: ${{ secrets.APP_ID }}
-          private-key: ${{ secrets.APP_PRIVATE_KEY }}
-          repositories: mulga
-
-      # build-install-artifacts.sh lives in mulga; the workbooks and their driver
-      # are in spinifex, so only the one directory is needed here.
-      - uses: actions/checkout@v7.0.1
-        with:
-          repository: mulgadc/mulga
-          path: mulga
-          token: ${{ steps.app-token.outputs.token }}
-          sparse-checkout: scripts/tofu-cluster
-
-      - uses: hashicorp/setup-terraform@v4.0.1
-        with:
-          terraform_wrapper: false
-
-      - name: Run Vultr
-        working-directory: spinifex/scripts/terraform/vultr-spx
-        env:
-          VULTR_API_KEY: ${{ secrets.VULTR_API_KEY }}
-          MULGA_ROOT: ${{ github.workspace }}/mulga
-          # Through the environment, never interpolated into the script: a
-          # dispatch input is untrusted text to the shell.
-          WORKBOOKS_INPUT: ${{ inputs.workbooks }}
-          VULTR_KEEP_ON_FAIL: ${{ inputs.keep_on_fail && '1' || '0' }}
-        run: |
-          set -uo pipefail
-          if [ -n "$WORKBOOKS_INPUT" ]; then export WORKBOOKS="$WORKBOOKS_INPUT"; fi
-          ./e2e-vultr.sh 2>&1 | tee "$RUNNER_TEMP/e2e-vultr.log"
-          exit "${PIPESTATUS[0]}"
-
-      # always(): a cancelled or timed-out job is the one that would leave
-      # servers and reserved IPs billing. destroy works from this run's state.
-      - name: Sweep anything left behind
-        if: always() && !inputs.keep_on_fail
-        working-directory: spinifex/scripts/terraform/vultr-spx
-        env:
-          VULTR_API_KEY: ${{ secrets.VULTR_API_KEY }}
-        run: ./e2e-vultr.sh --sweep-only
-
-      - name: Publish the verdict
-        if: always()
-        run: |
-          {
-            echo "### Vultr: ${VULTR_NODES} x ${VULTR_PLAN} in ${VULTR_REGION}, ${VULTR_SOURCE} build of ${SPX_REF}"
-            echo '```'
-            cat "$VULTR_ARTIFACT_DIR/verdict.txt" 2>/dev/null || echo "no verdict written"
-            echo '```'
-          } >> "$GITHUB_STEP_SUMMARY"
-
-      # Logs and the verdict only. The throwaway SSH key and the Terraform state
-      # under ~/.spinifex never reach an artifact.
-      - name: Upload the run
-        if: always()
-        uses: actions/upload-artifact@v7.0.2
-        with:
-          name: e2e-vultr-${{ github.run_id }}
-          path: |
-            ${{ runner.temp }}/e2e-vultr.log
-            ${{ github.workspace }}/e2e-vultr/*.log
-            ${{ github.workspace }}/e2e-vultr/verdict.txt
-            ${{ github.workspace }}/e2e-vultr/node*/*.log
-          retention-days: 14
@@ -10,7 +10,7 @@ on:
  workflow_dispatch:
    inputs:
      cells:
-        description: "Comma-separated cell numbers to run, no spaces (blank = all). 1-3, 8-10, 17-19 tofu permutation matrix, 34-36 Oracle Linux single node (basic, reboot, routed NAT), 37-38 Oracle Linux on three nodes (multi-node subset with IPsec, routed NAT), 20 baremetal, 21-22 ISO, 23 predastore throughput, 24 predastore fault injection, 25-27 service suites (eks, ecs, rds), 28 guest disk performance, 29 storage fault injection, 30 routed NAT on three nodes, 31 instance recovery on three nodes, 32 load balancer recovery on three nodes, 33 KV bucket quorum under node loss on three nodes"
+        description: "Comma-separated cell numbers to run, no spaces (blank = all). 1-3, 8-10, 17-19 tofu permutation matrix, 20 baremetal, 21-22 ISO, 23 predastore throughput, 24 predastore fault injection, 25-27 service suites (eks, ecs, rds), 28 guest disk performance, 29 storage fault injection, 30 routed NAT on three nodes, 31 instance recovery on three nodes, 32 load balancer recovery on three nodes, 33 KV bucket quorum under node loss on three nodes"
        required: false

 permissions:
@@ -33,7 +33,6 @@ concurrency:
 env:
  GIT_BRANCH: ${{ github.ref_name }}
  UBUNTU_GOLD_IMAGE: /mnt/disk1/gold-images/spinifex-image-builder-ubuntu-26.04.qcow2
-  ORACLE_GOLD_IMAGE: /mnt/disk1/gold-images/spinifex-image-builder-oracle-10.qcow2
  SPINIFEX_OTLP_ENDPOINT: ${{ vars.SPINIFEX_OTLP_ENDPOINT || 'http://192.168.1.13:8200' }}
  SPINIFEX_OTEL_ATTRS: ci.run_id=${{ github.run_id }},ci.workflow=${{ github.workflow }}

@@ -184,14 +183,6 @@ jobs:
            echo "running qemu: $(pgrep -c qemu-system-x86 || echo 0)"
          } >> "${ARTIFACT_DIR}/hypervisor-load.txt"

-      # A hypervisor out of disk fails the apply minutes in, as "Domain Creation
-      # Failed" from libvirt writing the domain XML. Say so before starting.
-      - name: Preflight hypervisor disk
-        working-directory: mulga/scripts/tofu-cluster
-        run: |
-          "${GITHUB_WORKSPACE}/spinifex/.github/scripts/hypervisor-disk-preflight.sh" \
-            "envs/${SPINIFEX_CI_ENV}.tfvars"
-
      - name: Provision VMs
        working-directory: mulga/scripts/tofu-cluster
        env:
@@ -204,8 +195,7 @@ jobs:
          # back onto the debian gold.
          TOFU_VAR_ARGS=""
          case "$MATRIX_HOST" in
-            ubuntu-*) TOFU_VAR_ARGS="-var=host_image_override=${UBUNTU_GOLD_IMAGE} -var=host_os=ubuntu" ;;
-            oracle-*) TOFU_VAR_ARGS="-var=host_image_override=${ORACLE_GOLD_IMAGE} -var=host_os=oracle" ;;
+            ubuntu-*) TOFU_VAR_ARGS="-var=host_image_override=${UBUNTU_GOLD_IMAGE}" ;;
          esac

          source "${GITHUB_WORKSPACE}/spinifex/.github/scripts/ci-fmt.sh"
@@ -249,11 +239,6 @@ jobs:
          . "${GITHUB_WORKSPACE}/spinifex/.github/scripts/suite-sets.sh"
          e2e_suites_assert_subset "e2e-nightly single" "${E2E_SUITES_NIGHTLY_SINGLE}" "${E2E_SUITES_SINGLE}"

-          # The select job sized this cell's budget from these same timeouts, so
-          # resolve them here and carry the pairs into the remote loop.
-          SUITE_TMOS=""
-          for s in ${E2E_SUITES_NIGHTLY_SINGLE}; do SUITE_TMOS="${SUITE_TMOS}${s}:$(e2e_suite_timeout "${s}") "; done
-
          INVENTORY=$(tofu output -json inventory)
          WAN_IP=$(echo "$INVENTORY" | jq -r '.nodes[0].wan_ip')
          SSH_KEY=$(echo "$INVENTORY" | jq -r '.ssh_key_path')
@@ -263,10 +248,9 @@ jobs:
             for SUITE in ${E2E_SUITES_NIGHTLY_SINGLE}; do \
               echo \"::group::suite \$SUITE\"; \
               date -u +%Y-%m-%dT%H:%M:%SZ > '${ARTIFACT_DIR}/test-'\$SUITE'.start'; \
-               TMO=30m; for kv in ${SUITE_TMOS}; do case \$kv in \$SUITE:*) TMO=\${kv#*:} ;; esac; done; \
               GITHUB_ACTIONS=true FORCE_COLOR=1 SPINIFEX_E2E=1 SPINIFEX_MODE=single \
                 ARTIFACT_DIR='${ARTIFACT_DIR}' \
-                 ./\$SUITE.test -test.v -test.timeout=\$TMO \
+                 ./\$SUITE.test -test.v -test.timeout=30m \
                 2>&1 | tee '${ARTIFACT_DIR}/test-'\$SUITE'.log'; \
               rc=\${PIPESTATUS[0]}; echo \"::endgroup::\"; \
               if [ \$rc -ne 0 ]; then echo \"\$SUITE: FAILED\" >> '${ARTIFACT_DIR}/suite-status.txt'; FAIL=1; fi; \
@@ -338,20 +322,16 @@ jobs:
            NODES_CSV="${NODES_CSV:+$NODES_CSV,}$ip"
          done

-          SUITE_TMOS=""
-          for s in ${E2E_SUITES_NIGHTLY_MULTI}; do SUITE_TMOS="${SUITE_TMOS}${s}:$(e2e_suite_timeout "${s}") "; done
-
          ssh -tt -o StrictHostKeyChecking=no -i "$SSH_KEY" tf-user@${NODE1_IP} \
            "set -u; mkdir -p '${ARTIFACT_DIR}'; cd \$HOME/e2e-tests/_bin; FAIL=0; \
             for SUITE in ${E2E_SUITES_NIGHTLY_MULTI}; do \
               echo \"::group::suite \$SUITE\"; \
               date -u +%Y-%m-%dT%H:%M:%SZ > '${ARTIFACT_DIR}/test-'\$SUITE'.start'; \
-               TMO=30m; for kv in ${SUITE_TMOS}; do case \$kv in \$SUITE:*) TMO=\${kv#*:} ;; esac; done; \
               GITHUB_ACTIONS=true FORCE_COLOR=1 SPINIFEX_E2E=1 SPINIFEX_MODE=multinode \
                 SPINIFEX_NODES='${NODES_CSV}' SPINIFEX_NODE_IPS='${NODES_CSV}' \
                 SPINIFEX_SSH_USER=tf-user SPINIFEX_SSH_KEY=\$HOME/.ssh/tf-user-ap-southeast-2 \
                 ARTIFACT_DIR='${ARTIFACT_DIR}' \
-                 ./\$SUITE.test -test.v -test.timeout=\$TMO \
+                 ./\$SUITE.test -test.v -test.timeout=30m \
                 2>&1 | tee '${ARTIFACT_DIR}/test-'\$SUITE'.log'; \
               rc=\${PIPESTATUS[0]}; echo \"::endgroup::\"; \
               if [ \$rc -ne 0 ]; then echo \"\$SUITE: FAILED\" >> '${ARTIFACT_DIR}/suite-status.txt'; FAIL=1; fi; \
@@ -707,7 +687,7 @@ jobs:
              'echo "host: $(hostname)"; echo "loadavg: $(cat /proc/loadavg)";
               grep -E "^(MemTotal|MemAvailable|SwapFree):" /proc/meminfo;
               echo "cpu(steal is field 8): $(grep "^cpu " /proc/stat)";
-               echo "running qemu: $(pgrep -c "qemu-system-x86|qemu-kvm" || echo 0)"' 2>&1
+               echo "running qemu: $(pgrep -c qemu-system-x86 || echo 0)"' 2>&1
          } >> "${ARTIFACT_DIR}/node-load.txt"
          exit 0

@@ -878,8 +858,7 @@ jobs:
          # different image path than apply did.
          TOFU_VAR_ARGS=""
          case "$MATRIX_HOST" in
-            ubuntu-*) TOFU_VAR_ARGS="-var=host_image_override=${UBUNTU_GOLD_IMAGE} -var=host_os=ubuntu" ;;
-            oracle-*) TOFU_VAR_ARGS="-var=host_image_override=${ORACLE_GOLD_IMAGE} -var=host_os=oracle" ;;
+            ubuntu-*) TOFU_VAR_ARGS="-var=host_image_override=${UBUNTU_GOLD_IMAGE}" ;;
          esac
          source "${GITHUB_WORKSPACE}/spinifex/.github/scripts/ci-fmt.sh"
          tofu workspace select -or-create "${SPINIFEX_CI_ENV}" >> "$TOFU_LOG" 2>&1
@@ -1057,6 +1036,9 @@ jobs:
            { echo "::error::br-wan not permitted in /etc/qemu/bridge.conf"; exit 1; }
          command -v sshpass >/dev/null ||
            { echo "::error::sshpass not installed"; exit 1; }
+          free_mb=$(free -m | awk '/^Mem:/ {print $7}')
+          [ "$free_mb" -ge 8192 ] ||
+            { echo "::error::need 8 GiB available, have ${free_mb} MiB"; exit 1; }
          # A 40G image on tmpfs competes with the 8 GiB the VM itself needs.
          fstype=$(df --output=fstype "$TMPDIR" | tail -1 | tr -d ' ')
          [ "$fstype" != tmpfs ] ||
@@ -1087,10 +1069,6 @@ jobs:
              ssh-keygen -t ed25519 -N "" -f "$HOME/.ssh/$k" -C "$k-ci"
          done

-      # The node's 8 GiB, claimed when the VM boots rather than at preflight.
-      - name: Wait for memory
-        run: mulga/spinifex/.github/scripts/wait-for-memory.sh 8192
-
      # Boots the ISO, installs unattended, reads the lease off the serial
      # console, runs the in-guest smoke test, and installs the key for the
      # next step.
@@ -1204,16 +1182,6 @@ jobs:
          sleep 2
          rm -f "$TMPDIR"/tmp.*.qcow2 "$TMPDIR"/tmp.*.log "$TMPDIR"/tmp.*-node.log

-      # The ISO build runs as root inside the workspace, and the next job on
-      # this runner, from any workflow, cannot remove what it leaves there.
-      - name: Release the workspace
-        if: always()
-        run: |
-          sudo umount -R -l "$GITHUB_WORKSPACE"/mulga/scripts/iso-builder/.cache/rootfs 2>/dev/null || true
-          sudo rm -rf --one-file-system "$GITHUB_WORKSPACE"/mulga/scripts/iso-builder/.cache \
-              "$GITHUB_WORKSPACE"/mulga/scripts/iso-builder/dist
-          sudo chown -R "$(id -u):$(id -g)" "$GITHUB_WORKSPACE"
-
  iso-multi:
    name: cell-22 (iso/dhcp/three-node)
    # After cell-21 rather than beside it: same concurrency group, and running
@@ -1302,10 +1270,15 @@ jobs:
          ref: ${{ steps.siblings.outputs.bluebottle }}
          path: mulga/bluebottle

+      # 3 x 8 GiB plus 9 sparse 40G disks, before the instances the cluster
+      # launches on top.
      - name: Preflight
        run: |
          set -euo pipefail
          mkdir -p "$TMPDIR"
+          free_mb=$(free -m | awk '/^Mem:/ {print $7}')
+          [ "$free_mb" -ge 26624 ] ||
+            { echo "::error::need 26 GiB available, have ${free_mb} MiB"; exit 1; }
          fstype=$(df --output=fstype "$TMPDIR" | tail -1 | tr -d ' ')
          [ "$fstype" != tmpfs ] ||
            { echo "::error::$TMPDIR is tmpfs — nine node disks would be in RAM"; exit 1; }
@@ -1328,11 +1301,6 @@ jobs:
      # formation port. Both land with mulga-yxtda and the bridged WAN mode;
      # until then this cell proves the cluster forms and survives, not that a
      # customer can use it.
-      # 3 x 8 GiB plus headroom for the instances the cluster launches on top,
-      # claimed when the nodes boot rather than at preflight.
-      - name: Wait for memory
-        run: mulga/spinifex/.github/scripts/wait-for-memory.sh 26624
-
      - name: Install, form and verify the cluster
        working-directory: mulga/scripts/iso-builder
        run: |
@@ -1365,16 +1333,6 @@ jobs:
          rm -rf /tmp/cell22-artifacts-$GITHUB_RUN_ID /tmp/cell22-$GITHUB_RUN_ID.log \
                 "$WORK_DIR"

-      # The ISO build runs as root inside the workspace, and the next job on
-      # this runner, from any workflow, cannot remove what it leaves there.
-      - name: Release the workspace
-        if: always()
-        run: |
-          sudo umount -R -l "$GITHUB_WORKSPACE"/mulga/scripts/iso-builder/.cache/rootfs 2>/dev/null || true
-          sudo rm -rf --one-file-system "$GITHUB_WORKSPACE"/mulga/scripts/iso-builder/.cache \
-              "$GITHUB_WORKSPACE"/mulga/scripts/iso-builder/dist
-          sudo chown -R "$(id -u):$(id -g)" "$GITHUB_WORKSPACE"
-
  # Predastore throughput ("cell 23"). Predastore has no runners of its own and
  # spinifex depends on it, so the benchmark lives here and checks predastore
  # out as a sibling.
@@ -536,13 +536,6 @@ jobs:
          log-dir: ${{ env.ARTIFACT_DIR }}
          title: "E2E failure analysis"

-      # The WAN capture is most of the artifact and only matters when a run
-      # failed. Anything short of a clean pass (suite rc, a failed setup or
-      # collect step, a missing rc) keeps it.
-      - name: Drop the packet capture from a passing single-node run
-        if: always() && steps.e2e.outputs.rc == '0' && job.status == 'success'
-        run: rm -f "${ARTIFACT_DIR}"/net-diag/wan.pcap
-
      - uses: actions/upload-artifact@v7.0.2
        if: always()
        with:
@@ -997,13 +990,6 @@ jobs:
          log-dir: ${{ env.ARTIFACT_DIR }}
          title: "Multi-Node E2E failure analysis"

-      # The WAN captures are 90% of the artifact and only matter when a run
-      # failed. Anything short of a clean pass (suite rc, a failed setup or
-      # collect step, a missing rc) keeps them.
-      - name: Drop the packet captures from a passing multi-node run
-        if: always() && steps.e2e.outputs.rc == '0' && job.status == 'success'
-        run: rm -f "${ARTIFACT_DIR}"/net-diag-node*/wan.pcap
-
      - uses: actions/upload-artifact@v7.0.2
        if: always()
        with:
@@ -1,33 +0,0 @@
-name: Mulga design
-
-# Reminds the author to say whether the Mulga design records need to change.
-# It reads only the pull request body, uses no secrets, and warns without ever
-# failing: the check is a prompt, not a gate.
-
-on:
-  pull_request:
-    branches:
-      - dev
-    types: [opened, edited, reopened]
-
-permissions:
-  contents: read
-
-jobs:
-  mulga_design:
-    name: Mulga design line
-    if: ${{ !endsWith(github.actor, '[bot]') }}
-    runs-on: ubuntu-26.04
-    steps:
-      - name: Checkout Code
-        uses: actions/checkout@v7.0.1
-        with:
-          sparse-checkout: .github/scripts
-
-      - name: Check the Mulga design line
-        env:
-          PR_BODY: ${{ github.event.pull_request.body }}
-        working-directory: .github/scripts
-        run: |
-          python3 -m unittest -q test_mulga_design_check
-          python3 mulga_design_check.py
@@ -57,8 +57,8 @@ jobs:
          go-version-file: spinifex/go.mod
          cache: false

-      - name: Build microVM artifacts (lb-agent + kernel + initramfs + qboot + SQS store and worker images)
-        run: cd spinifex && make build-microvm-image build-sqs-worker-microvm-image
+      - name: Build microVM artifacts (lb-agent + kernel + initramfs)
+        run: cd spinifex && make build-microvm-image

      - name: Build amd64 Tarball
        env:
@@ -72,7 +72,6 @@ jobs:
          path: |
            spinifex/dist/spinifex-${{ github.ref_name }}-linux-amd64.tar.gz
            spinifex/dist/spinifex-${{ github.ref_name }}-linux-amd64.tar.gz.sha256
-            spinifex/dist/qboot-*.tar.gz
            spinifex/scripts/setup.sh

  distro-arm64:
@@ -119,6 +119,9 @@ jobs:
      - name: Build Spinifex
        run: make -C spinifex build

+      - name: Manifest check + drift lint
+        run: make -C spinifex manifest-check manifest-lint
+
      - name: Run Tests with Coverage
        env:
          SPINIFEX_REQUIRE_CONFORMANCE_TOOLS: "1"
@@ -7,11 +7,6 @@ on:
      - dev
    paths:
      - spinifex/runtime/roles/spinifexui/frontend/**
-      - spinifex/runtime/roles/spinifexui/*.go
-      - spinifex/operator/admin/instance_metrics*.go
-      - spinifex/operator/admin/live_streams*.go
-      - spinifex/runtime/roles/qmpcollector/**
-      - contracts/telemetry/**
      - .github/workflows/ui.yml
  pull_request:
    branches:
@@ -19,11 +14,6 @@ on:
      - dev
    paths:
      - spinifex/runtime/roles/spinifexui/frontend/**
-      - spinifex/runtime/roles/spinifexui/*.go
-      - spinifex/operator/admin/instance_metrics*.go
-      - spinifex/operator/admin/live_streams*.go
-      - spinifex/runtime/roles/qmpcollector/**
-      - contracts/telemetry/**
      - .github/workflows/ui.yml
  workflow_dispatch:

@@ -79,85 +69,3 @@ jobs:
            echo "$drift"
            exit 1
          fi
-
-  # The pinned image lives in one file that scripts/ui-playwright.sh also reads,
-  # so make ui-baselines and the job below draw screenshots in the same image.
-  ui_e2e_image:
-    name: UI End-to-End Image
-    runs-on: ubuntu-26.04
-    outputs:
-      image: ${{ steps.read.outputs.image }}
-
-    steps:
-      - name: Checkout Code
-        uses: actions/checkout@v7.0.1
-        with:
-          sparse-checkout: spinifex/runtime/roles/spinifexui/frontend/playwright.image
-          sparse-checkout-cone-mode: false
-
-      - name: Read Playwright Image
-        id: read
-        run: echo "image=$(tr -d '[:space:]' < spinifex/runtime/roles/spinifexui/frontend/playwright.image)" >> "$GITHUB_OUTPUT"
-
-  # The browser suite: the console against a faked API on Vite dev, plus the
-  # built dist under the production CSP. It runs in Playwright's own image, which
-  # carries the browsers, so screenshots rasterise as they did for the baselines.
-  ui_e2e:
-    name: UI End-to-End
-    needs: ui_e2e_image
-    runs-on: ubuntu-26.04
-    timeout-minutes: 20
-    container:
-      image: ${{ needs.ui_e2e_image.outputs.image }}
-      options: --ipc=host
-    defaults:
-      run:
-        working-directory: spinifex/runtime/roles/spinifexui/frontend
-
-    steps:
-      - name: Checkout Code
-        uses: actions/checkout@v7.0.1
-        with:
-          sparse-checkout: spinifex/runtime/roles/spinifexui/frontend
-
-      - name: Setup pnpm
-        uses: pnpm/action-setup@v6.1.0
-        with:
-          package_json_file: spinifex/runtime/roles/spinifexui/frontend/package.json
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v7.1.0
-        with:
-          cache: "pnpm"
-          cache-dependency-path: spinifex/runtime/roles/spinifexui/frontend/pnpm-lock.yaml
-          node-version-file: spinifex/runtime/roles/spinifexui/frontend/.nvmrc
-
-      - name: Install Dependencies
-        run: pnpm install --frozen-lockfile
-
-      # The image's browsers belong to one Playwright release, so a lockfile
-      # bump without an image bump would otherwise fail on a missing executable.
-      - name: Check Playwright Matches the Image
-        env:
-          IMAGE: ${{ needs.ui_e2e_image.outputs.image }}
-        run: |
-          version=$(pnpm exec playwright --version | awk '{print $2}')
-          case "$IMAGE" in
-            *":v$version-"*) ;;
-            *) echo "::error::Lockfile has Playwright $version but the image is $IMAGE. Update playwright.image."; exit 1 ;;
-          esac
-
-      - name: Build Frontend
-        run: pnpm build
-
-      - name: Run End-to-End Suite
-        run: pnpm e2e
-
-      - name: Upload Screenshot Diffs
-        if: failure()
-        uses: actions/upload-artifact@v7.0.2
-        with:
-          name: ui-e2e-test-results
-          path: spinifex/runtime/roles/spinifexui/frontend/test-results/
-          if-no-files-found: ignore
-          retention-days: 14
@@ -19,15 +19,6 @@ bin/
 dist/
 build/microvm/vmlinuz
 build/microvm/initramfs.cpio.gz
-build/microvm/qboot.rom
-build/microvm/qboot.LICENSE
-build/microvm/sqs-worker/vmlinuz
-build/microvm/sqs-worker/initramfs.cpio.gz
-build/microvm/sqs-worker/.stage.*/
-build/microvm/lambda-runtime/vmlinuz
-build/microvm/lambda-runtime/initramfs.cpio.gz
-build/microvm/lambda-runtime/.stage.*/
-build/qboot/
 !spinifex/runtime/roles/spinifexui/frontend/dist/
 tmp/
 *.test
@@ -61,7 +61,7 @@ sudo apt-get install -y shellcheck
 curl -sSfL https://golangci-lint.run/install.sh | sh -s -- -b "$(go env GOPATH)/bin" v2.14.0
 ```

-The web console additionally needs `pnpm` and the Node.js version pinned in `spinifex/runtime/roles/spinifexui/frontend/.nvmrc`.
+The web console additionally needs Node.js 24 and `pnpm`.

 ## Development Workflow

@@ -56,19 +56,6 @@ build-ui:
 	@echo -e "\n....Building spinifex-ui frontend...."
 	cd spinifex/runtime/roles/spinifexui/frontend && pnpm build

-# Playwright suite for the console, against Vite dev and the built dist under
-# the console's CSP. Not part of preflight; needs `pnpm exec playwright install chromium`.
-test-ui-e2e: build-ui
-	cd spinifex/runtime/roles/spinifexui/frontend && pnpm e2e
-
-# The same suite inside the pinned Playwright image CI uses (podman or docker),
-# so screenshots compare as they will on the runner. ui-baselines redraws them.
-ui-e2e-container:
-	scripts/ui-playwright.sh compare
-
-ui-baselines:
-	scripts/ui-playwright.sh baselines
-
 # GO commands
 VERSION ?= $(shell git describe --tags --always --dirty --exclude '*-dev')
 COMMIT  ?= $(shell git rev-parse --short HEAD)
@@ -153,79 +140,22 @@ $(MICROVM_ARTIFACTS) &: $(MICROVM_INPUTS)
 bin/lb-agent:
 	$(MAKE) build-lb-agent

-# The dedicated SQS server, built from the go.mod-pinned module so the image
-# ships exactly the reviewed version. Static for the musl guest.
-bin/nats-server: go.mod go.sum
-	@mkdir -p bin
-	GOWORK=off CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -trimpath -ldflags '-s -w' -o $@ github.com/nats-io/nats-server/v2
+build-microvm-image: $(MICROVM_ARTIFACTS) ## Build microVM kernel + initramfs (incremental — skips when up to date)

-# go_local_srcs lists the main module package dirs and files guest package $(1)
-# links, scanned with the guest build settings; a dir's mtime catches a deleted
-# or renamed file. A failed scan names a missing prerequisite, so make stops.
-go_local_srcs = $(shell GOWORK=off CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go list -deps -f '{{if and .Module .Module.Main}}{{.Dir}} {{range .GoFiles}}{{$$.Dir}}/{{.}} {{end}}{{range .EmbedFiles}}{{$$.Dir}}/{{.}} {{end}}{{end}}' $(1) || echo go-list-failed-for-$(1))
-.SECONDEXPANSION:
-
-# The SQS microVM image: one guest running its own SQS nats-server and the SQS
-# worker as separate processes. A separate artifact from the LB image above.
-SQS_WORKER_MICROVM_OUT_DIR := $(MICROVM_OUT_DIR)/sqs-worker
-SQS_WORKER_MICROVM_ARTIFACTS := $(SQS_WORKER_MICROVM_OUT_DIR)/vmlinuz $(SQS_WORKER_MICROVM_OUT_DIR)/initramfs.cpio.gz
-SQS_WORKER_MICROVM_INPUTS := scripts/build-sqs-store-microvm-image.sh scripts/lib/microvm-image.sh scripts/lib/sqs-store-microvm-publish.sh $(SQS_WORKER_MICROVM_OUT_DIR)/init.sh $(SQS_WORKER_MICROVM_OUT_DIR)/inittab $(addprefix $(SQS_WORKER_MICROVM_OUT_DIR)/,sqs-worker-lib.sh sqs-worker-prepare sqs-worker-store sqs-worker-ready sqs-worker-stop) bin/nats-server bin/sqs-worker
-
-$(SQS_WORKER_MICROVM_ARTIFACTS) &: $(SQS_WORKER_MICROVM_INPUTS)
-	./scripts/build-sqs-store-microvm-image.sh
-
-bin/sqs-worker: go.mod go.sum $$(call go_local_srcs,./cmd/sqs-worker)
-	@mkdir -p bin
-	GOWORK=off CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -trimpath -ldflags '-s -w' -o $@ ./cmd/sqs-worker
-
-build-sqs-worker-microvm-image: $(SQS_WORKER_MICROVM_ARTIFACTS) ## Build the SQS microVM kernel and initramfs
-
-# The Lambda runtime microVM image. Built on demand; not shipped or installed.
-LAMBDA_RUNTIME_MICROVM_OUT_DIR := $(MICROVM_OUT_DIR)/lambda-runtime
-LAMBDA_RUNTIME_MICROVM_ARTIFACTS := $(LAMBDA_RUNTIME_MICROVM_OUT_DIR)/vmlinuz $(LAMBDA_RUNTIME_MICROVM_OUT_DIR)/initramfs.cpio.gz
-LAMBDA_RUNTIME_MICROVM_INPUTS := scripts/build-lambda-runtime-microvm-image.sh scripts/lib/microvm-image.sh $(addprefix $(LAMBDA_RUNTIME_MICROVM_OUT_DIR)/,init.sh inittab run-agent) bin/lambda-agent
-
-$(LAMBDA_RUNTIME_MICROVM_ARTIFACTS) &: $(LAMBDA_RUNTIME_MICROVM_INPUTS)
-	./scripts/build-lambda-runtime-microvm-image.sh
-
-bin/lambda-agent: go.mod go.sum $$(call go_local_srcs,./cmd/lambda-agent)
-	@mkdir -p bin
-	GOWORK=off CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -trimpath -ldflags '-s -w' -o $@ ./cmd/lambda-agent
-
-build-lambda-runtime-microvm-image: $(LAMBDA_RUNTIME_MICROVM_ARTIFACTS) ## Build the Lambda runtime microVM kernel and initramfs (not shipped)
-
-# qboot is the microvm firmware. The source tarball ships with each release
-# because qboot is GPL-2.0.
-QBOOT_COMMIT := $(shell sed -n 's/^QBOOT_COMMIT="\(.*\)"$$/\1/p' scripts/build-qboot.sh)
-QBOOT_SOURCE := build/qboot/qboot-$(QBOOT_COMMIT).tar.gz
-QBOOT_ARTIFACTS := $(MICROVM_OUT_DIR)/qboot.rom $(MICROVM_OUT_DIR)/qboot.LICENSE $(QBOOT_SOURCE)
-
-$(QBOOT_ARTIFACTS) &: scripts/build-qboot.sh
-	./scripts/build-qboot.sh
-
-build-microvm-image: $(MICROVM_ARTIFACTS) $(QBOOT_ARTIFACTS) ## Build microVM kernel, initramfs and qboot firmware (incremental — skips when up to date)
-
-install-sqs-worker-microvm: $(SQS_WORKER_MICROVM_ARTIFACTS) ## Install the SQS microVM image to /usr/share/spinifex/microvm/sqs-worker/
-	sudo install -d /usr/share/spinifex/microvm/sqs-worker
-	sudo rm -f /usr/share/spinifex/microvm/sqs-worker/initramfs.cpio.gz
-	sudo install -m 0644 $(SQS_WORKER_MICROVM_OUT_DIR)/vmlinuz /usr/share/spinifex/microvm/sqs-worker/vmlinuz
-	sudo install -m 0644 $(SQS_WORKER_MICROVM_OUT_DIR)/initramfs.cpio.gz /usr/share/spinifex/microvm/sqs-worker/initramfs.cpio.gz
-
-install-microvm: $(MICROVM_ARTIFACTS) $(QBOOT_ARTIFACTS) ## Install microVM artifacts to /usr/share/spinifex/microvm/
+install-microvm: $(MICROVM_ARTIFACTS) ## Install microVM artifacts to /usr/share/spinifex/microvm/
 	sudo install -d /usr/share/spinifex/microvm
 	sudo install -m 0644 $(MICROVM_OUT_DIR)/vmlinuz /usr/share/spinifex/microvm/vmlinuz
 	sudo install -m 0644 $(MICROVM_OUT_DIR)/initramfs.cpio.gz /usr/share/spinifex/microvm/initramfs.cpio.gz
-	sudo install -m 0644 $(MICROVM_OUT_DIR)/qboot.rom /usr/share/spinifex/microvm/qboot.rom
-	sudo install -m 0644 $(MICROVM_OUT_DIR)/qboot.LICENSE /usr/share/spinifex/microvm/qboot.LICENSE

-# the pre-commit gate: lint, vuln, and the unit and e2e-harness tiers.
+# the pre-commit gate: manifest checks, lint, vuln, and the unit and e2e-harness tiers.
 # integration and race tests skipped to keep quick, they run in CI.
 #
 # -j2 overlaps the only two heavy gates, lint and test-cover: alone each leaves
 # most of the machine idle, so pairing them cuts a cold run by about a quarter.
 # -Otarget keeps each gate's output in one block instead of interleaving them.
+# manifest-check manifest-lint test-package-check removed, can add back later
 preflight:
-	@$(MAKE) --no-print-directory -j2 -Otarget QUIET=1 lint govulncheck test-cover diff-coverage test-harness test-build-scripts
+	@$(MAKE) --no-print-directory -j2 -Otarget QUIET=1 lint govulncheck test-cover diff-coverage test-harness test-build-scripts manifest-check manifest-lint
 	@echo -e "\n ✅ Preflight passed — safe to commit."

 # Shell suites + shellcheck for build/scripts/, the systemd-unit helpers that
@@ -237,7 +167,7 @@ preflight:
 # reason: between them they install the software, wire OVN, erase the state and
 # remove the install, so a shellcheck warning in one is an outage or a wrong
 # deletion, not a style note.
-NODE_SCRIPTS := scripts/setup.sh scripts/setup-ovn.sh scripts/install-node.sh scripts/smoke-test.sh scripts/node-reset.sh scripts/uninstall-spx.sh scripts/lib/distro.sh scripts/lib/stage-sqs-store-microvm.sh
+NODE_SCRIPTS := scripts/setup.sh scripts/setup-ovn.sh scripts/install-node.sh scripts/smoke-test.sh scripts/node-reset.sh scripts/uninstall-spx.sh

 test-build-scripts:
 	@echo -e "\n....Running build/scripts/**/*_test.sh...."
@@ -245,21 +175,13 @@ test-build-scripts:
 		echo "-- $$t"; \
 		sh "$$t" || exit 1; \
 	done
-	@echo -e "\n....Running scripts/*_test.sh, scripts/lib/*_test.sh and scripts/appliance/*_test.sh...."
-	@for t in $$( (find scripts -maxdepth 1 -name '*_test.sh'; find scripts/lib scripts/appliance -name '*_test.sh') | sort); do \
+	@echo -e "\n....Running scripts/*_test.sh...."
+	@for t in $$(find scripts -maxdepth 1 -name '*_test.sh' | sort); do \
 		echo "-- $$t"; \
 		sh "$$t" || exit 1; \
 	done
-	@echo -e "\n....Running .github/scripts/*_test.sh...."
-	@for t in $$(find .github/scripts -maxdepth 1 -name '*_test.sh' | sort); do \
-		echo "-- $$t"; \
-		sh "$$t" || exit 1; \
-	done
-	shellcheck -S warning .github/scripts/hypervisor-disk-preflight.sh .github/scripts/hypervisor-disk-preflight_test.sh \
-		.github/scripts/wait-for-memory.sh .github/scripts/wait-for-memory_test.sh
 	@echo -e "\n....Running shellcheck over build/scripts/**/*.sh + the node scripts...."
 	shellcheck -S warning $$(find build/scripts -name '*.sh' | sort) $(NODE_SCRIPTS)
-	shellcheck -S warning -x scripts/build-oracle-appliance.sh $$(find scripts/appliance -name '*.sh' | sort)
 	@echo "  test-build-scripts ok"

 # E2E harness unit tests. Build-tagged `e2e` so they're skipped by the
@@ -306,6 +228,23 @@ test-segscan-oracle:
 	@echo -e "\n....Running segscan storage oracle test...."
 	$(_Q)LOG_IGNORE=1 go test -tags=integration,segscanoracle -timeout 120s ./tests/integration/... -run TestSegscanOracle $(_RACEQ)

+# Validate docs/service-interfaces.yaml. Schema check + cross-reference
+# of services/suites/fixtures + on-disk path existence.
+manifest-check:
+	@echo -e "\n....Checking service-interfaces.yaml...."
+	@go run ./tests/e2e/manifest-check/cmd/manifest-check -repo-root . -manifest docs/service-interfaces.yaml
+
+# Drift guards: direct-create fixture lint + NATS subject lint,
+# ratcheted against tests/e2e/manifest-lint/baseline.txt. Fails only on NEW
+# drift beyond the baseline.
+manifest-lint:
+	@echo -e "\n....Linting manifest drift (fixtures + subjects)...."
+	@go run ./tests/e2e/manifest-lint/cmd/manifest-lint -repo-root .
+
+# Accept current drift into the baseline. Run after an intentional change.
+manifest-lint-update:
+	@go run ./tests/e2e/manifest-lint/cmd/manifest-lint -repo-root . -update
+
 # Run unit tests
 test:
 	@echo -e "\n....Running tests for $(GO_PROJECT_NAME)...."
@@ -326,8 +265,7 @@ test-cover:
 # Run unit tests with race detector
 test-race:
 	@echo -e "\n....Running tests with race detector for $(GO_PROJECT_NAME)...."
-	$(_Q)LOG_IGNORE=1 SPINIFEX_SQS_R3=1 go test $(GOTESTFLAGS) -race -timeout 300s ./spinifex/... ./cmd/... ./internal/... ./contracts/... ./architecture/... $(_RACEQ)
-	$(_Q)LOG_IGNORE=1 go test $(GOTESTFLAGS) -race -tags=lambdatestlink -timeout 120s ./cmd/lambda-agent/ ./spinifex/agents/lambda/hostlink/ $(_RACEQ)
+	$(_Q)LOG_IGNORE=1 go test $(GOTESTFLAGS) -race -timeout 300s ./spinifex/... ./cmd/... ./internal/... ./contracts/... ./architecture/... $(_RACEQ)

 # Unit tests for in-repo GitHub Actions (e.g. .github/actions/e2e-analyze).
 # Kept out of `test-cover` so coverage % isn't diluted by CI-only tooling.
@@ -395,20 +333,14 @@ fuzz:
 # Microvm artifacts are reinstalled when they already exist on disk — the rule's
 # input timestamps drive a rebuild only if anything actually changed. On a fresh
 # checkout (no build/microvm/vmlinuz yet) the install step is skipped; run
-# `make install-microvm` explicitly the first time. They go in before the
-# preflight, which checks the microvm firmware.
+# `make install-microvm` explicitly the first time.
 deploy: build
 	sudo install -m 755 bin/spx /usr/local/bin/spx
-	@if [ -f $(MICROVM_OUT_DIR)/vmlinuz ]; then \
-		$(MAKE) install-microvm; \
-	else \
-		echo "[deploy] microvm artifacts absent — run 'make install-microvm' for first-time setup"; \
-	fi
 	@if [ "$${SKIP_ASSET_PREFLIGHT:-}" != "1" ]; then \
 		if ! sudo /usr/local/bin/spx admin preflight; then \
 			echo ""; \
-			echo "[deploy] host-asset preflight failed: this node's helper scripts, sudoers"; \
-			echo "  grants, QEMU or microvm firmware don't match the binary just installed. Remediate with:"; \
+			echo "[deploy] host-asset preflight failed: this node's helper scripts or sudoers"; \
+			echo "  grants don't match the binary just installed. Remediate with:"; \
 			echo "    scripts/update-nodes.sh   (from the mulga root)"; \
 			echo "  or:"; \
 			echo "    make reinstall"; \
@@ -418,6 +350,11 @@ deploy: build
 	else \
 		echo "[deploy] SKIP_ASSET_PREFLIGHT=1 — skipping host-asset preflight"; \
 	fi
+	@if [ -f $(MICROVM_OUT_DIR)/vmlinuz ]; then \
+		$(MAKE) install-microvm; \
+	else \
+		echo "[deploy] microvm artifacts absent — run 'make install-microvm' for first-time setup"; \
+	fi
 	sudo systemctl daemon-reload
 	sudo systemctl restart spinifex.target

@@ -430,25 +367,16 @@ clean:
 	rm -f ./bin/$(GO_PROJECT_NAME)
 	rm -rf spinifex/runtime/roles/spinifexui/frontend/dist

-# On dnf hosts the runtime packages and repositories come from setup.sh, so the
-# two cannot drift; nbdkit-devel, for building the plugin, is only in CodeReady.
 install-system:
 	@echo -e "\n....Installing system dependencies for $(ARCH)...."
-	@pm=$$(INSTALL_SPINIFEX_LIB_ONLY=1 bash -c '. scripts/setup.sh && distro_pkg_manager') || exit 1; \
-	if [ "$$pm" = dnf ]; then \
-		INSTALL_SPINIFEX_LIB_ONLY=1 bash -c '. scripts/setup.sh && setup_sudo && detect_os && install_dnf_deps' && \
-		sudo dnf config-manager --set-enabled ol10_codeready_builder && \
-		sudo dnf install -y nbdkit-devel pkgconf-pkg-config make gcc openssh-clients git sudo; \
-	else \
-		sudo apt-get update && sudo DEBIAN_FRONTEND=noninteractive apt-get install -y \
-			-o Dpkg::Options::="--force-confdef" \
-			-o Dpkg::Options::="--force-confold" \
-			nbdkit nbdkit-plugin-dev pkg-config qemu-system-x86 qemu-system-arm qemu-utils \
-			ovmf qemu-efi-aarch64 \
-			libvirt-daemon-system libvirt-clients libvirt-dev make gcc jq curl \
-			iproute2 netcat-openbsd openssh-client wget git unzip sudo xz-utils file \
-			ovn-central ovn-host openvswitch-switch dhcpcd-base; \
-	fi
+	sudo apt-get update && sudo DEBIAN_FRONTEND=noninteractive apt-get install -y \
+		-o Dpkg::Options::="--force-confdef" \
+		-o Dpkg::Options::="--force-confold" \
+		nbdkit nbdkit-plugin-dev pkg-config qemu-system-x86 qemu-system-arm qemu-utils \
+		ovmf qemu-efi-aarch64 \
+		libvirt-daemon-system libvirt-clients libvirt-dev make gcc jq curl \
+		iproute2 netcat-openbsd openssh-client wget git unzip sudo xz-utils file \
+		ovn-central ovn-host openvswitch-switch dhcpcd-base

 install-go:
 	@echo -e "\n....Installing Go 1.27.3 for $(ARCH) ($(GO_ARCH))...."
@@ -510,16 +438,14 @@ distro-amd64:
 		-f build/Dockerfile.distro \
 		--output type=local,dest=dist/amd64/ \
 		../
-	@if [ -f $(MICROVM_OUT_DIR)/vmlinuz ] && [ -f $(MICROVM_OUT_DIR)/initramfs.cpio.gz ] && [ -f $(MICROVM_OUT_DIR)/qboot.rom ] && [ -f $(QBOOT_SOURCE) ]; then \
+	@if [ -f $(MICROVM_OUT_DIR)/vmlinuz ] && [ -f $(MICROVM_OUT_DIR)/initramfs.cpio.gz ]; then \
 		echo "[distro-amd64] staging microvm artifacts into tarball"; \
 		mkdir -p dist/amd64/microvm; \
-		cp $(MICROVM_OUT_DIR)/vmlinuz $(MICROVM_OUT_DIR)/initramfs.cpio.gz $(MICROVM_OUT_DIR)/qboot.rom $(MICROVM_OUT_DIR)/qboot.LICENSE dist/amd64/microvm/; \
-		cp $(QBOOT_SOURCE) dist/; \
+		cp $(MICROVM_OUT_DIR)/vmlinuz $(MICROVM_OUT_DIR)/initramfs.cpio.gz dist/amd64/microvm/; \
 	else \
 		echo "[distro-amd64] WARNING: microvm artifacts missing — tarball will not include them"; \
 		echo "[distro-amd64]          run 'make build-microvm-image' before 'make distro-amd64'"; \
 	fi
-	./scripts/lib/stage-sqs-store-microvm.sh $(SQS_WORKER_MICROVM_OUT_DIR) dist/amd64 sqs-worker
 	tar -czf dist/spinifex-$(VERSION)-linux-amd64.tar.gz -C dist/amd64 .
 	sha256sum dist/spinifex-$(VERSION)-linux-amd64.tar.gz > dist/spinifex-$(VERSION)-linux-amd64.tar.gz.sha256

@@ -538,7 +464,7 @@ distro-arm64:
 distro-clean:
 	rm -rf dist/

-.PHONY: test-package-check build build-ui test-ui-e2e ui-e2e-container ui-baselines build-installer build-lb-agent build-ecs-agent build-system-image build-eks-node-image import-eks-node-image publish-eks-node-image build-ecs-node-image import-ecs-node-image build-rds-postgres-image import-rds-postgres-image build-rds-mariadb-image import-rds-mariadb-image build-microvm-image build-sqs-worker-microvm-image build-lambda-runtime-microvm-image install-microvm install-sqs-worker-microvm go_build preflight test test-cover test-race diff-coverage bench fuzz test-actions test-images test-build-scripts test-harness test-integration generate-aws-model-coverage aws-model-coverage test-segscan-oracle \
+.PHONY: test-package-check build build-ui build-installer build-lb-agent build-ecs-agent build-system-image build-eks-node-image import-eks-node-image publish-eks-node-image build-ecs-node-image import-ecs-node-image build-rds-postgres-image import-rds-postgres-image build-rds-mariadb-image import-rds-mariadb-image build-microvm-image install-microvm go_build preflight test test-cover test-race diff-coverage bench fuzz test-actions test-images test-build-scripts test-harness test-integration generate-aws-model-coverage aws-model-coverage test-segscan-oracle manifest-check manifest-lint manifest-lint-update \
 	deploy reinstall clean \
 	install-system install-go install-aws quickinstall \
 	lint fix govulncheck nilaway \
@@ -54,7 +54,7 @@ For Terraform, start from the [example workbooks](https://docs.mulgadc.com/docs/

 ## Services

-The platform serves **405 AWS API operations** across the services below. See exactly which ones in the [coverage report](https://docs.mulgadc.com/coverage).
+The platform serves **392 AWS API operations** across the services below. See exactly which ones in the [coverage report](https://docs.mulgadc.com/coverage).

 | Service | What it is | Built on | Status |
 | --- | --- | --- | --- |
@@ -68,10 +68,8 @@ The platform serves **405 AWS API operations** across the services below. See ex
 | **ECR** | Container registry | Predastore, deduplicated per account | Available |
 | **ECS** | Container service | Spinifex instances | Available |
 | **RDS** | Databases | PostgreSQL and MariaDB, with automated backups | Available |
-| **Route 53** | DNS | [Northstar](https://github.com/mulgadc/northstar): authoritative DNS with hosted zones | Available |
 | **Bedrock** | AI deployment | vLLM for text generation and Hugging Face TEI for embeddings and reranking | Q4 2026 |
 | **Lambda** | Serverless functions | | Q1 2027 |
-| **SQS** | Message queues | | Q1 2027 |

 Roadmap services ship under the same AWS API surface, so code written for AWS today works the moment they land. [Track what's shipped in the release notes](https://github.com/mulgadc/spinifex/releases).

@@ -113,7 +111,7 @@ aws ec2 describe-instance-types
 ## Web Console

 <p align="center">
-  <img src=".github/assets/dashboard.webp" alt="Spinifex web console dashboard" width="900">
+  <img src=".github/assets/spinifex-ui.jpg" alt="Spinifex web console dashboard" width="900">
 </p>

 Spinifex ships with a built-in web console for your instances, volumes, buckets, networks, and IAM. See [Launching the Web UI](https://docs.mulgadc.com/docs/setting-up-your-cluster#7-launching-the-web-ui).
@@ -10,28 +10,28 @@ type allowance struct {
 // docs/PACKAGE_BOUNDARY_MIGRATION.md. It only shrinks: delete an entry as soon
 // as its use is gone, and never add one to make a new consumer pass.
 var allowlist = []allowance{
-	{File: "spinifex/runtime/daemon/daemon.go", Symbol: "daemon.LocalStatePath", Inv: "INV-01"},
-	{File: "spinifex/runtime/daemon/daemon.go", Symbol: "daemon.ReadLocalState", Inv: "INV-01"},
-	{File: "spinifex/runtime/daemon/daemon.go", Symbol: "daemon.MarshalLocalState", Inv: "INV-01"},
-	{File: "spinifex/runtime/daemon/daemon.go", Symbol: "daemon.WriteLocalStateBytes", Inv: "INV-01"},
-	{File: "spinifex/runtime/daemon/daemon.go", Symbol: "JetStreamManager.InitKVBucket", Inv: "INV-02"},
-	{File: "spinifex/runtime/daemon/daemon.go", Symbol: "JetStreamManager.InitTerminatedInstanceBucket", Inv: "INV-02"},
-	{File: "spinifex/runtime/daemon/daemon.go", Symbol: "JetStreamManager.WriteNodeMarkerBestEffort", Inv: "INV-03"},
-	{File: "spinifex/runtime/daemon/daemon.go", Symbol: "JetStreamManager.WriteRunningSet", Inv: "INV-03"},
-	{File: "spinifex/runtime/daemon/instance_record_repair.go", Symbol: "JetStreamManager.WriteRunningSet", Inv: "INV-03"},
-	{File: "spinifex/runtime/daemon/daemon.go", Symbol: "JetStreamManager.ListTerminatedInstances", Inv: "INV-04"},
+	{File: "spinifex/daemon/daemon.go", Symbol: "daemon.LocalStatePath", Inv: "INV-01"},
+	{File: "spinifex/daemon/daemon.go", Symbol: "daemon.ReadLocalState", Inv: "INV-01"},
+	{File: "spinifex/daemon/daemon.go", Symbol: "daemon.MarshalLocalState", Inv: "INV-01"},
+	{File: "spinifex/daemon/daemon.go", Symbol: "daemon.WriteLocalStateBytes", Inv: "INV-01"},
+	{File: "spinifex/daemon/daemon.go", Symbol: "JetStreamManager.InitKVBucket", Inv: "INV-02"},
+	{File: "spinifex/daemon/daemon.go", Symbol: "JetStreamManager.InitTerminatedInstanceBucket", Inv: "INV-02"},
+	{File: "spinifex/daemon/daemon.go", Symbol: "JetStreamManager.WriteNodeMarkerBestEffort", Inv: "INV-03"},
+	{File: "spinifex/daemon/daemon.go", Symbol: "JetStreamManager.WriteRunningSet", Inv: "INV-03"},
+	{File: "spinifex/daemon/instance_record_repair.go", Symbol: "JetStreamManager.WriteRunningSet", Inv: "INV-03"},
+	{File: "spinifex/daemon/daemon.go", Symbol: "JetStreamManager.ListTerminatedInstances", Inv: "INV-04"},

-	{File: "spinifex/runtime/daemon/vm_adapters.go", Symbol: "JetStreamManager.LoadState", Inv: "INV-05"},
-	{File: "spinifex/runtime/daemon/vm_adapters.go", Symbol: "JetStreamManager.WriteStoppedInstance", Inv: "INV-05"},
-	{File: "spinifex/runtime/daemon/vm_adapters.go", Symbol: "JetStreamManager.LoadStoppedInstance", Inv: "INV-05"},
-	{File: "spinifex/runtime/daemon/vm_adapters.go", Symbol: "JetStreamManager.DeleteStoppedInstance", Inv: "INV-05"},
-	{File: "spinifex/runtime/daemon/vm_adapters.go", Symbol: "JetStreamManager.UpdateStoppedInstance", Inv: "INV-05"},
-	{File: "spinifex/runtime/daemon/vm_adapters.go", Symbol: "JetStreamManager.ClaimStoppedInstance", Inv: "INV-05"},
-	{File: "spinifex/runtime/daemon/vm_adapters.go", Symbol: "JetStreamManager.ListStoppedInstances", Inv: "INV-05"},
-	{File: "spinifex/runtime/daemon/vm_adapters.go", Symbol: "JetStreamManager.WriteTerminatedInstance", Inv: "INV-05"},
-	{File: "spinifex/runtime/daemon/vm_adapters.go", Symbol: "JetStreamManager.UpdateTerminatedInstance", Inv: "INV-05"},
-	{File: "spinifex/runtime/daemon/vm_adapters.go", Symbol: "JetStreamManager.ListTerminatedInstances", Inv: "INV-05"},
-	{File: "spinifex/runtime/daemon/vm_adapters.go", Symbol: "JetStreamManager.DeleteTerminatedInstance", Inv: "INV-05"},
+	{File: "spinifex/daemon/vm_adapters.go", Symbol: "JetStreamManager.LoadState", Inv: "INV-05"},
+	{File: "spinifex/daemon/vm_adapters.go", Symbol: "JetStreamManager.WriteStoppedInstance", Inv: "INV-05"},
+	{File: "spinifex/daemon/vm_adapters.go", Symbol: "JetStreamManager.LoadStoppedInstance", Inv: "INV-05"},
+	{File: "spinifex/daemon/vm_adapters.go", Symbol: "JetStreamManager.DeleteStoppedInstance", Inv: "INV-05"},
+	{File: "spinifex/daemon/vm_adapters.go", Symbol: "JetStreamManager.UpdateStoppedInstance", Inv: "INV-05"},
+	{File: "spinifex/daemon/vm_adapters.go", Symbol: "JetStreamManager.ClaimStoppedInstance", Inv: "INV-05"},
+	{File: "spinifex/daemon/vm_adapters.go", Symbol: "JetStreamManager.ListStoppedInstances", Inv: "INV-05"},
+	{File: "spinifex/daemon/vm_adapters.go", Symbol: "JetStreamManager.WriteTerminatedInstance", Inv: "INV-05"},
+	{File: "spinifex/daemon/vm_adapters.go", Symbol: "JetStreamManager.UpdateTerminatedInstance", Inv: "INV-05"},
+	{File: "spinifex/daemon/vm_adapters.go", Symbol: "JetStreamManager.ListTerminatedInstances", Inv: "INV-05"},
+	{File: "spinifex/daemon/vm_adapters.go", Symbol: "JetStreamManager.DeleteTerminatedInstance", Inv: "INV-05"},

 	{File: "spinifex/runtime/compute/vm/migrate.go", Symbol: "JetStreamManager.WriteStoppedInstance", Inv: "INV-06"},
 	{File: "spinifex/runtime/compute/vm/migrate.go", Symbol: "JetStreamManager.WriteTerminatedInstance", Inv: "INV-06"},
@@ -50,23 +50,23 @@ var allowlist = []allowance{
 	{File: "spinifex/domains/ec2/instance/service_impl.go", Symbol: "JetStreamManager.WriteTerminatedInstance", Inv: "INV-07"},
 	{File: "spinifex/domains/ec2/instance/service_impl.go", Symbol: "JetStreamManager.DeleteStoppedInstance", Inv: "INV-07"},

-	{File: "spinifex/runtime/daemon/daemon_handlers_image.go", Symbol: "JetStreamManager.LoadStoppedInstance", Inv: "INV-08"},
-	{File: "spinifex/runtime/daemon/daemon_handlers_image.go", Symbol: "JetStreamManager.UpdateStoppedInstance", Inv: "INV-08"},
+	{File: "spinifex/daemon/daemon_handlers_image.go", Symbol: "JetStreamManager.LoadStoppedInstance", Inv: "INV-08"},
+	{File: "spinifex/daemon/daemon_handlers_image.go", Symbol: "JetStreamManager.UpdateStoppedInstance", Inv: "INV-08"},

-	{File: "spinifex/runtime/daemon/instance_recovery.go", Symbol: "vm.InstanceRecord", Inv: "INV-10"},
-	{File: "spinifex/runtime/daemon/instance_recovery.go", Symbol: "JetStreamManager.ListInstanceRecords", Inv: "INV-10"},
-	{File: "spinifex/runtime/daemon/instance_recovery.go", Symbol: "JetStreamManager.ClaimRecoverableInstance", Inv: "INV-10"},
-	{File: "spinifex/runtime/daemon/instance_recovery.go", Symbol: "JetStreamManager.ReleaseRecoveredInstance", Inv: "INV-10"},
-	{File: "spinifex/runtime/daemon/instance_recovery.go", Symbol: "JetStreamManager.AbandonRecovery", Inv: "INV-10"},
-	{File: "spinifex/runtime/daemon/instance_recovery.go", Symbol: "JetStreamManager.LoadInstanceRecord", Inv: "INV-10"},
+	{File: "spinifex/daemon/instance_recovery.go", Symbol: "vm.InstanceRecord", Inv: "INV-10"},
+	{File: "spinifex/daemon/instance_recovery.go", Symbol: "JetStreamManager.ListInstanceRecords", Inv: "INV-10"},
+	{File: "spinifex/daemon/instance_recovery.go", Symbol: "JetStreamManager.ClaimRecoverableInstance", Inv: "INV-10"},
+	{File: "spinifex/daemon/instance_recovery.go", Symbol: "JetStreamManager.ReleaseRecoveredInstance", Inv: "INV-10"},
+	{File: "spinifex/daemon/instance_recovery.go", Symbol: "JetStreamManager.AbandonRecovery", Inv: "INV-10"},
+	{File: "spinifex/daemon/instance_recovery.go", Symbol: "JetStreamManager.LoadInstanceRecord", Inv: "INV-10"},

-	{File: "spinifex/runtime/daemon/dns_reconcile.go", Symbol: "daemon.InstanceRecordPrefix", Inv: "INV-11"},
-	{File: "spinifex/runtime/daemon/dns_reconcile.go", Symbol: "daemon.InstanceStateBucket", Inv: "INV-11"},
-	{File: "spinifex/runtime/daemon/dns_reconcile.go", Symbol: "JetStreamManager.ListInstanceRecords", Inv: "INV-11"},
+	{File: "spinifex/daemon/dns_reconcile.go", Symbol: "daemon.InstanceRecordPrefix", Inv: "INV-11"},
+	{File: "spinifex/daemon/dns_reconcile.go", Symbol: "daemon.InstanceStateBucket", Inv: "INV-11"},
+	{File: "spinifex/daemon/dns_reconcile.go", Symbol: "JetStreamManager.ListInstanceRecords", Inv: "INV-11"},

-	{File: "spinifex/runtime/daemon/eni_orphan_reaper.go", Symbol: "vm.InstanceRecord", Inv: "INV-12"},
-	{File: "spinifex/runtime/daemon/eni_orphan_reaper.go", Symbol: "JetStreamManager.ListInstanceRecords", Inv: "INV-12"},
-	{File: "spinifex/runtime/daemon/eni_orphan_reaper.go", Symbol: "JetStreamManager.ListTerminatedInstanceRecords", Inv: "INV-12"},
+	{File: "spinifex/daemon/eni_orphan_reaper.go", Symbol: "vm.InstanceRecord", Inv: "INV-12"},
+	{File: "spinifex/daemon/eni_orphan_reaper.go", Symbol: "JetStreamManager.ListInstanceRecords", Inv: "INV-12"},
+	{File: "spinifex/daemon/eni_orphan_reaper.go", Symbol: "JetStreamManager.ListTerminatedInstanceRecords", Inv: "INV-12"},

 	{File: "spinifex/domains/ec2/instance/state/imds_readers.go", Symbol: "daemon.LocalState", Inv: "INV-13"},
 	{File: "spinifex/domains/ec2/instance/state/imds_readers.go", Symbol: "daemon.LocalStatePath", Inv: "INV-13"},
@@ -95,7 +95,7 @@ const faultSource = `package %s
 import (
 	"encoding/json"

-	spxd "github.com/mulgadc/spinifex/spinifex/runtime/daemon"
+	spxd "github.com/mulgadc/spinifex/spinifex/daemon"
 	"github.com/mulgadc/spinifex/spinifex/runtime/compute/vm"
 )

@@ -176,11 +176,11 @@ func TestADR0007_S6_RatchetDetectsFaults(t *testing.T) {
 // must see those too.
 func TestADR0007_S6_RatchetSeesBareIdentifiersInOwnerPackages(t *testing.T) {
 	src := map[string]string{
-		"spinifex/runtime/daemon/new_consumer.go":   "package daemon\n\nfunc f() string { return InstanceStateBucket + LocalStatePath(\"\") }\n",
+		"spinifex/daemon/new_consumer.go":           "package daemon\n\nfunc f() string { return InstanceStateBucket + LocalStatePath(\"\") }\n",
 		"spinifex/runtime/compute/vm/new_reader.go": "package vm\n\nfunc g(r *InstanceRecord) *VM { return VMFromRecord(r) }\n",
 	}
 	want := map[string][]string{
-		"spinifex/runtime/daemon/new_consumer.go":   {"daemon.InstanceStateBucket", "daemon.LocalStatePath"},
+		"spinifex/daemon/new_consumer.go":           {"daemon.InstanceStateBucket", "daemon.LocalStatePath"},
 		"spinifex/runtime/compute/vm/new_reader.go": {"vm.InstanceRecord", "vm.VMFromRecord"},
 	}
 	for rel, code := range src {
@@ -20,9 +20,9 @@ import (
 )

 const (
-	daemonPath = "github.com/mulgadc/spinifex/spinifex/runtime/daemon"
+	daemonPath = "github.com/mulgadc/spinifex/spinifex/daemon"
 	vmPath     = "github.com/mulgadc/spinifex/spinifex/runtime/compute/vm"
-	daemonDir  = "spinifex/runtime/daemon"
+	daemonDir  = "spinifex/daemon"
 	vmDir      = "spinifex/runtime/compute/vm"
 )

@@ -69,12 +69,12 @@ var literals = set(`"spinifex-instance-state"`, `"spinifex-terminated-instances"
 // ownerFiles define the symbols above. They are the implementation being
 // migrated, not consumers of it, and are listed so a deleted one is noticed.
 var ownerFiles = []string{
-	"spinifex/runtime/daemon/instance_membership.go",
-	"spinifex/runtime/daemon/instance_records.go",
-	"spinifex/runtime/daemon/instance_records_migrate.go",
-	"spinifex/runtime/daemon/instance_running_set.go",
-	"spinifex/runtime/daemon/jetstream.go",
-	"spinifex/runtime/daemon/local_state.go",
+	"spinifex/daemon/instance_membership.go",
+	"spinifex/daemon/instance_records.go",
+	"spinifex/daemon/instance_records_migrate.go",
+	"spinifex/daemon/instance_running_set.go",
+	"spinifex/daemon/jetstream.go",
+	"spinifex/daemon/local_state.go",
 	"spinifex/runtime/compute/vm/record.go",
 }

@@ -11,68 +11,62 @@ type allowance struct {
 // docs/PACKAGE_BOUNDARY_MIGRATION.md. It only shrinks: add an edge only with
 // recorded debt, and delete an entry as soon as its import is gone.
 var allowlist = []allowance{
-	{From: "operator/accountlifecycle", To: "domains/ec2/awsapi/eip", Debt: "accountteardown (dependency)", Reason: "EC2 reapers call the awsapi action adapters; needs domain-owned cleanup capabilities"},
-	{From: "operator/accountlifecycle", To: "domains/ec2/awsapi/igw", Debt: "accountteardown (dependency)", Reason: "EC2 reapers call the awsapi action adapters; needs domain-owned cleanup capabilities"},
-	{From: "operator/accountlifecycle", To: "domains/ec2/awsapi/image", Debt: "accountteardown (dependency)", Reason: "EC2 reapers call the awsapi action adapters; needs domain-owned cleanup capabilities"},
-	{From: "operator/accountlifecycle", To: "domains/ec2/awsapi/instance", Debt: "accountteardown (dependency)", Reason: "EC2 reapers call the awsapi action adapters; needs domain-owned cleanup capabilities"},
-	{From: "operator/accountlifecycle", To: "domains/ec2/awsapi/key", Debt: "accountteardown (dependency)", Reason: "EC2 reapers call the awsapi action adapters; needs domain-owned cleanup capabilities"},
-	{From: "operator/accountlifecycle", To: "domains/ec2/awsapi/launchtemplate", Debt: "accountteardown (dependency)", Reason: "EC2 reapers call the awsapi action adapters; needs domain-owned cleanup capabilities"},
-	{From: "operator/accountlifecycle", To: "domains/ec2/awsapi/placementgroup", Debt: "accountteardown (dependency)", Reason: "EC2 reapers call the awsapi action adapters; needs domain-owned cleanup capabilities"},
-	{From: "operator/accountlifecycle", To: "domains/ec2/awsapi/routetable", Debt: "accountteardown (dependency)", Reason: "EC2 reapers call the awsapi action adapters; needs domain-owned cleanup capabilities"},
-	{From: "operator/accountlifecycle", To: "domains/ec2/awsapi/snapshot", Debt: "accountteardown (dependency)", Reason: "EC2 reapers call the awsapi action adapters; needs domain-owned cleanup capabilities"},
-	{From: "operator/accountlifecycle", To: "domains/ec2/awsapi/volume", Debt: "accountteardown (dependency)", Reason: "EC2 reapers call the awsapi action adapters; needs domain-owned cleanup capabilities"},
-	{From: "operator/accountlifecycle", To: "domains/ec2/awsapi/vpc", Debt: "accountteardown (dependency)", Reason: "EC2 reapers call the awsapi action adapters; needs domain-owned cleanup capabilities"},
+	{From: "accountteardown", To: "domains/ec2/awsapi/eip", Debt: "accountteardown (dependency)", Reason: "EC2 reapers call the awsapi action adapters; needs domain-owned cleanup capabilities"},
+	{From: "accountteardown", To: "domains/ec2/awsapi/igw", Debt: "accountteardown (dependency)", Reason: "EC2 reapers call the awsapi action adapters; needs domain-owned cleanup capabilities"},
+	{From: "accountteardown", To: "domains/ec2/awsapi/image", Debt: "accountteardown (dependency)", Reason: "EC2 reapers call the awsapi action adapters; needs domain-owned cleanup capabilities"},
+	{From: "accountteardown", To: "domains/ec2/awsapi/instance", Debt: "accountteardown (dependency)", Reason: "EC2 reapers call the awsapi action adapters; needs domain-owned cleanup capabilities"},
+	{From: "accountteardown", To: "domains/ec2/awsapi/key", Debt: "accountteardown (dependency)", Reason: "EC2 reapers call the awsapi action adapters; needs domain-owned cleanup capabilities"},
+	{From: "accountteardown", To: "domains/ec2/awsapi/launchtemplate", Debt: "accountteardown (dependency)", Reason: "EC2 reapers call the awsapi action adapters; needs domain-owned cleanup capabilities"},
+	{From: "accountteardown", To: "domains/ec2/awsapi/placementgroup", Debt: "accountteardown (dependency)", Reason: "EC2 reapers call the awsapi action adapters; needs domain-owned cleanup capabilities"},
+	{From: "accountteardown", To: "domains/ec2/awsapi/routetable", Debt: "accountteardown (dependency)", Reason: "EC2 reapers call the awsapi action adapters; needs domain-owned cleanup capabilities"},
+	{From: "accountteardown", To: "domains/ec2/awsapi/snapshot", Debt: "accountteardown (dependency)", Reason: "EC2 reapers call the awsapi action adapters; needs domain-owned cleanup capabilities"},
+	{From: "accountteardown", To: "domains/ec2/awsapi/volume", Debt: "accountteardown (dependency)", Reason: "EC2 reapers call the awsapi action adapters; needs domain-owned cleanup capabilities"},
+	{From: "accountteardown", To: "domains/ec2/awsapi/vpc", Debt: "accountteardown (dependency)", Reason: "EC2 reapers call the awsapi action adapters; needs domain-owned cleanup capabilities"},

-	{From: "agents/ecs/agent", To: "domains/ecs", Debt: "agents/ecs/agent", Reason: "assignment/state wire types from the ECS implementation; needs a guest/controller contract"},
+	{From: "agents/ecs/agent", To: "handlers/ecs", Debt: "agents/ecs/agent", Reason: "assignment/state wire types from the ECS implementation; needs a guest/controller contract"},

-	{From: "agents/eks/tokenwebhook", To: "domains/eks/cluster", Debt: "agents/eks/tokenwebhook", Reason: "WebhookTokenReviewResult from the EKS implementation; needs an EKS contract or projection"},
+	{From: "agents/eks/tokenwebhook", To: "handlers/eks", Debt: "agents/eks/tokenwebhook", Reason: "WebhookTokenReviewResult from the EKS implementation; needs an EKS contract or projection"},

-	{From: "agents/rds/agent", To: "domains/rds/instance", Debt: "agents/rds/agent (dependency, narrowed)", Reason: "command protocol, wire and record types; needs a guest/controller wire contract"},
+	{From: "agents/rds/agent", To: "handlers/rds", Debt: "agents/rds/agent (dependency, narrowed)", Reason: "command protocol, wire and record types; needs a guest/controller wire contract"},

-	{From: "cmd/aws-model-coverage", To: "domains/acm/awsapi", Debt: "cmd/aws-model-coverage", Reason: "reads declared service inventories; named exception, must not construct a registration"},
-	{From: "cmd/aws-model-coverage", To: "domains/ecr/awsapi", Debt: "cmd/aws-model-coverage", Reason: "reads declared service inventories; named exception, must not construct a registration"},
-	{From: "cmd/aws-model-coverage", To: "domains/route53/awsapi", Debt: "cmd/aws-model-coverage", Reason: "reads declared service inventories; named exception, must not construct a registration"},
-	{From: "cmd/aws-model-coverage", To: "domains/elbv2/awsapi", Debt: "cmd/aws-model-coverage", Reason: "reads declared service inventories; named exception, must not construct a registration"},
-	{From: "cmd/aws-model-coverage", To: "domains/rds/awsapi", Debt: "cmd/aws-model-coverage", Reason: "reads declared service inventories; named exception, must not construct a registration"},
-	{From: "cmd/aws-model-coverage", To: "domains/ec2/awsapi", Debt: "cmd/aws-model-coverage", Reason: "reads declared service inventories; named exception, must not construct a registration"},
-	{From: "cmd/aws-model-coverage", To: "domains/ecs/awsapi", Debt: "cmd/aws-model-coverage", Reason: "reads declared service inventories; named exception, must not construct a registration"},
-	{From: "cmd/aws-model-coverage", To: "domains/eks/awsapi", Debt: "cmd/aws-model-coverage", Reason: "reads declared service inventories; named exception, must not construct a registration"},
-	{From: "cmd/aws-model-coverage", To: "domains/iam/awsapi", Debt: "cmd/aws-model-coverage", Reason: "reads declared service inventories; named exception, must not construct a registration"},
-	{From: "cmd/aws-model-coverage", To: "domains/sqs/awsapi", Debt: "cmd/aws-model-coverage", Reason: "reads declared service inventories; named exception, must not construct a registration"},
-	{From: "cmd/aws-model-coverage", To: "domains/sts/awsapi", Debt: "cmd/aws-model-coverage", Reason: "reads declared service inventories; named exception, must not construct a registration"},
+	{From: "cmd/aws-model-coverage", To: "domains/acm/awsapi", Debt: "cmd/aws-model-coverage", Reason: "reads declared ECR/ACM inventories; named exception, must not construct a registration"},
+	{From: "cmd/aws-model-coverage", To: "domains/ecr/awsapi", Debt: "cmd/aws-model-coverage", Reason: "reads declared ECR/ACM inventories; named exception, must not construct a registration"},

-	{From: "runtime/daemon", To: "domains/ec2/awsapi/instance", Debt: "Instance adapter consumers outside EC2", Reason: "runtime/daemon/eks_cp_control.go and rds_deps.go call the instance adapter; needs an EC2 capability"},
+	{From: "daemon", To: "domains/ec2/awsapi/instance", Debt: "Instance adapter consumers outside EC2", Reason: "daemon/eks_cp_control.go and rds_deps.go call the instance adapter; needs an EC2 capability"},

-	{From: "domains/acm", To: "domains/iam", Debt: "ACM: the IAM AES-GCM helper import (ACM relocation residual)", Reason: "IAM AES-GCM helpers; needs a shared crypto boundary"},
+	{From: "domains/acm", To: "handlers/iam", Debt: "ACM: the IAM AES-GCM helper import (ACM relocation residual)", Reason: "IAM AES-GCM helpers; needs a shared crypto boundary"},

 	{From: "domains/admission/quota", To: "domains/ec2/awsapi/eip", Debt: "domains/admission/quota (dependency, moved from handlers/quota unchanged)", Reason: "describe adapter used as a counter; needs a reader capability"},
 	{From: "domains/admission/quota", To: "domains/ec2/awsapi/instance", Debt: "domains/admission/quota (dependency, moved from handlers/quota unchanged)", Reason: "vcpu.go counts instances through the instance adapter; needs an EC2 reader capability"},
 	{From: "domains/admission/quota", To: "domains/ec2/awsapi/volume", Debt: "domains/admission/quota (dependency, moved from handlers/quota unchanged)", Reason: "describe adapter used as a counter; needs a reader capability"},
 	{From: "domains/admission/quota", To: "domains/ec2/awsapi/vpc", Debt: "domains/admission/quota (dependency, moved from handlers/quota unchanged)", Reason: "describe adapter used as a counter; needs a reader capability"},
 	{From: "domains/admission/quota", To: "domains/ec2/instancetypes", Debt: "domains/admission/quota → domains/ec2/instancetypes", Reason: "DefaultVCPUs sizing; needs a consumer-owned capability or EC2 projection"},
-	{From: "domains/admission/quota", To: "domains/elbv2/awsapi", Debt: "domains/admission/quota (dependency, moved from handlers/quota unchanged)", Reason: "live ELBv2 counter; needs a reader capability"},
-	{From: "domains/admission/quota", To: "domains/rds/instance", Debt: "domains/admission/quota (dependency, moved from handlers/quota unchanged)", Reason: "live RDS counter; needs a reader capability"},
+	{From: "domains/admission/quota", To: "gateway/elbv2", Debt: "domains/admission/quota (dependency, moved from handlers/quota unchanged)", Reason: "live ELBv2 counter; needs a reader capability"},
+	{From: "domains/admission/quota", To: "handlers/rds", Debt: "domains/admission/quota (dependency, moved from handlers/quota unchanged)", Reason: "live RDS counter; needs a reader capability"},
 	{From: "domains/admission/quota", To: "runtime/compute/vm", Debt: "domains/admission/quota (dependency, moved from handlers/quota unchanged)", Reason: "instance-record vCPU sweep; needs a reader capability"},

 	{From: "domains/dns", To: "domains/network/reconcile", Debt: "domains/dns", Reason: "takes the reconcile lock from network's implementation"},
 	{From: "domains/dns", To: "runtime/compute/vm", Debt: "domains/dns", Reason: "domain-to-runtime import of VM state"},

-	{From: "domains/ec2/awsapi/instance", To: "domains/iam", Debt: "domains/ec2/awsapi/instance (dependency)", Reason: "IAM edge needs an IAM capability"},
+	{From: "domains/ec2/awsapi/instance", To: "handlers/iam", Debt: "domains/ec2/awsapi/instance (dependency)", Reason: "IAM edge needs an IAM capability"},
 	{From: "domains/ec2/awsapi/instance", To: "runtime/compute/cache", Debt: "domains/ec2/awsapi/instance (dependency)", Reason: "node liveness and VM state; needs an EC2-owned projection"},
 	{From: "domains/ec2/awsapi/instance", To: "runtime/compute/vm", Debt: "domains/ec2/awsapi/instance (dependency)", Reason: "node liveness and VM state; needs an EC2-owned projection"},

+	{From: "domains/ec2/awsapi/spotinstance", To: "domains/admission/quota", Debt: "domains/ec2/awsapi/spotinstance (dependency)", Reason: "RequestSpotInstances.go uses IAMService and quota.Service"},
+	{From: "domains/ec2/awsapi/spotinstance", To: "handlers/iam", Debt: "domains/ec2/awsapi/spotinstance (dependency)", Reason: "RequestSpotInstances.go uses IAMService and quota.Service"},
+
 	{From: "domains/ec2/eip", To: "domains/network/topology", Debt: "EC2 → network implementation", Reason: "EC2 reads network implementation; clears with the EC2-owned projection"},

 	{From: "domains/ec2/guestmetadata", To: "domains/dns", Debt: "Guest metadata: the cross-domain and runtime imports above", Reason: "guest-metadata relocation residual; needs capabilities, projections or contracts"},
-	{From: "domains/ec2/guestmetadata", To: "domains/iam", Debt: "Guest metadata: the cross-domain and runtime imports above", Reason: "guest-metadata relocation residual; needs capabilities, projections or contracts"},
-	{From: "domains/ec2/guestmetadata", To: "domains/sts", Debt: "Guest metadata: the cross-domain and runtime imports above", Reason: "guest-metadata relocation residual; needs capabilities, projections or contracts"},
+	{From: "domains/ec2/guestmetadata", To: "handlers/iam", Debt: "Guest metadata: the cross-domain and runtime imports above", Reason: "guest-metadata relocation residual; needs capabilities, projections or contracts"},
+	{From: "domains/ec2/guestmetadata", To: "handlers/sts", Debt: "Guest metadata: the cross-domain and runtime imports above", Reason: "guest-metadata relocation residual; needs capabilities, projections or contracts"},
 	{From: "domains/ec2/guestmetadata", To: "runtime/compute/vm", Debt: "Guest metadata: the cross-domain and runtime imports above", Reason: "guest-metadata relocation residual; needs capabilities, projections or contracts"},

 	{From: "domains/ec2/instance", To: "domains/dns", Debt: "domains/ec2/instance", Reason: "cross-domain implementation import of DNS"},
 	{From: "domains/ec2/instance", To: "domains/network/topology", Debt: "EC2 → network implementation", Reason: "EC2 reads network implementation; clears with the EC2-owned projection"},
 	{From: "domains/ec2/instance", To: "runtime/compute/gpu", Debt: "domains/ec2/instance", Reason: "VM/GPU runtime state read directly; needs a domain-owned projection"},
 	{From: "domains/ec2/instance", To: "runtime/compute/vm", Debt: "domains/ec2/instance", Reason: "VM/GPU runtime state read directly; needs a domain-owned projection"},
-	{From: "domains/ec2/instance/state", To: "runtime/daemon", Debt: "domains/ec2/instance/state (dependency, IMDS readers)", Reason: "wraps the daemon's local-file reader and JetStreamManager bucket open unchanged for vpcd's IMDS lookup"},
+	{From: "domains/ec2/instance/state", To: "daemon", Debt: "domains/ec2/instance/state (dependency, IMDS readers)", Reason: "wraps the daemon's local-file reader and JetStreamManager bucket open unchanged for vpcd's IMDS lookup"},
 	{From: "domains/ec2/instance/state", To: "runtime/compute/vm", Debt: "domains/ec2/instance/state (dependency)", Reason: "the vpcd IMDS local reader returns vm.VM"},

 	{From: "domains/ec2/volume", To: "runtime/compute/vm", Debt: "Domain → runtime", Reason: "VM runtime state read directly; needs a domain-owned projection"},
@@ -82,7 +76,7 @@ var allowlist = []allowance{
 	{From: "domains/ec2/vpc", To: "domains/network/identifiers", Debt: "EC2 → network implementation", Reason: "EC2 reads network implementation; clears with the EC2-owned projection"},
 	{From: "domains/ec2/vpc", To: "domains/network/topology", Debt: "EC2 → network implementation", Reason: "EC2 reads network implementation; clears with the EC2-owned projection"},

-	{From: "domains/ecr/auth", To: "domains/iam", Debt: "Cross-domain", Reason: "IAM implementation import; needs an IAM capability"},
+	{From: "domains/ecr/auth", To: "handlers/iam", Debt: "Cross-domain", Reason: "IAM implementation import; needs an IAM capability"},

 	{From: "domains/network/host", To: "runtime/compute/vm", Debt: "domains/network", Reason: "domain-to-runtime import"},
 	{From: "domains/network/host", To: "runtime/host/command", Debt: "domains/network", Reason: "domain-to-runtime import"},
@@ -95,46 +89,76 @@ var allowlist = []allowance{
 	{From: "domains/network/reconcile", To: "runtime/compute/vm", Debt: "domains/network", Reason: "domain-to-runtime import"},

 	{From: "domains/ochre", To: "domains/ec2/systeminstance", Debt: "Cross-domain", Reason: "consumes another domain's implementation rather than a capability"},
-	{From: "domains/ochre", To: "domains/iam", Debt: "IAM implementation consumers in STS, Ochre and ELBv2", Reason: "secret encrypt/decrypt helpers; needs a shared crypto boundary"},
 	{From: "domains/ochre", To: "domains/network/systemvpc", Debt: "Cross-domain", Reason: "consumes another domain's implementation rather than a capability"},
+	{From: "domains/ochre", To: "gateway/bedrock", Debt: "gateway/bedrock", Reason: "Ochre domain core still lives in gateway/bedrock; needs the recorded split"},
 	{From: "domains/ochre", To: "runtime/compute/gpu", Debt: "Domain → runtime", Reason: "GPU runtime state read directly; needs a domain-owned projection"},

-	{From: "domains/ochre/vector", To: "domains/iam", Debt: "Cross-domain", Reason: "consumes another domain's implementation rather than a capability"},
+	{From: "domains/ochre/vector", To: "handlers/iam", Debt: "Cross-domain", Reason: "consumes another domain's implementation rather than a capability"},

-	{From: "domains/rds/awsapi", To: "domains/ec2/awsapi/instance", Debt: "Instance adapter consumers outside EC2", Reason: "enginecatalog.go calls the instance adapter; needs an EC2 capability"},
+	{From: "gateway", To: "domains/ec2/awsapi", Debt: "gateway/ec2.go (registration)", Reason: "EC2 dispatch map stays in gateway until the ingress registration seam"},
+	{From: "gateway", To: "domains/ec2/awsapi/account", Debt: "gateway/ec2.go (registration)", Reason: "EC2 dispatch map stays in gateway until the ingress registration seam"},
+	{From: "gateway", To: "domains/ec2/awsapi/capacityreservation", Debt: "gateway/ec2.go (registration)", Reason: "EC2 dispatch map stays in gateway until the ingress registration seam"},
+	{From: "gateway", To: "domains/ec2/awsapi/eigw", Debt: "gateway/ec2.go (registration)", Reason: "EC2 dispatch map stays in gateway until the ingress registration seam"},
+	{From: "gateway", To: "domains/ec2/awsapi/eip", Debt: "gateway/ec2.go (registration)", Reason: "EC2 dispatch map stays in gateway until the ingress registration seam"},
+	{From: "gateway", To: "domains/ec2/awsapi/idem", Debt: "gateway/ec2.go (registration; ec2_idempotency.go)", Reason: "dispatch-time idempotency wrapper; moves with the EC2 dispatch map"},
+	{From: "gateway", To: "domains/ec2/awsapi/igw", Debt: "gateway/ec2.go (registration)", Reason: "EC2 dispatch map stays in gateway until the ingress registration seam"},
+	{From: "gateway", To: "domains/ec2/awsapi/image", Debt: "gateway/ec2.go (registration)", Reason: "EC2 dispatch map stays in gateway until the ingress registration seam"},
+	{From: "gateway", To: "domains/ec2/awsapi/instance", Debt: "gateway/ec2.go (registration)", Reason: "EC2 dispatch map stays in gateway until the ingress registration seam"},
+	{From: "gateway", To: "domains/ec2/awsapi/key", Debt: "gateway/ec2.go (registration)", Reason: "EC2 dispatch map stays in gateway until the ingress registration seam"},
+	{From: "gateway", To: "domains/ec2/awsapi/launchtemplate", Debt: "gateway/ec2.go (registration)", Reason: "EC2 dispatch map stays in gateway until the ingress registration seam"},
+	{From: "gateway", To: "domains/ec2/awsapi/natgw", Debt: "gateway/ec2.go (registration)", Reason: "EC2 dispatch map stays in gateway until the ingress registration seam"},
+	{From: "gateway", To: "domains/ec2/awsapi/placementgroup", Debt: "gateway/ec2.go (registration)", Reason: "EC2 dispatch map stays in gateway until the ingress registration seam"},
+	{From: "gateway", To: "domains/ec2/awsapi/routetable", Debt: "gateway/ec2.go (registration)", Reason: "EC2 dispatch map stays in gateway until the ingress registration seam"},
+	{From: "gateway", To: "domains/ec2/awsapi/snapshot", Debt: "gateway/ec2.go (registration)", Reason: "EC2 dispatch map stays in gateway until the ingress registration seam"},
+	{From: "gateway", To: "domains/ec2/awsapi/spotinstance", Debt: "gateway/ec2.go (registration)", Reason: "EC2 dispatch map stays in gateway until the ingress registration seam"},
+	{From: "gateway", To: "domains/ec2/awsapi/tags", Debt: "gateway/ec2.go (registration)", Reason: "EC2 dispatch map stays in gateway until the ingress registration seam"},
+	{From: "gateway", To: "domains/ec2/awsapi/volume", Debt: "gateway/ec2.go (registration)", Reason: "EC2 dispatch map stays in gateway until the ingress registration seam"},
+	{From: "gateway", To: "domains/ec2/awsapi/vpc", Debt: "gateway/ec2.go (registration)", Reason: "EC2 dispatch map stays in gateway until the ingress registration seam"},
+	{From: "gateway", To: "domains/ec2/awsapi/zone", Debt: "gateway/ec2.go (registration)", Reason: "EC2 dispatch map stays in gateway until the ingress registration seam"},

-	{From: "domains/sts/awsapi", To: "domains/iam", Debt: "IAM implementation consumers in STS, Ochre and ELBv2", Reason: "GetCallerIdentity takes IAMService; needs an IAM capability"},
+	{From: "gateway/bedrock", To: "handlers/iam", Debt: "IAM implementation consumers in STS, Ochre and ELBv2", Reason: "secret encrypt/decrypt helpers; needs a shared crypto boundary"},

-	{From: "domains/ecs", To: "domains/ec2/ebs/metadata", Debt: "close-out: handlers/ecs (ADR-0004 blocked-dependency list; inventory-ecs boundary imports)", Reason: "legacy ECS calls another domain's implementation as an internal API"},
-	{From: "domains/ecs", To: "domains/ec2/eip", Debt: "close-out: handlers/ecs (ADR-0004 blocked-dependency list; inventory-ecs boundary imports)", Reason: "legacy ECS calls another domain's implementation as an internal API"},
-	{From: "domains/ecs", To: "domains/ec2/instancetypes", Debt: "close-out: handlers/ecs (ADR-0004 blocked-dependency list; inventory-ecs boundary imports)", Reason: "legacy ECS calls another domain's implementation as an internal API"},
-	{From: "domains/ecs", To: "domains/elbv2", Debt: "close-out: handlers/ecs (ADR-0004 blocked-dependency list; inventory-ecs boundary imports)", Reason: "legacy ECS calls another domain's implementation as an internal API"},
-	{From: "domains/ecs", To: "domains/iam", Debt: "close-out: handlers/ecs (ADR-0004 blocked-dependency list; inventory-ecs boundary imports)", Reason: "legacy ECS calls another domain's implementation as an internal API"},
+	{From: "gateway/rds", To: "domains/ec2/awsapi/instance", Debt: "Instance adapter consumers outside EC2", Reason: "enginecatalog.go calls the instance adapter; needs an EC2 capability"},

-	{From: "domains/eks/cluster", To: "domains/dns", Debt: "close-out: handlers/eks (ADR-0004 blocked-dependency list; inventory-eks boundary imports)", Reason: "legacy EKS calls another domain's or runtime implementation directly"},
-	{From: "domains/eks/cluster", To: "domains/ec2/ebs/metadata", Debt: "close-out: handlers/eks (ADR-0004 blocked-dependency list; inventory-eks boundary imports)", Reason: "legacy EKS calls another domain's or runtime implementation directly"},
-	{From: "domains/eks/cluster", To: "domains/ec2/instancetypes", Debt: "close-out: handlers/eks (ADR-0004 blocked-dependency list; inventory-eks boundary imports)", Reason: "legacy EKS calls another domain's or runtime implementation directly"},
-	{From: "domains/eks/cluster", To: "domains/ec2/placementgroup", Debt: "close-out: handlers/eks (ADR-0004 blocked-dependency list; inventory-eks boundary imports)", Reason: "legacy EKS calls another domain's or runtime implementation directly"},
-	{From: "domains/eks/cluster", To: "domains/ec2/systeminstance", Debt: "close-out: handlers/eks (ADR-0004 blocked-dependency list; inventory-eks boundary imports)", Reason: "legacy EKS calls another domain's or runtime implementation directly"},
-	{From: "domains/eks/cluster", To: "domains/network/systemvpc", Debt: "close-out: handlers/eks (ADR-0004 blocked-dependency list; inventory-eks boundary imports)", Reason: "legacy EKS calls another domain's or runtime implementation directly"},
-	{From: "domains/eks/cluster", To: "domains/iam", Debt: "close-out: handlers/eks (ADR-0004 blocked-dependency list; inventory-eks boundary imports)", Reason: "legacy EKS calls another domain's or runtime implementation directly"},
-	{From: "domains/eks/cluster", To: "runtime/compute/vm", Debt: "close-out: handlers/eks (ADR-0004 blocked-dependency list; inventory-eks boundary imports)", Reason: "legacy EKS calls another domain's or runtime implementation directly"},
+	{From: "gateway/sts", To: "handlers/iam", Debt: "IAM implementation consumers in STS, Ochre and ELBv2", Reason: "GetCallerIdentity takes IAMService; needs an IAM capability"},

-	{From: "domains/elbv2", To: "domains/acm", Debt: "domains/elbv2 (cross-domain)", Reason: "ELBv2 cross-domain import; clears when ELBv2 is extracted behind consumer-owned capabilities"},
-	{From: "domains/elbv2", To: "domains/dns", Debt: "domains/elbv2 (cross-domain)", Reason: "ELBv2 cross-domain import; clears when ELBv2 is extracted behind consumer-owned capabilities"},
-	{From: "domains/elbv2", To: "domains/ec2/systeminstance", Debt: "domains/elbv2 (cross-domain)", Reason: "ELBv2 cross-domain import; clears when ELBv2 is extracted behind consumer-owned capabilities"},
-	{From: "domains/elbv2", To: "domains/ec2/vpc", Debt: "domains/elbv2 (cross-domain)", Reason: "ELBv2 cross-domain import; clears when ELBv2 is extracted behind consumer-owned capabilities"},
-	{From: "domains/elbv2", To: "domains/network/topology", Debt: "domains/elbv2 (cross-domain)", Reason: "ELBv2 cross-domain import; clears when ELBv2 is extracted behind consumer-owned capabilities"},
-	{From: "domains/elbv2", To: "domains/iam", Debt: "IAM implementation consumers in STS, Ochre and ELBv2", Reason: "system-instance role ensurer; needs an IAM capability"},
-	{From: "domains/elbv2", To: "agents/elbv2", Debt: "domains/elbv2/{agent_types,haproxy,health_checker,nginx}.go import lbagent", Reason: "health-report and cert/PID-path vocabulary; needs a guest/controller contract"},
+	{From: "handlers/ecs", To: "domains/ec2/ebs/metadata", Debt: "close-out: handlers/ecs (ADR-0004 blocked-dependency list; inventory-ecs boundary imports)", Reason: "legacy ECS calls another domain's implementation as an internal API"},
+	{From: "handlers/ecs", To: "domains/ec2/eip", Debt: "close-out: handlers/ecs (ADR-0004 blocked-dependency list; inventory-ecs boundary imports)", Reason: "legacy ECS calls another domain's implementation as an internal API"},
+	{From: "handlers/ecs", To: "domains/ec2/instancetypes", Debt: "close-out: handlers/ecs (ADR-0004 blocked-dependency list; inventory-ecs boundary imports)", Reason: "legacy ECS calls another domain's implementation as an internal API"},
+	{From: "handlers/ecs", To: "handlers/elbv2", Debt: "close-out: handlers/ecs (ADR-0004 blocked-dependency list; inventory-ecs boundary imports)", Reason: "legacy ECS calls another domain's implementation as an internal API"},
+	{From: "handlers/ecs", To: "handlers/iam", Debt: "close-out: handlers/ecs (ADR-0004 blocked-dependency list; inventory-ecs boundary imports)", Reason: "legacy ECS calls another domain's implementation as an internal API"},

-	{From: "domains/rds/instance", To: "domains/dns", Debt: "close-out: handlers/rds (ADR-0004 blocked-dependency list; inventory-rds boundary imports)", Reason: "legacy RDS calls another domain's or runtime implementation directly"},
-	{From: "domains/rds/instance", To: "domains/ec2/instance", Debt: "close-out: handlers/rds (ADR-0004 blocked-dependency list; inventory-rds boundary imports)", Reason: "legacy RDS calls another domain's or runtime implementation directly"},
-	{From: "domains/rds/instance", To: "domains/ec2/instancetypes", Debt: "close-out: handlers/rds (ADR-0004 blocked-dependency list; inventory-rds boundary imports)", Reason: "legacy RDS calls another domain's or runtime implementation directly"},
-	{From: "domains/rds/instance", To: "domains/ec2/systeminstance", Debt: "close-out: handlers/rds (ADR-0004 blocked-dependency list; inventory-rds boundary imports)", Reason: "legacy RDS calls another domain's or runtime implementation directly"},
-	{From: "domains/rds/instance", To: "domains/network/systemvpc", Debt: "close-out: handlers/rds (ADR-0004 blocked-dependency list; inventory-rds boundary imports)", Reason: "legacy RDS calls another domain's or runtime implementation directly"},
-	{From: "domains/rds/instance", To: "domains/iam", Debt: "close-out: handlers/rds (ADR-0004 blocked-dependency list; inventory-rds boundary imports)", Reason: "legacy RDS calls another domain's or runtime implementation directly"},
-	{From: "domains/rds/instance", To: "runtime/compute/vm", Debt: "close-out: handlers/rds (ADR-0004 blocked-dependency list; inventory-rds boundary imports)", Reason: "legacy RDS calls another domain's or runtime implementation directly"},
+	{From: "handlers/eks", To: "domains/dns", Debt: "close-out: handlers/eks (ADR-0004 blocked-dependency list; inventory-eks boundary imports)", Reason: "legacy EKS calls another domain's or runtime implementation directly"},
+	{From: "handlers/eks", To: "domains/ec2/ebs/metadata", Debt: "close-out: handlers/eks (ADR-0004 blocked-dependency list; inventory-eks boundary imports)", Reason: "legacy EKS calls another domain's or runtime implementation directly"},
+	{From: "handlers/eks", To: "domains/ec2/instancetypes", Debt: "close-out: handlers/eks (ADR-0004 blocked-dependency list; inventory-eks boundary imports)", Reason: "legacy EKS calls another domain's or runtime implementation directly"},
+	{From: "handlers/eks", To: "domains/ec2/placementgroup", Debt: "close-out: handlers/eks (ADR-0004 blocked-dependency list; inventory-eks boundary imports)", Reason: "legacy EKS calls another domain's or runtime implementation directly"},
+	{From: "handlers/eks", To: "domains/ec2/systeminstance", Debt: "close-out: handlers/eks (ADR-0004 blocked-dependency list; inventory-eks boundary imports)", Reason: "legacy EKS calls another domain's or runtime implementation directly"},
+	{From: "handlers/eks", To: "domains/network/systemvpc", Debt: "close-out: handlers/eks (ADR-0004 blocked-dependency list; inventory-eks boundary imports)", Reason: "legacy EKS calls another domain's or runtime implementation directly"},
+	{From: "handlers/eks", To: "handlers/iam", Debt: "close-out: handlers/eks (ADR-0004 blocked-dependency list; inventory-eks boundary imports)", Reason: "legacy EKS calls another domain's or runtime implementation directly"},
+	{From: "handlers/eks", To: "runtime/compute/vm", Debt: "close-out: handlers/eks (ADR-0004 blocked-dependency list; inventory-eks boundary imports)", Reason: "legacy EKS calls another domain's or runtime implementation directly"},

-	{From: "domains/sts", To: "domains/iam", Debt: "IAM implementation consumers in STS, Ochre and ELBv2", Reason: "STS reads IAM service, trust-policy and OIDC-provider state; needs an IAM capability"},
+	{From: "handlers/elbv2", To: "domains/acm", Debt: "handlers/elbv2 (cross-domain)", Reason: "legacy ELBv2 cross-domain import; clears when ELBv2 is extracted behind consumer-owned capabilities"},
+	{From: "handlers/elbv2", To: "domains/dns", Debt: "handlers/elbv2 (cross-domain)", Reason: "legacy ELBv2 cross-domain import; clears when ELBv2 is extracted behind consumer-owned capabilities"},
+	{From: "handlers/elbv2", To: "domains/ec2/systeminstance", Debt: "handlers/elbv2 (cross-domain)", Reason: "legacy ELBv2 cross-domain import; clears when ELBv2 is extracted behind consumer-owned capabilities"},
+	{From: "handlers/elbv2", To: "domains/ec2/vpc", Debt: "handlers/elbv2 (cross-domain)", Reason: "legacy ELBv2 cross-domain import; clears when ELBv2 is extracted behind consumer-owned capabilities"},
+	{From: "handlers/elbv2", To: "domains/network/topology", Debt: "handlers/elbv2 (cross-domain)", Reason: "legacy ELBv2 cross-domain import; clears when ELBv2 is extracted behind consumer-owned capabilities"},
+	{From: "handlers/elbv2", To: "handlers/iam", Debt: "IAM implementation consumers in STS, Ochre and ELBv2", Reason: "system-instance role ensurer; needs an IAM capability"},
+	{From: "handlers/elbv2", To: "lbagent", Debt: "handlers/elbv2/{agent_types,haproxy,health_checker,nginx}.go import lbagent", Reason: "health-report and cert/PID-path vocabulary; needs a guest/controller contract"},
+
+	{From: "handlers/rds", To: "domains/dns", Debt: "close-out: handlers/rds (ADR-0004 blocked-dependency list; inventory-rds boundary imports)", Reason: "legacy RDS calls another domain's or runtime implementation directly"},
+	{From: "handlers/rds", To: "domains/ec2/instance", Debt: "close-out: handlers/rds (ADR-0004 blocked-dependency list; inventory-rds boundary imports)", Reason: "legacy RDS calls another domain's or runtime implementation directly"},
+	{From: "handlers/rds", To: "domains/ec2/instancetypes", Debt: "close-out: handlers/rds (ADR-0004 blocked-dependency list; inventory-rds boundary imports)", Reason: "legacy RDS calls another domain's or runtime implementation directly"},
+	{From: "handlers/rds", To: "domains/ec2/systeminstance", Debt: "close-out: handlers/rds (ADR-0004 blocked-dependency list; inventory-rds boundary imports)", Reason: "legacy RDS calls another domain's or runtime implementation directly"},
+	{From: "handlers/rds", To: "domains/network/systemvpc", Debt: "close-out: handlers/rds (ADR-0004 blocked-dependency list; inventory-rds boundary imports)", Reason: "legacy RDS calls another domain's or runtime implementation directly"},
+	{From: "handlers/rds", To: "handlers/iam", Debt: "close-out: handlers/rds (ADR-0004 blocked-dependency list; inventory-rds boundary imports)", Reason: "legacy RDS calls another domain's or runtime implementation directly"},
+	{From: "handlers/rds", To: "runtime/compute/vm", Debt: "close-out: handlers/rds (ADR-0004 blocked-dependency list; inventory-rds boundary imports)", Reason: "legacy RDS calls another domain's or runtime implementation directly"},
+
+	{From: "handlers/sts", To: "handlers/iam", Debt: "IAM implementation consumers in STS, Ochre and ELBv2", Reason: "STS reads IAM service, trust-policy and OIDC-provider state; needs an IAM capability"},
+
+	{From: "operator/cli", To: "accountteardown", Debt: "operator/cli (dependency)", Reason: "command tree imports implementations; needs public capabilities"},
+	{From: "operator/cli", To: "daemon", Debt: "operator/cli (dependency)", Reason: "command tree imports implementations; needs public capabilities"},
+	{From: "operator/cli", To: "gateway", Debt: "operator/cli (dependency)", Reason: "command tree imports implementations; needs public capabilities"},
+	{From: "operator/cli", To: "gateway/bedrock", Debt: "operator/cli (dependency)", Reason: "command tree imports implementations; needs public capabilities"},
+	{From: "operator/cli", To: "handlers/eks", Debt: "operator/cli (dependency)", Reason: "command tree imports implementations; needs public capabilities"},
+	{From: "operator/cli", To: "handlers/iam", Debt: "operator/cli (dependency)", Reason: "command tree imports implementations; needs public capabilities"},
 }
@@ -191,48 +191,3 @@ func TestADR0001_LayeringCheckerDetectsFaults(t *testing.T) {
 		t.Errorf("allow-listed cross-domain edge %s was not detected by R3, so the allowlist entry would read as stale", allowedEdge)
 	}
 }
-
-// TestADR0001_R2_IngressRejectsRuntimeOperatorAndDomains: the request pipeline
-// lives under ingress/aws, so it must not import the daemon, any runtime or
-// operator package, or a domain implementation.
-func TestADR0001_R2_IngressRejectsRuntimeOperatorAndDomains(t *testing.T) {
-	r := ruleByID("R2_IngressImportsNoImplementation")
-	from := "spinifex/ingress/aws/pipeline"
-	f, ok := classify(from)
-	if !ok || !r.subject(f, from) {
-		t.Fatalf("%s is not governed by R2", from)
-	}
-	for _, to := range []string{
-		"spinifex/runtime/daemon", "spinifex/runtime/host/process", "spinifex/runtime/roles/awsgw",
-		"spinifex/operator/admin", "spinifex/domains/ecs", "spinifex/domains/iam/awsapi",
-	} {
-		target, _ := classify(to)
-		if !r.forbids(f, target, from) {
-			t.Errorf("%s -> %s is not rejected by R2", from, to)
-		}
-	}
-}
-
-// TestADR0002_S7_RequestRecordRejectsOutsiders: the request record is readable
-// by packages under ingress/aws only.
-func TestADR0002_S7_RequestRecordRejectsOutsiders(t *testing.T) {
-	record, ok := classify("spinifex/ingress/aws/reqctx")
-	if !ok || !record.requestRecord {
-		t.Fatalf("ingress/aws/reqctx is not classified as the request record: %+v", record)
-	}
-	r := ruleByID("S7_RequestRecordPrivateToIngress")
-	for name, wantRejected := range map[string]bool{
-		"domains/ecs/awsapi":   true,
-		"runtime/roles/awsgw":  true,
-		"operator/admin":       true,
-		"ingress/aws/dispatch": false,
-	} {
-		from, ok := classify(fullPath(name))
-		if !ok {
-			t.Fatalf("%s is unclassified", name)
-		}
-		if got := r.forbids(from, record, name); got != wantRejected {
-			t.Errorf("%s -> ingress/aws/reqctx rejected=%v, want %v", name, got, wantRejected)
-		}
-	}
-}
@@ -29,11 +29,12 @@ const (
 type domainKind int

 const (
-	notDomain    domainKind = iota
-	domainImpl              // domains/<d>/... resource implementation
-	domainAWSAPI            // domains/<d>/awsapi/... AWS action adapters
-	domainProj              // domains/<d>/projection/... authorised view
-	legacyImpl              // handlers/<d>/... legacy domain implementation
+	notDomain     domainKind = iota
+	domainImpl               // domains/<d>/... resource implementation
+	domainAWSAPI             // domains/<d>/awsapi/... AWS action adapters
+	domainProj               // domains/<d>/projection/... authorised view
+	legacyImpl               // handlers/<d>/... legacy domain implementation
+	legacyAdapter            // gateway/<d>/... legacy AWS action adapters
 )

 type class struct {
@@ -41,9 +42,6 @@ type class struct {
 	legacy string // legacy root name when layer is layerLegacy
 	domain string // owning domain for domain-shaped and agent packages
 	kind   domainKind
-	daemon bool // runtime/daemon, the interim daemon -> gateway -> handlers root
-	// requestRecord marks ingress/aws/reqctx, the request record ADR-0002:S7 keeps private to ingress.
-	requestRecord bool
 }

 func (c class) domainShaped() bool { return c.kind != notDomain }
@@ -59,8 +57,25 @@ func (c class) isLegacy(roots ...string) bool {
 	return slices.Contains(roots, c.legacy)
 }

-// legacyRoots are pre-ADR-0001 application roots still standing. None remain.
-var legacyRoots = map[string]bool{}
+// legacyRoots are pre-ADR-0001 application roots still standing.
+var legacyRoots = map[string]bool{
+	"handlers": true, "gateway": true, "daemon": true,
+	"accountteardown": true, "lbagent": true,
+}
+
+// gatewayDomains names the domain each gateway/<service> adapter belongs to;
+// Bedrock is the AWS surface of the Ochre domain.
+var gatewayDomains = map[string]string{
+	"bedrock": "ochre", "ecs": "ecs", "eks": "eks", "elbv2": "elbv2", "iam": "iam",
+	"rds": "rds", "sts": "sts",
+}
+
+// runtimeLegacy and operatorLegacy are the legacy roots whose ADR-0001 target
+// is runtime/ and operator/ respectively.
+var (
+	runtimeLegacy  = []string{"daemon"}
+	operatorLegacy = []string{"accountteardown"}
+)

 // classify maps a module-relative package directory to its layer. ok is false
 // for a package that has no deliberate classification.
@@ -95,9 +110,9 @@ func classifyApp(app []string) (class, bool) {
 	case "foundation":
 		return class{layer: layerFoundation}, true
 	case "ingress":
-		return class{layer: layerIngress, requestRecord: len(app) >= 3 && app[1] == "aws" && app[2] == "reqctx"}, true
+		return class{layer: layerIngress}, true
 	case "runtime":
-		return class{layer: layerRuntime, daemon: len(app) >= 2 && app[1] == "daemon"}, true
+		return class{layer: layerRuntime}, true
 	case "operator":
 		return class{layer: layerOperator}, true
 	case "providers":
@@ -132,6 +147,8 @@ func classifyApp(app []string) (class, bool) {
 	switch {
 	case app[0] == "handlers" && len(app) >= 2:
 		c.domain, c.kind = app[1], legacyImpl
+	case app[0] == "gateway" && len(app) >= 2 && gatewayDomains[app[1]] != "":
+		c.domain, c.kind = gatewayDomains[app[1]], legacyAdapter
 	}
 	return c, true
 }
@@ -9,11 +9,31 @@ import (
 // frozenLegacyPackages is every production package still under a legacy root.
 // It only shrinks: a new entry is a new legacy package, a missing one is a
 // completed move whose line must be deleted.
-var frozenLegacyPackages = []string{}
+var frozenLegacyPackages = []string{
+	"accountteardown",
+	"daemon",
+	"gateway",
+	"gateway/bedrock",
+	"gateway/ecs",
+	"gateway/eks",
+	"gateway/elbv2",
+	"gateway/iam",
+	"gateway/rds",
+	"gateway/spx",
+	"gateway/sts",
+	"handlers/ecs",
+	"handlers/eks",
+	"handlers/elbv2",
+	"handlers/iam",
+	"handlers/iam/mock",
+	"handlers/rds",
+	"handlers/sts",
+	"lbagent",
+}

 // retiredLegacyRoots were legacy roots whose every package has moved to its
 // ADR-0001 target; recreating one would reopen a closed migration row.
-var retiredLegacyRoots = []string{"accountteardown", "admin", "daemon", "gateway", "handlers", "lbagent", "services", "utils", "vpcd"}
+var retiredLegacyRoots = []string{"admin", "services", "utils", "vpcd"}

 // TestADR0001_LegacyRootsFrozen: the current-to-target map gives every legacy
 // root a destination, so none may gain a package and no retired root may return.
@@ -33,6 +53,9 @@ func TestADR0001_LegacyRootsFrozen(t *testing.T) {
 			present[name] = true
 		}
 	}
+	if len(present) == 0 {
+		t.Fatal("found no legacy packages; the freeze would pass vacuously")
+	}
 	frozen := map[string]bool{}
 	for _, p := range frozenLegacyPackages {
 		frozen[p] = true
@@ -1,9 +1,6 @@
 package layering

-import (
-	"slices"
-	"strings"
-)
+import "slices"

 // rule is one ADR-0001 dependency rule over a classified import edge.
 type rule struct {
@@ -75,7 +72,8 @@ var rules = []rule{
 		hint:    "expose the runtime or operator state through a domain-owned projection or a capability wired at the composition root",
 		subject: func(f class, _ string) bool { return f.domainShaped() },
 		forbids: func(f, t class, _ string) bool {
-			return f.domainShaped() && isLayer(t, layerRuntime, layerOperator)
+			return f.domainShaped() && (isLayer(t, layerRuntime, layerOperator) ||
+				t.isLegacy(runtimeLegacy...) || t.isLegacy(operatorLegacy...))
 		},
 	},
 	{
@@ -123,11 +121,13 @@ var rules = []rule{
 				return false
 			}
 			switch {
-			case t.layer == layerAgents:
+			case t.layer == layerAgents || t.isLegacy("lbagent"):
 				return true
 			case t.layer == layerIngress:
-				return f.kind != domainAWSAPI
-			case t.isLegacy("handlers"):
+				return f.kind != domainAWSAPI && f.kind != legacyAdapter
+			case t.isLegacy("gateway") && !t.domainShaped():
+				return true
+			case t.isLegacy("handlers", "gateway"):
 				return f.layer == layerDomain
 			}
 			return false
@@ -137,9 +137,9 @@ var rules = []rule{
 		id:      "Agents_ImportNoDomainOrLegacyImplementation",
 		clause:  "area table: agents/<domain> own in-guest and service-role behaviour, not tenant API authority or another domain's private state",
 		hint:    "move the shared wire vocabulary behind a guest/controller contract under contracts/",
-		subject: func(f class, _ string) bool { return f.layer == layerAgents },
+		subject: func(f class, _ string) bool { return f.layer == layerAgents || f.isLegacy("lbagent") },
 		forbids: func(f, t class, _ string) bool {
-			return f.layer == layerAgents && (t.domainShaped() || t.isLegacy())
+			return (f.layer == layerAgents || f.isLegacy("lbagent")) && (t.domainShaped() || t.isLegacy())
 		},
 	},
 	{
@@ -153,15 +153,18 @@ var rules = []rule{
 		},
 	},
 	{
-		id:      "S7_RequestRecordPrivateToIngress",
-		clause:  "ADR-0002:S7: the request record is private to ingress, so no domain, runtime or operator package reads it; only packages under ingress/aws may import ingress/aws/reqctx",
-		hint:    "receive what you need through dispatch.Invocation instead of the request record",
-		subject: func(_ class, _ string) bool { return true },
-		forbids: func(_, t class, fromName string) bool {
-			if !t.requestRecord {
-				return false
+		id:      "Interim_DaemonGatewayHandlersDirection",
+		clause:  "during migration the existing daemon -> gateway -> handlers rule remains the guardrail (Q-20, Q-29)",
+		hint:    "keep the dependency pointing daemon -> gateway -> handlers; invert it through a callback or capability",
+		subject: func(f class, _ string) bool { return f.isLegacy("handlers", "gateway") },
+		forbids: func(f, t class, _ string) bool {
+			switch {
+			case f.isLegacy("handlers"):
+				return t.isLegacy("gateway", "daemon")
+			case f.isLegacy("gateway"):
+				return t.isLegacy("daemon")
 			}
-			return !strings.HasPrefix(fromName, "ingress/aws/")
+			return false
 		},
 	},
 }
@@ -1,6 +1,6 @@
 ARG VERSION=dev

-FROM golang:1.27.3-bookworm@sha256:d9b6a1beb9474adc2a1ce842573639b44b2a0dd49b6669f51d3821baf9ec37c9 AS builder
+FROM golang:1.27.3-bookworm@sha256:5c3e9b43cfd3bb95c7937462e29d87ada57b481a96fa23ad0eb61778d7a00110 AS builder

 ARG VERSION

@@ -42,16 +42,9 @@ RUN COMMIT=$(cd spinifex && git rev-parse --short HEAD 2>/dev/null || echo "unkn
 # Build nbdkit viperblock plugin (.so)
 RUN cd viperblock && GOFIPS140=v1.0.0 go build -o /out/nbdkit-viperblock-plugin.so -buildmode=c-shared nbd/viperblock.go

-# One tarball ships to every OS. The ceiling is what both binaries need today,
-# so a rise is a decision rather than an accident; every supported OS has 2.39+.
-RUN spinifex/scripts/check-glibc-ceiling.sh 2.34 /out/spx /out/nbdkit-viperblock-plugin.so
-
 # Copy setup scripts and systemd units
 RUN cp spinifex/scripts/setup.sh /out/setup.sh 2>/dev/null || true
 RUN cp spinifex/scripts/setup-ovn.sh /out/setup-ovn.sh
-RUN cd spinifex/scripts && cp install-node.sh smoke-test.sh node-reset.sh uninstall-spx.sh /out/
-RUN mkdir -p /out/udev && cp spinifex/build/udev/* /out/udev/
-RUN mkdir -p /out/lib && cp spinifex/scripts/lib/distro.sh /out/lib/distro.sh
 RUN mkdir -p /out/systemd && cp spinifex/build/systemd/* /out/systemd/
 RUN mkdir -p /out/scripts && cp spinifex/build/scripts/* /out/scripts/
 RUN cp spinifex/build/logrotate/spinifex /out/logrotate-spinifex
@@ -1,68 +0,0 @@
-#!/bin/sh
-mount -t proc  proc  /proc
-mount -t sysfs sys   /sys
-mount -t devtmpfs dev /dev
-
-# modprobe needs a usable modules.dep; insmod by explicit path does not, so
-# fall back to it. Handles .ko and .ko.gz.
-load_mod() {
-    modprobe "$1" 2>/dev/null && return 0
-    for ko in $(find /lib/modules -name "$1.ko" -o -name "$1.ko.gz" 2>/dev/null); do
-        insmod "$ko" 2>/dev/null && return 0
-        case "$ko" in
-            *.gz) gunzip -c "$ko" >/tmp/mod.ko 2>/dev/null \
-                  && insmod /tmp/mod.ko 2>/dev/null && return 0 ;;
-        esac
-    done
-    return 1
-}
-# lambda-agent reads its identity from fw_cfg and unloads qemu_fw_cfg before
-# anything else runs. virtio_net needs net_failover and failover, and the
-# insmod fallback resolves no dependencies, so load the chain bottom-up.
-load_mod qemu_fw_cfg || echo "[init] qemu_fw_cfg did not load" >/dev/console
-load_mod failover || true
-load_mod net_failover || true
-load_mod virtio_net || echo "[init] virtio_net did not load" >/dev/console
-
-ip link set lo up
-
-# The guest's addresses come from the same netcfg entry as other system VMs.
-NETCFG=/sys/firmware/qemu_fw_cfg/by_name/opt/spinifex/netcfg/raw
-i=0
-while [ "$i" -lt 25 ] && [ ! -f "$NETCFG" ]; do
-    sleep 0.04
-    i=$((i + 1))
-done
-if [ -f "$NETCFG" ]; then
-    # shellcheck source=/dev/null
-    . "$NETCFG"
-    for n in 0 1 2 3 4 5; do
-        eval mac=\$NIC${n}_MAC
-        [ -z "$mac" ] && continue
-        iface=""
-        for _ in 1 2 3 4 5; do
-            iface=$(ip -o link | awk -v m="$mac" 'tolower($0) ~ tolower(m) {print $2}' | tr -d :)
-            [ -n "$iface" ] && break
-            sleep 0.02
-        done
-        if [ -z "$iface" ]; then
-            echo "[init] no interface for MAC $mac (NIC$n)" >/dev/console
-            continue
-        fi
-        cidr="" gw="" default="" rdst="" rvia=""
-        eval cidr=\$NIC${n}_CIDR
-        eval gw=\$NIC${n}_GW
-        eval default=\$NIC${n}_DEFAULT
-        eval rdst=\$NIC${n}_ROUTE_DST
-        eval rvia=\$NIC${n}_ROUTE_VIA
-        ip link set "$iface" up
-        [ -n "$cidr" ] && ip addr add "$cidr" dev "$iface"
-        [ "$default" = "1" ] && [ -n "$gw" ] && ip route add default via "$gw" dev "$iface"
-        [ -n "$rdst" ] && [ -n "$rvia" ] && ip route add "$rdst" via "$rvia" dev "$iface"
-    done
-else
-    # lambda-agent then fails to reach the host and the guest powers off.
-    echo "[init] fw_cfg netcfg not available" >/dev/console
-fi
-
-exec /sbin/init
@@ -1,6 +0,0 @@
-# The power button loads here, not in /init: busybox init has its SIGUSR2
-# (poweroff) handler installed before sysinit runs, so a press can never reach
-# the pre-exec shell PID 1. A press before this line is lost; the host re-sends.
-::sysinit:/sbin/modprobe tiny_power_button power_signal=12
-::once:/usr/local/lib/lambda-runtime/run-agent
-::ctrlaltdel:/sbin/reboot
@@ -1,6 +0,0 @@
-#!/bin/sh
-# Runs the Lambda guest agent, then powers the guest off whatever its status.
-/usr/local/bin/lambda-agent >/dev/console 2>&1
-status=$?
-echo "[run-agent] lambda-agent exited with status $status" >/dev/console
-poweroff -f
@@ -1,100 +0,0 @@
-#!/bin/sh
-mount -t proc  proc  /proc
-mount -t sysfs sys   /sys
-mount -t devtmpfs dev /dev
-
-# virtio_mmio is built-in (CONFIG_VIRTIO_MMIO=y) so virtio-net devices are
-# already enumerated by the time PID 1 runs — no modprobe needed.
-# qemu_fw_cfg and virtio_net are =m in stock Alpine linux-virt, so load them.
-#
-# modprobe needs a usable modules.dep; when the image is built on a host whose
-# depmod can't produce one, busybox modprobe silently no-ops and the module
-# never loads — fw_cfg then never appears and init panics. insmod by explicit
-# path needs no modules.dep, so fall back to it. Handles .ko and .ko.gz.
-load_mod() {
-    modprobe "$1" 2>/dev/null && return 0
-    for ko in $(find /lib/modules -name "$1.ko" -o -name "$1.ko.gz" 2>/dev/null); do
-        insmod "$ko" 2>/dev/null && return 0
-        case "$ko" in
-            *.gz) gunzip -c "$ko" >/tmp/mod.ko 2>/dev/null \
-                  && insmod /tmp/mod.ko 2>/dev/null && return 0 ;;
-        esac
-    done
-    return 1
-}
-load_mod qemu_fw_cfg || load_mod fw_cfg_sysfs || true
-# virtio_net depends on net_failover, which depends on failover. The load_mod
-# insmod fallback loads a single .ko with no dependency resolution, and
-# modules.dep is absent when the image is built on a kmod-less host (depmod
-# skipped), so modprobe can't resolve the chain either. Load it explicitly
-# bottom-up so the NIC comes up regardless of how the image was built —
-# without this the agent has no network and the LB hangs in provisioning.
-load_mod failover || true
-load_mod net_failover || true
-load_mod virtio_net || true
-
-# The guest's SQS store listens on 127.0.0.1 and the worker dials it there;
-# the kernel leaves lo down, so bring it up before init starts either.
-ip link set lo up
-
-NETCFG=/sys/firmware/qemu_fw_cfg/by_name/opt/spinifex/netcfg/raw
-i=0
-while [ "$i" -lt 25 ]; do
-    [ -f "$NETCFG" ] && break
-    sleep 0.04
-    i=$((i + 1))
-done
-
-if [ ! -f "$NETCFG" ]; then
-    # Dump host/guest fw_cfg state to the serial console before init exits so a
-    # "netcfg not available" panic is diagnosable from the captured console log
-    # (module-not-loaded vs qemu-not-exposing-by_name vs wrong machine type).
-    echo "[init] FATAL: fw_cfg netcfg not available" >&2
-    echo "[init] dmi: vendor=$(cat /sys/class/dmi/id/sys_vendor 2>/dev/null) product=$(cat /sys/class/dmi/id/product_name 2>/dev/null) bios=$(cat /sys/class/dmi/id/bios_version 2>/dev/null)" >&2
-    echo "[init] qemu_fw_cfg dir present: $([ -d /sys/firmware/qemu_fw_cfg ] && echo yes || echo NO)" >&2
-    echo "[init] modules: $(lsmod 2>/dev/null | awk 'NR>1{print $1}' | tr '\n' ',')" >&2
-    echo "[init] by_name listing:" >&2
-    ls -la /sys/firmware/qemu_fw_cfg/by_name/ 2>&1 | sed 's/^/[init]   /' >&2
-    ls -la /sys/firmware/qemu_fw_cfg/by_name/opt/ 2>&1 | sed 's/^/[init]   /' >&2
-    echo "[init] dmesg fw_cfg:" >&2
-    dmesg 2>/dev/null | grep -i fw_cfg | sed 's/^/[init]   /' >&2
-    exit 1
-fi
-
-. "$NETCFG"
-
-for n in 0 1 2 3 4 5; do
-    eval mac=\$NIC${n}_MAC
-    [ -z "$mac" ] && continue
-
-    iface=""
-    for attempt in 1 2 3 4 5; do
-        iface=$(ip -o link | awk -v m="$mac" 'tolower($0) ~ tolower(m) {print $2}' | tr -d :)
-        [ -n "$iface" ] && break
-        sleep 0.02
-    done
-
-    if [ -z "$iface" ]; then
-        echo "[init] WARNING: no interface found for MAC $mac (NIC$n), skipping" >&2
-        continue
-    fi
-
-    eval cidr=\$NIC${n}_CIDR
-    eval gw=\$NIC${n}_GW
-    eval default=\$NIC${n}_DEFAULT
-    eval rdst=\$NIC${n}_ROUTE_DST
-    eval rvia=\$NIC${n}_ROUTE_VIA
-
-    ip link set "$iface" up
-    [ -n "$cidr" ] && ip addr add "$cidr" dev "$iface"
-    [ "$default" = "1" ] && [ -n "$gw" ] && ip route add default via "$gw" dev "$iface"
-    [ -n "$rdst" ] && [ -n "$rvia" ] && ip route add "$rdst" via "$rvia" dev "$iface"
-done
-
-# The image takes no lb-agent environment. The worker reads the cluster CA
-# from fw_cfg itself; this copy only serves other tools in the guest.
-CA_CERT=/sys/firmware/qemu_fw_cfg/by_name/opt/spinifex/ca-cert/raw
-mkdir -p /etc/ssl/certs
-[ -f "$CA_CERT" ] && cp "$CA_CERT" /etc/ssl/certs/ca-certificates.crt
-
-exec /sbin/init
@@ -1,9 +0,0 @@
-# The power button loads here, not in /init: busybox init has its SIGUSR2
-# (poweroff) handler installed before sysinit runs, so a press can never reach
-# the pre-exec shell PID 1. A press before this line is lost; the host re-sends.
-::sysinit:/sbin/modprobe tiny_power_button power_signal=12
-::sysinit:/usr/local/lib/sqs-worker/sqs-worker-prepare
-::respawn:/usr/local/lib/sqs-worker/sqs-worker-store
-::respawn:/usr/local/lib/sqs-worker/sqs-worker-ready
-::ctrlaltdel:/sbin/reboot
-::shutdown:/usr/local/lib/sqs-worker/sqs-worker-stop
@@ -1,203 +0,0 @@
-# sqs-worker-lib.sh — shared by the SQS guest's store, readiness and stop
-# steps. Sourced, never executed. Every path and command is overridable so the
-# host test can drive the same code against test-owned processes and stub tools.
-#
-# The guest runs its own SQS nats-server on loopback and the worker beside it.
-# The server starts only after boot settled the receipt key; store-ready exists
-# only while the running watcher's last check of that server passed.
-
-SQSW_RUN=${SQSW_RUN:-/run/sqs-worker}
-SQSW_DATA=${SQSW_DATA:-/data}
-SQSW_CONSOLE=${SQSW_CONSOLE:-/dev/console}
-SQSW_MOUNTS=${SQSW_MOUNTS:-/proc/mounts}
-SQSW_BIN=${SQSW_BIN:-/usr/local/bin/sqs-worker}
-SQSW_LIB=${SQSW_LIB:-/usr/local/lib/sqs-worker/sqs-worker-lib.sh}
-SQSW_NATS_BIN=${SQSW_NATS_BIN:-/usr/local/bin/nats-server}
-SQSW_STORE_PORT=${SQSW_STORE_PORT:-4222}
-SQSW_STOP_BUDGET_TENTHS=${SQSW_STOP_BUDGET_TENTHS:-100}
-SQSW_RESPAWN_GAP=${SQSW_RESPAWN_GAP:-5}
-SQSW_PARK=${SQSW_PARK:-sleep 2147483647}
-SQSW_BOOT_RETRY=${SQSW_BOOT_RETRY:-30}
-UMOUNT=${UMOUNT:-umount}
-
-sqsw_log() { echo "[sqs-worker] $*" >> "$SQSW_CONSOLE"; }
-
-# sqsw_alive <pid>: running or stopped, not exited (a zombie counts as exited).
-sqsw_alive() { [ -r "/proc/$1/status" ] && ! grep -q '^State:[[:space:]]*Z' "/proc/$1/status" 2>/dev/null; }
-
-# sqsw_starttime <pid>: kernel start time (stat field 22). It survives exec, and
-# pairing it with the pid reduces PID-reuse risk; it is not an absolute guarantee.
-sqsw_starttime() { sed 's/.*) //' "/proc/$1/stat" 2>/dev/null | cut -d' ' -f20; }
-
-# sqsw_same <pid> <starttime>: the recorded process is still alive.
-sqsw_same() { [ -n "$2" ] && sqsw_alive "$1" && [ "$(sqsw_starttime "$1")" = "$2" ]; }
-
-# sqsw_write_config <file>: the guest's own server. It listens only on
-# loopback, with no monitor, route or cluster listener. Its max_payload admits
-# a 1 MiB SQS message with its headers (ADR-0011:S4); the 1MB default does not.
-sqsw_write_config() {
-    cat > "$1" <<CONF
-listen: "127.0.0.1:$SQSW_STORE_PORT"
-server_name: "sqs-store"
-max_payload: 2MiB
-jetstream {
-  store_dir: "$SQSW_DATA/jetstream"
-  sync_interval: always
-}
-CONF
-}
-
-# sqsw_prepare_store: write and test the server config once boot has settled
-# the receipt key. Returns non-zero, leaving the store unstarted, otherwise.
-sqsw_prepare_store() {
-    rm -f "$SQSW_RUN/store.conf"
-    [ -s "$SQSW_RUN/receipt-ready" ] || { sqsw_log "store: receipt key not settled, store not prepared"; return 1; }
-    umask 077
-    sqsw_write_config "$SQSW_RUN/store.conf.new" || return 1
-    if ! "$SQSW_NATS_BIN" -t -c "$SQSW_RUN/store.conf.new" > "$SQSW_RUN/config-test.out" 2>&1; then
-        sqsw_log "store: FATAL: server config test failed: $(tr '\n' ' ' < "$SQSW_RUN/config-test.out")"
-        return 1
-    fi
-    mv "$SQSW_RUN/store.conf.new" "$SQSW_RUN/store.conf"
-    sqsw_log "store: config written for 127.0.0.1:$SQSW_STORE_PORT; server not started yet"
-}
-
-# sqsw_park <why>: init respawns a step that exits, so a step that must not run
-# logs once and waits for shutdown instead of looping.
-sqsw_park() {
-    sqsw_log "$1"
-    exec $SQSW_PARK
-}
-
-# sqsw_record <name>: record this process's identity before the stopping
-# check, so a stop that misses the record has already set stopping.
-sqsw_record() { echo "$$ $(sqsw_starttime $$)" > "$SQSW_RUN/$1.pid"; }
-
-# sqsw_boot: settle the disk and receipt key once per guest boot. A transient
-# failure (exit 75) waits and exits so init runs it again; boot never remounts
-# a disk already mounted. Any other failure is final for this guest boot.
-sqsw_boot() {
-    [ ! -e "$SQSW_RUN/boot-refused" ] || sqsw_park "store: boot refused, not starting"
-    [ -s "$SQSW_RUN/receipt-ready" ] && return 0
-    # The boot child records itself before its stopping check, as the other
-    # steps do, so shutdown either sees its record or it never starts.
-    SQSW_RUN="$SQSW_RUN" SQSW_BIN="$SQSW_BIN" sh -c '. "$1"; sqsw_record boot; [ ! -e "$SQSW_RUN/stopping" ] || exit 75; exec "$SQSW_BIN" boot' \
-        sh "$SQSW_LIB" >> "$SQSW_CONSOLE" 2>&1 &
-    child=$!
-    rc=0
-    wait "$child" || rc=$?
-    rm -f "$SQSW_RUN/boot.pid"
-    [ ! -e "$SQSW_RUN/stopping" ] || sqsw_park "store: shutdown during boot, not starting"
-    case "$rc" in
-        0) return 0 ;;
-        75) sqsw_log "store: boot not settled, retrying in ${SQSW_BOOT_RETRY}s"
-            sleep "$SQSW_BOOT_RETRY"
-            exit 1 ;;
-        *) : > "$SQSW_RUN/boot-refused"
-           sqsw_park "store: boot refused (rc=$rc), not starting" ;;
-    esac
-}
-
-# sqsw_store: the respawned server body. It starts only on a prepared config.
-sqsw_store() {
-    mkdir -p "$SQSW_RUN"
-    sqsw_record store
-    [ ! -e "$SQSW_RUN/stopping" ] || sqsw_park "store: shutdown in progress, not starting"
-    sqsw_boot
-    if [ ! -s "$SQSW_RUN/store.conf" ] && ! sqsw_prepare_store; then
-        : > "$SQSW_RUN/boot-refused"
-        sqsw_park "store: not prepared, not starting"
-    fi
-    sqsw_log "store: starting pid=$$"
-    # ADR-0011:S11 bounds the store's Go heap; the guest must be larger.
-    GOMEMLIMIT=512MiB exec "$SQSW_NATS_BIN" -c "$SQSW_RUN/store.conf"
-}
-
-# sqsw_run: the respawned readiness body. A predecessor that was killed or
-# crashed could not remove its marker, so every start removes it first.
-sqsw_run() {
-    mkdir -p "$SQSW_RUN"
-    sqsw_record ready
-    if [ -e "$SQSW_RUN/store-ready" ]; then
-        rm -f "$SQSW_RUN/store-ready"
-        sqsw_log "ready: removed a store-ready marker left by an earlier watcher"
-    fi
-    [ ! -e "$SQSW_RUN/stopping" ] || sqsw_park "ready: shutdown in progress, not starting"
-    [ ! -e "$SQSW_RUN/boot-refused" ] || sqsw_park "ready: boot refused, readiness not started"
-    # Boot may still be retrying; check again after a gap rather than parking.
-    if [ ! -s "$SQSW_RUN/store.conf" ]; then
-        sleep "$SQSW_RESPAWN_GAP"
-        exit 0
-    fi
-    # Init respawns at once; a watcher that keeps exiting restarts at most
-    # once per gap instead of in a tight loop.
-    now=$(date +%s)
-    last=$(cat "$SQSW_RUN/ready.last" 2>/dev/null || echo 0)
-    wait=$((last + SQSW_RESPAWN_GAP - now))
-    if [ "$wait" -gt 0 ] && [ "$wait" -le "$SQSW_RESPAWN_GAP" ]; then sleep "$wait"; fi
-    date +%s > "$SQSW_RUN/ready.last"
-    sqsw_log "ready: starting watcher pid=$$"
-    exec "$SQSW_BIN" ready >> "$SQSW_CONSOLE" 2>&1
-}
-
-# sqsw_end <name>: SIGTERM the recorded process, SIGKILL only after the
-# budget. Returns non-zero while it is still alive.
-sqsw_end() {
-    rec=$(cat "$SQSW_RUN/$1.pid" 2>/dev/null || true)
-    pid=${rec%% *} st=${rec#* }
-    [ "$st" != "$rec" ] || st=""
-    if [ -z "$pid" ] || ! sqsw_same "$pid" "$st"; then
-        sqsw_log "stop: no running $1"
-        return 0
-    fi
-    kill -TERM "$pid" 2>/dev/null || true
-    sqsw_log "stop: SIGTERM sent to $1 pid=$pid"
-    i=0
-    while sqsw_same "$pid" "$st" && [ "$i" -lt "$SQSW_STOP_BUDGET_TENTHS" ]; do sleep 0.1; i=$((i + 1)); done
-    if sqsw_same "$pid" "$st"; then
-        sqsw_log "stop: $1 pid=$pid still running after $((SQSW_STOP_BUDGET_TENTHS / 10))s, SIGKILL"
-        kill -KILL "$pid" 2>/dev/null || true
-        j=0
-        while sqsw_same "$pid" "$st" && [ "$j" -lt 30 ]; do sleep 0.1; j=$((j + 1)); done
-    fi
-    if sqsw_same "$pid" "$st"; then
-        sqsw_log "stop: $1 pid=$pid STILL ALIVE"
-        return 1
-    fi
-    sqsw_log "stop: $1 pid=$pid exited"
-    rm -f "$SQSW_RUN/$1.pid"
-}
-
-# sqsw_stop: block any respawn, drop the marker, stop the watcher, the server
-# and any boot in progress, and unmount the disk only once all are confirmed
-# gone. A survivor keeps the disk mounted.
-sqsw_stop() {
-    mkdir -p "$SQSW_RUN"
-    : > "$SQSW_RUN/stopping"
-    rm -f "$SQSW_RUN/store-ready"
-    if ! sqsw_end ready || ! sqsw_end store || ! sqsw_end boot; then
-        rm -f "$SQSW_RUN/store-ready"
-        sqsw_log "stop: leaving $SQSW_DATA mounted"
-        return 1
-    fi
-    rm -f "$SQSW_RUN/store-ready"
-    sync
-    if grep -q " $SQSW_DATA " "$SQSW_MOUNTS" 2>/dev/null; then
-        rc=0
-        "$UMOUNT" "$SQSW_DATA" || rc=$?
-        sqsw_log "stop: umount $SQSW_DATA rc=$rc"
-    fi
-}
-
-# sqsw_shutdown: the only shutdown action. The generic read-only remount runs
-# only after both processes stopped; a survivor keeps every mount as it is.
-sqsw_shutdown() {
-    if ! sqsw_stop; then
-        sync
-        sqsw_log "shutdown: a guest process survived, skipping umount -a -r"
-        return 1
-    fi
-    rc=0
-    "$UMOUNT" -a -r || rc=$?
-    echo "[init] shutdown: umount -a -r rc=$rc" >> "$SQSW_CONSOLE"
-}
@@ -1,9 +0,0 @@
-#!/bin/sh
-# sysinit: load the disk drivers and clear this boot's markers. The respawned
-# store step mounts the disk, settles the receipt key and starts the store.
-. /usr/local/lib/sqs-worker/sqs-worker-lib.sh
-modprobe virtio_blk 2>/dev/null || true
-modprobe ext4 2>/dev/null || true
-mkdir -p "$SQSW_RUN"
-rm -f "$SQSW_RUN/receipt-ready" "$SQSW_RUN/store.conf" "$SQSW_RUN/boot-refused"
-exit 0
@@ -1,5 +0,0 @@
-#!/bin/sh
-# Respawned by init: the worker, reporting ready only while the local store
-# answers. A watcher that must not run parks instead of exiting.
-. /usr/local/lib/sqs-worker/sqs-worker-lib.sh
-sqsw_run
@@ -1,5 +0,0 @@
-#!/bin/sh
-# The only shutdown action: stop the worker, then the store, and unmount the
-# data disk, then run the generic read-only remount only if both are gone.
-. /usr/local/lib/sqs-worker/sqs-worker-lib.sh
-sqsw_shutdown
@@ -1,5 +0,0 @@
-#!/bin/sh
-# Respawned by init: the guest's own SQS nats-server, started only on a
-# prepared config. A store that must not run parks instead of exiting.
-. /usr/local/lib/sqs-worker/sqs-worker-lib.sh
-sqsw_store
@@ -1,10 +1,10 @@
-# spinifex-unit-version: 6
+# spinifex-unit-version: 3
 [Unit]
 Description=Spinifex Daemon (VM Orchestration)
 PartOf=spinifex.target
-After=spinifex-nats.service spinifex-viperblock.service ovsdb-server.service ovs-vswitchd.service ovn-controller.service openvswitch-ipsec.service spinifex-hostnet.service
-# Wants (not Requires): boot without openvswitch-ipsec, survive OVS restarts via hostnet
-Wants=openvswitch-ipsec.service spinifex-hostnet.service
+After=spinifex-nats.service spinifex-viperblock.service openvswitch-switch.service ovn-controller.service openvswitch-ipsec.service
+# Wants (not Requires): stay bootable when openvswitch-ipsec is absent
+Wants=openvswitch-ipsec.service

 [Service]
 EnvironmentFile=-/etc/spinifex/telemetry.env
@@ -14,8 +14,6 @@ Type=simple
 Slice=spinifex-system.slice
 User=spinifex-daemon
 Group=spinifex
-ExecStartPre=/usr/local/bin/spx admin hostnet check
-ExecStartPre=-+/usr/local/bin/spx admin node-facts collect
 ExecStart=/usr/local/bin/spx service spinifex start
 Restart=on-failure
 RestartSec=5
@@ -1,10 +1,11 @@
-# spinifex-unit-version: 2
+# spinifex-unit-version: 1
 [Unit]
 Description=Spinifex host firewall (nftables input policy)
 Documentation=file:/etc/spinifex/firewall/spinifex.nft
 Wants=network-pre.target
 Before=network-pre.target shutdown.target
 DefaultDependencies=no
+ConditionPathExists=/etc/spinifex/firewall/peers.nft

 [Service]
 Type=oneshot
@@ -12,11 +13,8 @@ RemainAfterExit=yes
 StandardInput=null
 ProtectSystem=full
 ProtectHome=true
-# Unconditional: connection tracking loads on every node, so a flow that opens
-# while the policy is not armed survives the arm. The policy itself still loads
-# only where the daemon has written a peer file.
-ExecStart=/usr/local/lib/spinifex/spinifex-firewall-apply boot
-ExecReload=/usr/local/lib/spinifex/spinifex-firewall-apply boot
+ExecStart=/usr/local/lib/spinifex/spinifex-firewall-apply
+ExecReload=/usr/local/lib/spinifex/spinifex-firewall-apply
 TimeoutStopSec=10s

 # No ExecStop: flushing on stop would take vpcd's MASQUERADE and per-EIP FORWARD
@@ -1,25 +0,0 @@
-# spinifex-unit-version: 2
-[Unit]
-Description=Spinifex host network wiring (veth pairs, mgmt address, encap route)
-# PartOf/WantedBy ovs-vswitchd: re-applied whenever OVS starts; daemon and vpcd only Want it
-Requires=ovs-vswitchd.service
-After=ovs-vswitchd.service NetworkManager-wait-online.service
-PartOf=ovs-vswitchd.service
-# Stopping OVS stops ovn-controller through its Requires= chain and starting OVS
-# does not bring it back, so the start that re-applies hostnet restarts it too
-Wants=ovn-controller.service
-Before=spinifex.target
-
-[Service]
-Type=oneshot
-RemainAfterExit=yes
-ExecStart=/usr/local/bin/spx admin hostnet apply
-# Covers the 120s wait behind setup-ovn.sh plus the 60s wait for links
-TimeoutStartSec=240
-TimeoutStopSec=10
-ProtectSystem=full
-ProtectHome=yes
-PrivateTmp=yes
-
-[Install]
-WantedBy=spinifex.target ovs-vswitchd.service
@@ -1,9 +1,9 @@
-# spinifex-unit-version: 3
+# spinifex-unit-version: 1
 [Unit]
 Description=Spinifex VPC Daemon (OVN Networking)
 PartOf=spinifex.target
-After=spinifex-nats.service spinifex-daemon.service systemd-networkd.service ovsdb-server.service ovs-vswitchd.service ovn-controller.service spinifex-hostnet.service
-Wants=spinifex-nats.service ovn-controller.service spinifex-hostnet.service
+After=spinifex-nats.service spinifex-daemon.service systemd-networkd.service openvswitch-switch.service ovn-controller.service
+Wants=spinifex-nats.service ovn-controller.service

 [Service]
 EnvironmentFile=-/etc/spinifex/telemetry.env
@@ -11,7 +11,6 @@ Type=simple
 Slice=spinifex-system.slice
 User=spinifex-vpcd
 Group=spinifex
-ExecStartPre=/usr/local/bin/spx admin hostnet check
 ExecStartPre=/var/lib/spinifex/wait-for-nats.sh
 ExecStart=/usr/local/bin/spx service vpcd start
 Restart=on-failure
@@ -1,9 +1,9 @@
-# spinifex-unit-version: 4
+# spinifex-unit-version: 1
 [Unit]
 Description=Spinifex Infrastructure Platform
 After=network-online.target
 Wants=network-online.target
-Wants=spinifex-nats.service spinifex-predastore.service spinifex-northstar.service spinifex-viperblock.service spinifex-daemon.service spinifex-awsgw.service spinifex-vpcd.service spinifex-ui.service spinifex-qmp-collector.service spinifex-shutdown.service spinifex-nats-watchdog.timer ovsdb-server.service ovs-vswitchd.service ovn-controller.service
+Wants=spinifex-nats.service spinifex-predastore.service spinifex-northstar.service spinifex-viperblock.service spinifex-daemon.service spinifex-awsgw.service spinifex-vpcd.service spinifex-ui.service spinifex-qmp-collector.service spinifex-shutdown.service spinifex-nats-watchdog.timer openvswitch-switch.service ovn-controller.service

 [Install]
 WantedBy=multi-user.target
@@ -4,21 +4,12 @@ import (
 	"flag"
 	"fmt"
 	"os"
-	"slices"

 	"github.com/mulgadc/predastore/s3api"
 	"github.com/mulgadc/spinifex/internal/awsmodel"
 	acmawsapi "github.com/mulgadc/spinifex/spinifex/domains/acm/awsapi"
-	ec2awsapi "github.com/mulgadc/spinifex/spinifex/domains/ec2/awsapi"
 	awsapi "github.com/mulgadc/spinifex/spinifex/domains/ecr/awsapi"
-	ecsawsapi "github.com/mulgadc/spinifex/spinifex/domains/ecs/awsapi"
-	eksawsapi "github.com/mulgadc/spinifex/spinifex/domains/eks/awsapi"
-	elbv2awsapi "github.com/mulgadc/spinifex/spinifex/domains/elbv2/awsapi"
-	iamawsapi "github.com/mulgadc/spinifex/spinifex/domains/iam/awsapi"
-	rdsawsapi "github.com/mulgadc/spinifex/spinifex/domains/rds/awsapi"
-	route53awsapi "github.com/mulgadc/spinifex/spinifex/domains/route53/awsapi"
-	sqsawsapi "github.com/mulgadc/spinifex/spinifex/domains/sqs/awsapi"
-	stsawsapi "github.com/mulgadc/spinifex/spinifex/domains/sts/awsapi"
+	"github.com/mulgadc/spinifex/spinifex/gateway"
 	"github.com/mulgadc/spinifex/spinifex/ingress/aws/dispatch"

 	_ "github.com/mulgadc/bluebottle/pkg/fipsboot"
@@ -57,26 +48,10 @@ func fail(err error) {
 func compareAll() ([]awsmodel.OperationCoverage, error) {
 	// Registered services contribute their declared inventory, which needs no
 	// live dependencies; nothing here serves a request.
-	inventories := dispatch.AWSOperationInventory(map[string]dispatch.Inventory{
-		awsapi.ServiceName:        awsapi.OperationInventory(),
-		acmawsapi.ServiceName:     acmawsapi.OperationInventory(),
-		route53awsapi.ServiceName: route53awsapi.OperationInventory(),
-		elbv2awsapi.InventoryName: elbv2awsapi.OperationInventory(),
-		rdsawsapi.ServiceName:     rdsawsapi.OperationInventory(),
-		ec2awsapi.ServiceName:     ec2awsapi.OperationInventory(),
-		ecsawsapi.ServiceName:     ecsawsapi.OperationInventory(),
-		eksawsapi.ServiceName:     eksawsapi.OperationInventory(),
-		iamawsapi.ServiceName:     iamawsapi.OperationInventory(),
-		sqsawsapi.ServiceName:     sqsawsapi.OperationInventory(),
-		stsawsapi.ServiceName:     stsawsapi.OperationInventory(),
+	inventories := gateway.AWSOperationInventory(map[string]dispatch.Inventory{
+		awsapi.ServiceName:    awsapi.OperationInventory(),
+		acmawsapi.ServiceName: acmawsapi.OperationInventory(),
 	})
-	// The loop below walks the embedded models, so a served service with no
-	// model would otherwise drop out of the report without a word.
-	for name := range inventories {
-		if !slices.Contains(awsmodel.Services(), awsmodel.Service(name)) {
-			return nil, fmt.Errorf("no embedded AWS model for served service %s", name)
-		}
-	}
 	coverages := make([]awsmodel.OperationCoverage, 0, len(awsmodel.Services()))
 	for _, service := range awsmodel.Services() {
 		inventory, ok := inventories[string(service)]
@@ -1,50 +0,0 @@
-// eks-etcd-member removes a dead peer from the embedded etcd cluster of an EKS
-// K3s control-plane VM. A member that is already gone exits 0; any other
-// failure exits non-zero.
-package main
-
-import (
-	"context"
-	"flag"
-	"fmt"
-	"io"
-	"os"
-	"time"
-
-	_ "github.com/mulgadc/bluebottle/pkg/fipsboot"
-
-	"github.com/mulgadc/spinifex/spinifex/agents/eks/etcdmember"
-)
-
-func main() {
-	os.Exit(run(os.Args[1:], os.Stdout, os.Stderr))
-}
-
-func run(args []string, stdout, stderr io.Writer) int {
-	if len(args) < 1 || args[0] != "remove" {
-		fmt.Fprintln(stderr, "usage: eks-etcd-member remove --peer-ip 10.0.0.12 [--self-ip 10.0.0.10]")
-		return 2
-	}
-	fs := flag.NewFlagSet("remove", flag.ContinueOnError)
-	fs.SetOutput(stderr)
-	var cfg etcdmember.Config
-	endpoint := fs.String("endpoint", etcdmember.DefaultEndpoint, "etcd client endpoint")
-	certDir := fs.String("cert-dir", etcdmember.DefaultCertDir, "directory holding the K3s etcd client.crt, client.key and server-ca.crt")
-	timeout := fs.Duration("timeout", 30*time.Second, "overall deadline")
-	fs.StringVar(&cfg.PeerIP, "peer-ip", "", "peer URL host of the member to remove")
-	fs.StringVar(&cfg.SelfIP, "self-ip", "", "this host's own address; removal of it is refused")
-	if err := fs.Parse(args[1:]); err != nil {
-		return 2
-	}
-
-	ctx, cancel := context.WithTimeout(context.Background(), *timeout)
-	defer cancel()
-
-	cli, err := etcdmember.Dial(*endpoint, *certDir, *timeout)
-	if err != nil {
-		fmt.Fprintln(stderr, "etcd member remove failed:", err)
-		return 1
-	}
-	defer func() { _ = cli.Close() }()
-	return etcdmember.Run(ctx, cli, cfg, stdout)
-}
@@ -1,63 +0,0 @@
-package main
-
-import (
-	"bytes"
-	"testing"
-
-	"github.com/mulgadc/spinifex/internal/testkit/fakeetcd"
-	"github.com/stretchr/testify/assert"
-)
-
-var fakeMembers = []fakeetcd.Member{
-	{ID: 0xa1, Name: "cp-a", PeerURLs: []string{"https://10.0.0.10:2380"}},
-	{ID: 0xb2, Name: "cp-b", PeerURLs: []string{"https://10.0.0.12:2380"}},
-}
-
-func TestRunRequiresTheRemoveSubcommand(t *testing.T) {
-	t.Parallel()
-	for _, args := range [][]string{nil, {"list"}} {
-		var out, errOut bytes.Buffer
-		assert.Equal(t, 2, run(args, &out, &errOut))
-		assert.Contains(t, errOut.String(), "usage: eks-etcd-member remove")
-	}
-}
-
-func TestRunRejectsUnknownFlags(t *testing.T) {
-	t.Parallel()
-	var out, errOut bytes.Buffer
-	assert.Equal(t, 2, run([]string{"remove", "--bogus"}, &out, &errOut))
-}
-
-func TestRunFailsWhenEtcdCertificatesAreMissing(t *testing.T) {
-	t.Parallel()
-	var out, errOut bytes.Buffer
-	code := run([]string{"remove", "--peer-ip", "10.0.0.12", "--cert-dir", t.TempDir()}, &out, &errOut)
-	assert.Equal(t, 1, code)
-	assert.Contains(t, errOut.String(), "etcd member remove failed")
-}
-
-func TestRunRemovesTheNamedPeer(t *testing.T) {
-	t.Parallel()
-	srv := fakeetcd.Start(t, 0xa1, fakeMembers)
-	var out, errOut bytes.Buffer
-
-	code := run([]string{"remove", "--peer-ip", "10.0.0.12", "--self-ip", "10.0.0.10",
-		"--endpoint", srv.Endpoint, "--cert-dir", srv.CertDir}, &out, &errOut)
-
-	assert.Zero(t, code, errOut.String()+out.String())
-	assert.Contains(t, out.String(), "removed etcd member 10.0.0.12")
-	assert.Equal(t, []uint64{0xb2}, srv.Removed())
-}
-
-func TestRunTreatsAnAbsentPeerAsSuccess(t *testing.T) {
-	t.Parallel()
-	srv := fakeetcd.Start(t, 0xa1, fakeMembers)
-	var out, errOut bytes.Buffer
-
-	code := run([]string{"remove", "--peer-ip", "10.0.0.99",
-		"--endpoint", srv.Endpoint, "--cert-dir", srv.CertDir}, &out, &errOut)
-
-	assert.Zero(t, code)
-	assert.Contains(t, out.String(), "member already absent")
-	assert.Empty(t, srv.Removed())
-}
@@ -6,7 +6,6 @@
 //
 //	eks-gateway-fetch -resource addons   # GET /clusters/{cluster}/internal-addons/{accountId}
 //	eks-gateway-fetch -resource recovery -instance-id i-… # GET /clusters/{cluster}/internal-recovery/{accountId}/{instanceId}
-//	eks-gateway-fetch -resource workers  # GET /clusters/{cluster}/internal-workers/{accountId}
 //
 // Flags default to environment variables seeded by cloud-init:
 // EKS_GATEWAY_URL, EKS_GATEWAY_CA, EKS_ACCESS_KEY, EKS_SECRET_KEY, EKS_REGION,
@@ -34,7 +33,7 @@ func main() {
 	flag.StringVar(&cfg.AccountID, "account-id", os.Getenv("EKS_ACCOUNT_ID"), "Cluster account ID")
 	flag.StringVar(&cfg.ClusterName, "cluster", os.Getenv("EKS_CLUSTER_NAME"), "Cluster name")
 	flag.StringVar(&cfg.InstanceID, "instance-id", os.Getenv("EKS_INSTANCE_ID"), "This member's EC2 instance ID (recovery resource)")
-	flag.StringVar(&cfg.Resource, "resource", "addons", "Resource to fetch: addons | recovery | workers")
+	flag.StringVar(&cfg.Resource, "resource", "addons", "Resource to fetch: addons | recovery")
 	flag.Parse()

 	if err := gatewayfetch.Run(context.Background(), cfg); err != nil {
@@ -1,32 +0,0 @@
-// Command eks-pod-identity-webhook is the IRSA mutating admission webhook run
-// on every EKS control-plane server; the implementation is in
-// agents/eks/podidentity. It listens on loopback only and is called by the
-// local kube-apiserver.
-package main
-
-import (
-	"context"
-	"log/slog"
-	"os"
-	"os/signal"
-	"syscall"
-
-	_ "github.com/mulgadc/bluebottle/pkg/fipsboot"
-
-	"github.com/mulgadc/spinifex/spinifex/agents/eks/podidentity"
-)
-
-func main() {
-	log := slog.New(slog.NewTextHandler(os.Stderr, nil))
-	cfg, err := podidentity.ParseServiceConfig(os.Args[1:], os.Getenv, os.Stderr)
-	if err != nil {
-		log.Error("invalid configuration", "error", err)
-		os.Exit(2)
-	}
-	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
-	defer stop()
-	if err := podidentity.Run(ctx, cfg, log); err != nil {
-		log.Error("pod identity webhook stopped", "error", err)
-		os.Exit(1)
-	}
-}
@@ -29,7 +29,6 @@ func loadConfig() (tokenwebhook.Config, error) {
 		CertPath:    envOr("EKS_WEBHOOK_CERT", "/etc/spinifex-eks/token-webhook.crt"),
 		KeyPath:     envOr("EKS_WEBHOOK_KEY", "/etc/spinifex-eks/token-webhook.key"),
 		Kubeconfig:  envOr("EKS_WEBHOOK_KUBECONFIG", "/etc/spinifex-eks/token-webhook.kubeconfig"),
-		ReadyAddr:   os.Getenv("EKS_WEBHOOK_READY_ADDR"),
 	}
 	// Static SigV4 creds are optional: when absent, eksgw.New signs with the
 	// AWS SDK chain (IMDS instance-role creds), the same path the CP VM's
@@ -1,48 +0,0 @@
-package main
-
-import (
-	"context"
-	"crypto/tls"
-	"errors"
-	"fmt"
-
-	"github.com/mulgadc/spinifex/spinifex/agents/lambda/hostlink"
-)
-
-// Exit statuses: the guest refused to start, the control connection failed,
-// or the host closed it.
-const (
-	exitRefused = 2
-	exitLink    = 1
-	exitClosed  = 0
-)
-
-type startup struct {
-	fwCfgDir  string
-	fwCfgRoot string
-	unload    func() error
-}
-
-func defaultStartup() startup {
-	return startup{fwCfgDir: hostlink.FwCfgDir, fwCfgRoot: hostlink.FwCfgRoot, unload: hostlink.UnloadFwCfg}
-}
-
-// connect loads the identity, seals fw_cfg whether or not the load succeeded,
-// then dials the host. Under TLS 1.3 a host refusal is seen only on first read.
-func (s startup) connect(ctx context.Context) (*tls.Conn, int, error) {
-	id, loadErr := hostlink.LoadIdentity(s.fwCfgDir)
-	if err := hostlink.SealFwCfg(s.fwCfgRoot, s.unload); err != nil {
-		return nil, exitRefused, errors.Join(loadErr, err)
-	}
-	if loadErr != nil {
-		return nil, exitRefused, loadErr
-	}
-	conn, err := hostlink.Dial(ctx, id)
-	if err != nil {
-		if ctx.Err() != nil {
-			err = fmt.Errorf("%w: %w", err, context.Cause(ctx))
-		}
-		return nil, exitLink, err
-	}
-	return conn, 0, nil
-}
@@ -1,98 +0,0 @@
-package main
-
-import (
-	"context"
-	"crypto/tls"
-	"net"
-	"os"
-	"path/filepath"
-	"testing"
-	"time"
-
-	lambdav1 "github.com/mulgadc/spinifex/contracts/lambda/v1"
-	"github.com/mulgadc/spinifex/spinifex/runtime/compute/lambda/guestconn"
-	"github.com/stretchr/testify/require"
-)
-
-const scope lambdav1.Scope = "ap-southeast-2/000000000001/fn-1/env-1/gen-1"
-
-// guest is a fake fw_cfg tree; unload removes it as unloading the module would.
-type guest struct {
-	root     string
-	unloads  int
-	sealedAt chan struct{}
-}
-
-func newGuest(t *testing.T, entries map[string][]byte) *guest {
-	t.Helper()
-	g := &guest{root: filepath.Join(t.TempDir(), "qemu_fw_cfg"), sealedAt: make(chan struct{}, 1)}
-	for name, b := range entries {
-		dir := filepath.Join(g.root, "by_name", lambdav1.FwCfgPrefix, name)
-		require.NoError(t, os.MkdirAll(dir, 0o700))
-		require.NoError(t, os.WriteFile(filepath.Join(dir, "raw"), b, 0o600))
-	}
-	return g
-}
-
-func (g *guest) startup() startup {
-	return startup{
-		fwCfgDir:  filepath.Join(g.root, "by_name", lambdav1.FwCfgPrefix),
-		fwCfgRoot: g.root,
-		unload: func() error {
-			g.unloads++
-			g.sealedAt <- struct{}{}
-			return os.RemoveAll(g.root)
-		},
-	}
-}
-
-type host struct {
-	ln   *net.TCPListener
-	gen  *guestconn.Generation
-	conn chan accepted
-}
-
-func newHost(t *testing.T) *host {
-	t.Helper()
-	ln, err := net.ListenTCP("tcp", &net.TCPAddr{IP: net.IPv4(127, 0, 0, 1)})
-	require.NoError(t, err)
-	t.Cleanup(func() { ln.Close() })
-	gen, err := guestconn.NewGeneration(scope, time.Hour)
-	require.NoError(t, err)
-	return &host{ln: ln, gen: gen, conn: make(chan accepted, 1)}
-}
-
-func (h *host) entries() map[string][]byte { return h.gen.GuestEntries(h.ln.Addr().String()) }
-
-type accepted struct {
-	conn *tls.Conn
-	err  error
-}
-
-// accept runs the host end until ctx ends and reports what it accepted.
-func (h *host) accept(ctx context.Context) {
-	go func() {
-		c, err := h.gen.AcceptGuest(ctx, h.ln, 2*time.Second)
-		h.conn <- accepted{c, err}
-	}()
-}
-
-// guest waits for the host to authenticate the guest.
-func (h *host) guest(t *testing.T) *tls.Conn {
-	t.Helper()
-	a := wait(t, h.conn, "host to authenticate the guest")
-	require.NoError(t, a.err)
-	return a.conn
-}
-
-// wait bounds every test wait so a stalled host or startup fails promptly.
-func wait[T any](t *testing.T, ch <-chan T, what string) T {
-	t.Helper()
-	select {
-	case v := <-ch:
-		return v
-	case <-time.After(10 * time.Second):
-		t.Fatalf("timed out waiting for %s", what)
-		panic("unreachable")
-	}
-}
@@ -1,24 +0,0 @@
-// lambda-agent runs inside a Lambda guest.
-//
-// A normal build reads its per-generation identity from fw_cfg, unloads
-// fw_cfg so nothing started later can read the guest key, and opens the
-// authenticated control connection to the host. It accepts no invocations and
-// never starts the function's bootstrap: the message protocol and grant
-// fencing do not exist yet. The agent never listens for the host.
-//
-// A lambdatestlink build opens the same connection, then relays one invocation
-// over a test carrier for local proofs; the carrier is not the guest protocol.
-package main
-
-import (
-	"context"
-	"flag"
-	"os"
-)
-
-func main() { os.Exit(run()) }
-
-func run() int {
-	flag.Parse()
-	return start(context.Background())
-}
@@ -1,276 +0,0 @@
-//go:build lambdatestlink
-
-package main
-
-import (
-	"archive/zip"
-	"bytes"
-	"crypto/sha256"
-	"encoding/hex"
-	"errors"
-	"fmt"
-	"io"
-	"io/fs"
-	"os"
-	"os/exec"
-	"path"
-	"path/filepath"
-	"strconv"
-	"strings"
-	"time"
-
-	"golang.org/x/sys/unix"
-)
-
-// Dev-only code delivery for the test path: the host attaches the ZIP as a
-// read-only disk and passes its exact size and SHA-256 through fw_cfg. This
-// is not the production delivery, and these bounds are not AWS limits.
-const (
-	entryPackageSize   = "test-package-size"
-	entryPackageSHA256 = "test-package-sha256"
-
-	devMaxZipBytes    = 16 << 20
-	devMaxUnzipBytes  = 64 << 20
-	devMaxEntries     = 1024
-	packageDevice     = "/dev/vda"
-	taskTmpfsSizeOpts = "mode=0755,size=72m"
-)
-
-type packageSpec struct {
-	size   int64
-	sha256 [sha256.Size]byte
-}
-
-type unpackLimits struct {
-	entries int
-	bytes   int64
-}
-
-var devLimits = unpackLimits{entries: devMaxEntries, bytes: devMaxUnzipBytes}
-
-// readPackageSpec reads the expected size and SHA-256 from fw_cfg; it must
-// run before fw_cfg is sealed.
-func readPackageSpec(fwCfgDir string) (packageSpec, error) {
-	var spec packageSpec
-	read := func(name string) (string, error) {
-		b, err := os.ReadFile(filepath.Join(fwCfgDir, name, "raw"))
-		if err != nil {
-			return "", fmt.Errorf("read %s: %w", name, err)
-		}
-		return strings.TrimSpace(string(b)), nil
-	}
-	s, err := read(entryPackageSize)
-	if err != nil {
-		return spec, err
-	}
-	spec.size, err = strconv.ParseInt(s, 10, 64)
-	if err != nil || spec.size <= 0 || spec.size > devMaxZipBytes {
-		return spec, fmt.Errorf("package size %q outside 1..%d bytes", s, devMaxZipBytes)
-	}
-	h, err := read(entryPackageSHA256)
-	if err != nil {
-		return spec, err
-	}
-	b, err := hex.DecodeString(h)
-	if err != nil || len(b) != sha256.Size {
-		return spec, errors.New("package sha256 is not 64 hex digits")
-	}
-	copy(spec.sha256[:], b)
-	return spec, nil
-}
-
-// taskPackage puts the package under dir: a fresh nosuid,nodev tmpfs, made
-// read-only once the files are in place.
-type taskPackage struct {
-	device     string
-	dir        string
-	loadDriver func() error
-	mountDir   func(dir string) error
-	sealDir    func(dir string) error
-}
-
-func devTaskPackage() taskPackage {
-	return taskPackage{device: packageDevice, dir: taskRoot, loadDriver: loadBlockDriver, mountDir: mountTaskDir, sealDir: sealTaskDir}
-}
-
-func (p taskPackage) install(spec packageSpec) error {
-	if err := p.loadDriver(); err != nil {
-		return fmt.Errorf("load block driver: %w", err)
-	}
-	dev, err := os.Open(p.device)
-	if err != nil {
-		return fmt.Errorf("open package disk: %w", err)
-	}
-	defer dev.Close()
-	if err := p.mountDir(p.dir); err != nil {
-		return fmt.Errorf("mount %s: %w", p.dir, err)
-	}
-	if err := unpack(dev, spec, p.dir, devLimits); err != nil {
-		return err
-	}
-	if err := p.sealDir(p.dir); err != nil {
-		return fmt.Errorf("make %s read-only: %w", p.dir, err)
-	}
-	return nil
-}
-
-// unpack reads exactly spec.size bytes once, checks their SHA-256, then
-// validates every entry before writing any of them under dir.
-func unpack(r io.ReaderAt, spec packageSpec, dir string, lim unpackLimits) error {
-	buf := make([]byte, spec.size)
-	if _, err := io.ReadFull(io.NewSectionReader(r, 0, spec.size), buf); err != nil {
-		return fmt.Errorf("read package: %w", err)
-	}
-	if sha256.Sum256(buf) != spec.sha256 {
-		return errors.New("package sha256 mismatch")
-	}
-	zr, err := zip.NewReader(bytes.NewReader(buf), spec.size)
-	if err != nil {
-		return fmt.Errorf("open package: %w", err)
-	}
-	if len(zr.File) > lim.entries {
-		return fmt.Errorf("package has %d entries, limit %d", len(zr.File), lim.entries)
-	}
-	names := make([]string, len(zr.File))
-	var declared int64
-	for i, f := range zr.File {
-		name, err := entryName(f.Name)
-		if err != nil {
-			return err
-		}
-		names[i] = name
-		switch mode := f.Mode(); {
-		case mode.IsDir():
-		case mode.IsRegular():
-			// Compared against what remains, so a huge size cannot wrap the sum.
-			if f.UncompressedSize64 > uint64(lim.bytes-declared) {
-				return fmt.Errorf("%q: unpacked size over the %d-byte limit", f.Name, lim.bytes)
-			}
-			declared += int64(f.UncompressedSize64)
-		default:
-			return fmt.Errorf("%q: %s entries are refused", f.Name, mode.Type())
-		}
-	}
-
-	root, err := os.OpenRoot(dir)
-	if err != nil {
-		return err
-	}
-	defer root.Close()
-	var written int64
-	for i, f := range zr.File {
-		n, err := extract(root, names[i], f, lim.bytes-written)
-		written += n
-		if err != nil {
-			return fmt.Errorf("%q: %w", f.Name, err)
-		}
-	}
-	return nil
-}
-
-// extract writes one entry, refusing it if its actual bytes exceed budget
-// whatever its header claims.
-func extract(root *os.Root, name string, f *zip.File, budget int64) (int64, error) {
-	if f.Mode().IsDir() {
-		return 0, mkdirs(root, name)
-	}
-	if d := path.Dir(name); d != "." {
-		if err := mkdirs(root, d); err != nil {
-			return 0, err
-		}
-	}
-	perm := os.FileMode(0o644)
-	if f.Mode()&0o111 != 0 {
-		perm = 0o755
-	}
-	in, err := f.Open()
-	if err != nil {
-		return 0, err
-	}
-	defer in.Close()
-	out, err := root.OpenFile(name, os.O_CREATE|os.O_EXCL|os.O_WRONLY, perm)
-	if err != nil {
-		return 0, err
-	}
-	// The umask applies at create; fchmod does not, so the mode is exact.
-	if err := out.Chmod(perm); err != nil {
-		out.Close()
-		return 0, err
-	}
-	n, err := io.Copy(out, io.LimitReader(in, budget+1))
-	if cerr := out.Close(); err == nil {
-		err = cerr
-	}
-	if err == nil && n > budget {
-		err = errors.New("unpacked bytes over the limit")
-	}
-	return n, err
-}
-
-// mkdirs creates each component of dir as mode 0755 whatever the umask. An
-// existing component must be a real directory, never a symlink.
-func mkdirs(root *os.Root, dir string) error {
-	cur := ""
-	for _, part := range strings.Split(dir, "/") {
-		cur = path.Join(cur, part)
-		if err := root.Mkdir(cur, 0o755); err != nil {
-			if !errors.Is(err, fs.ErrExist) {
-				return err
-			}
-			fi, err := root.Lstat(cur)
-			if err != nil {
-				return err
-			}
-			if !fi.IsDir() {
-				return fmt.Errorf("%q exists and is not a directory", cur)
-			}
-		}
-		if err := root.Chmod(cur, 0o755); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-// entryName returns a clean relative path, refusing anything that could name
-// a location outside the task root.
-func entryName(name string) (string, error) {
-	if name == "" || strings.ContainsAny(name, "\\\x00") || path.IsAbs(name) {
-		return "", fmt.Errorf("%q: entry name refused", name)
-	}
-	c := path.Clean(name)
-	if c == "." || c == ".." || strings.HasPrefix(c, "../") {
-		return "", fmt.Errorf("%q: entry name refused", name)
-	}
-	return c, nil
-}
-
-// loadBlockDriver loads virtio_blk, which the image ships but init does not
-// load, then waits briefly for the package disk to appear.
-func loadBlockDriver() error {
-	if err := exec.Command("/sbin/modprobe", "virtio_blk").Run(); err != nil {
-		var uts unix.Utsname
-		if uerr := unix.Uname(&uts); uerr != nil {
-			return uerr
-		}
-		ko := "/lib/modules/" + unix.ByteSliceToString(uts.Release[:]) + "/kernel/drivers/block/virtio_blk.ko"
-		if err := exec.Command("/sbin/insmod", ko).Run(); err != nil {
-			return fmt.Errorf("modprobe and insmod virtio_blk failed: %w", err)
-		}
-	}
-	for range 50 {
-		if _, err := os.Stat(packageDevice); err == nil {
-			return nil
-		}
-		time.Sleep(20 * time.Millisecond)
-	}
-	return fmt.Errorf("%s did not appear", packageDevice)
-}
-
-func mountTaskDir(dir string) error {
-	return unix.Mount("tmpfs", dir, "tmpfs", unix.MS_NOSUID|unix.MS_NODEV, taskTmpfsSizeOpts)
-}
-
-func sealTaskDir(dir string) error {
-	return unix.Mount("", dir, "", unix.MS_REMOUNT|unix.MS_RDONLY|unix.MS_NOSUID|unix.MS_NODEV, "")
-}
@@ -1,209 +0,0 @@
-//go:build lambdatestlink
-
-package main
-
-import (
-	"archive/zip"
-	"bytes"
-	"crypto/sha256"
-	"hash/crc32"
-	"io/fs"
-	"math"
-	"os"
-	"path/filepath"
-	"sort"
-	"syscall"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// testZip builds a ZIP; an entry named bootstrap is marked executable.
-func testZip(t *testing.T, files map[string]string) []byte {
-	t.Helper()
-	var buf bytes.Buffer
-	zw := zip.NewWriter(&buf)
-	names := make([]string, 0, len(files))
-	for n := range files {
-		names = append(names, n)
-	}
-	sort.Strings(names)
-	for _, n := range names {
-		h := &zip.FileHeader{Name: n, Method: zip.Deflate}
-		h.SetMode(0o644)
-		if n == "bootstrap" {
-			h.SetMode(0o755)
-		}
-		w, err := zw.CreateHeader(h)
-		require.NoError(t, err)
-		_, err = w.Write([]byte(files[n]))
-		require.NoError(t, err)
-	}
-	require.NoError(t, zw.Close())
-	return buf.Bytes()
-}
-
-// rawZip writes entries with headers set by the caller, so a test can claim
-// sizes or modes the data does not have.
-func rawZip(t *testing.T, entries ...*zip.FileHeader) []byte {
-	t.Helper()
-	var buf bytes.Buffer
-	zw := zip.NewWriter(&buf)
-	for _, h := range entries {
-		w, err := zw.CreateRaw(h)
-		require.NoError(t, err)
-		_, err = w.Write([]byte("x"))
-		require.NoError(t, err)
-	}
-	require.NoError(t, zw.Close())
-	return buf.Bytes()
-}
-
-func specFor(b []byte) packageSpec {
-	return packageSpec{size: int64(len(b)), sha256: sha256.Sum256(b)}
-}
-
-// Not parallel: the umask is process-wide, so the test sets a restrictive one
-// and restores it.
-func TestUnpackInstallsFilesWithFixedModes(t *testing.T) {
-	old := syscall.Umask(0o077)
-	t.Cleanup(func() { syscall.Umask(old) })
-	b := testZip(t, map[string]string{"bootstrap": "#!/bin/sh\n", "lib/data.txt": "data"})
-	dir := t.TempDir()
-	require.NoError(t, unpack(bytes.NewReader(b), specFor(b), dir, devLimits))
-
-	pfi, err := os.Stat(filepath.Join(dir, "lib"))
-	require.NoError(t, err)
-	assert.Equal(t, fs.FileMode(0o755), pfi.Mode().Perm(), "implicit parent dir")
-
-	fi, err := os.Stat(filepath.Join(dir, "bootstrap"))
-	require.NoError(t, err)
-	assert.Equal(t, fs.FileMode(0o755), fi.Mode().Perm(), "executable")
-	fi, err = os.Stat(filepath.Join(dir, "lib", "data.txt"))
-	require.NoError(t, err)
-	assert.Equal(t, fs.FileMode(0o644), fi.Mode().Perm())
-	got, err := os.ReadFile(filepath.Join(dir, "lib", "data.txt"))
-	require.NoError(t, err)
-	assert.Equal(t, "data", string(got))
-}
-
-func TestUnpackRefusesBeforeWritingAnything(t *testing.T) {
-	symlink := &zip.FileHeader{Name: "link", Method: zip.Store, CRC32: crc32.ChecksumIEEE([]byte("x")), CompressedSize64: 1, UncompressedSize64: 1}
-	symlink.SetMode(fs.ModeSymlink | 0o777)
-	fifo := &zip.FileHeader{Name: "pipe", Method: zip.Store, CRC32: crc32.ChecksumIEEE([]byte("x")), CompressedSize64: 1, UncompressedSize64: 1}
-	fifo.SetMode(fs.ModeNamedPipe | 0o644)
-	// The second size would wrap a plain running sum back under the limit.
-	big := func(name string, n uint64) *zip.FileHeader {
-		return &zip.FileHeader{Name: name, Method: zip.Store, CRC32: crc32.ChecksumIEEE([]byte("x")), CompressedSize64: 1, UncompressedSize64: n}
-	}
-	cases := map[string]struct {
-		zip  []byte
-		want string
-	}{
-		"parent traversal": {testZip(t, map[string]string{"a": "ok", "../escape": "x"}), "entry name refused"},
-		"nested traversal": {testZip(t, map[string]string{"a": "ok", "lib/../../escape": "x"}), "entry name refused"},
-		"absolute path":    {testZip(t, map[string]string{"a": "ok", "/etc/escape": "x"}), "entry name refused"},
-		"backslash":        {testZip(t, map[string]string{"a": "ok", `..\escape`: "x"}), "entry name refused"},
-		"symlink":          {rawZip(t, big("a", 1), symlink), "entries are refused"},
-		"named pipe":       {rawZip(t, big("a", 1), fifo), "entries are refused"},
-		"declared size":    {rawZip(t, big("a", devMaxUnzipBytes+1)), "over the"},
-		"wrapping sizes":   {rawZip(t, big("a", devMaxUnzipBytes), big("b", math.MaxUint64)), "over the"},
-	}
-	for name, tc := range cases {
-		t.Run(name, func(t *testing.T) {
-			dir := t.TempDir()
-			err := unpack(bytes.NewReader(tc.zip), specFor(tc.zip), dir, devLimits)
-			assert.ErrorContains(t, err, tc.want)
-			left, rerr := os.ReadDir(dir)
-			require.NoError(t, rerr)
-			assert.Empty(t, left, "files written before the refusal")
-		})
-	}
-}
-
-func TestUnpackRefusesTooManyEntries(t *testing.T) {
-	b := testZip(t, map[string]string{"a": "1", "b": "2", "c": "3"})
-	err := unpack(bytes.NewReader(b), specFor(b), t.TempDir(), unpackLimits{entries: 2, bytes: devMaxUnzipBytes})
-	assert.ErrorContains(t, err, "limit 2")
-}
-
-// The header claims a size within the limit, but the data is longer: the
-// actual bytes are refused, whatever the header says.
-func TestUnpackRefusesBytesBeyondTheLimit(t *testing.T) {
-	data := bytes.Repeat([]byte("a"), 64)
-	var buf bytes.Buffer
-	zw := zip.NewWriter(&buf)
-	h := &zip.FileHeader{Name: "a", Method: zip.Store, CRC32: crc32.ChecksumIEEE(data), CompressedSize64: uint64(len(data)), UncompressedSize64: 8}
-	w, err := zw.CreateRaw(h)
-	require.NoError(t, err)
-	_, err = w.Write(data)
-	require.NoError(t, err)
-	require.NoError(t, zw.Close())
-	b := buf.Bytes()
-
-	dir := t.TempDir()
-	err = unpack(bytes.NewReader(b), specFor(b), dir, unpackLimits{entries: 4, bytes: 16})
-	require.Error(t, err)
-	fi, serr := os.Stat(filepath.Join(dir, "a"))
-	if serr == nil {
-		assert.LessOrEqual(t, fi.Size(), int64(17))
-	}
-}
-
-func TestUnpackChecksSizeAndHash(t *testing.T) {
-	b := testZip(t, map[string]string{"bootstrap": "x"})
-	wrongHash := specFor(b)
-	wrongHash.sha256[0] ^= 1
-	assert.ErrorContains(t, unpack(bytes.NewReader(b), wrongHash, t.TempDir(), devLimits), "sha256 mismatch")
-
-	longer := specFor(b)
-	longer.size++
-	assert.ErrorContains(t, unpack(bytes.NewReader(b), longer, t.TempDir(), devLimits), "read package")
-}
-
-func TestReadPackageSpecBounds(t *testing.T) {
-	sum := "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
-	cases := map[string]struct {
-		size, hash string
-		want       string
-	}{
-		"valid":     {"10", sum, ""},
-		"zero":      {"0", sum, "outside"},
-		"too large": {"16777217", sum, "outside"},
-		"not hex":   {"10", "zz", "64 hex digits"},
-		"short":     {"10", sum[:62], "64 hex digits"},
-	}
-	for name, tc := range cases {
-		t.Run(name, func(t *testing.T) {
-			dir := t.TempDir()
-			for n, v := range map[string]string{entryPackageSize: tc.size, entryPackageSHA256: tc.hash} {
-				require.NoError(t, os.MkdirAll(filepath.Join(dir, n), 0o700))
-				require.NoError(t, os.WriteFile(filepath.Join(dir, n, "raw"), []byte(v), 0o600))
-			}
-			spec, err := readPackageSpec(dir)
-			if tc.want == "" {
-				require.NoError(t, err)
-				assert.Equal(t, int64(10), spec.size)
-				return
-			}
-			assert.ErrorContains(t, err, tc.want)
-		})
-	}
-}
-
-// A pre-existing symlink where a directory belongs is refused, not followed
-// or chmodded.
-func TestMkdirsRefusesSymlinkComponent(t *testing.T) {
-	dir := t.TempDir()
-	outside := t.TempDir()
-	require.NoError(t, os.Chmod(outside, 0o700))
-	require.NoError(t, os.Symlink(outside, filepath.Join(dir, "lib")))
-	root, err := os.OpenRoot(dir)
-	require.NoError(t, err)
-	defer root.Close()
-	assert.ErrorContains(t, mkdirs(root, "lib/sub"), "not a directory")
-	fi, err := os.Stat(outside)
-	require.NoError(t, err)
-	assert.Equal(t, fs.FileMode(0o700), fi.Mode().Perm(), "symlink target was chmodded")
-}
@@ -1,56 +0,0 @@
-//go:build !lambdatestlink
-
-package main
-
-import (
-	"context"
-	"crypto/tls"
-	"errors"
-	"fmt"
-	"io"
-	"log/slog"
-)
-
-// errNoProtocol is returned when the host sends anything: this build defines no
-// message protocol, so it accepts no work.
-var errNoProtocol = errors.New("host sent data, but this build accepts no invocations")
-
-func start(ctx context.Context) int {
-	code, err := defaultStartup().run(ctx)
-	if err != nil {
-		slog.Error("lambda-agent stopping", "exit", code, "err", err)
-	}
-	return code
-}
-
-// run authenticates to the host and holds the connection until it closes.
-func (s startup) run(ctx context.Context) (int, error) {
-	conn, code, err := s.connect(ctx)
-	if err != nil {
-		return code, err
-	}
-	defer conn.Close()
-	slog.Info("control connection open; invocations are not enabled in this build", "host", conn.RemoteAddr().String())
-	if err := awaitHostClose(ctx, conn); err != nil {
-		return exitLink, err
-	}
-	return exitClosed, nil
-}
-
-// awaitHostClose reads until the host closes the connection. Under TLS 1.3 a
-// host that rejects the guest certificate is only seen here, on first read.
-func awaitHostClose(ctx context.Context, conn *tls.Conn) error {
-	stop := context.AfterFunc(ctx, func() { _ = conn.Close() })
-	defer stop()
-	n, err := conn.Read(make([]byte, 1))
-	switch {
-	case n > 0:
-		return errNoProtocol
-	case errors.Is(err, io.EOF):
-		return nil
-	case ctx.Err() != nil:
-		return fmt.Errorf("control connection: %w", context.Cause(ctx))
-	default:
-		return fmt.Errorf("control connection: %w", err)
-	}
-}
@@ -1,171 +0,0 @@
-//go:build !lambdatestlink
-
-package main
-
-import (
-	"context"
-	"errors"
-	"net"
-	"os"
-	"testing"
-	"time"
-
-	lambdav1 "github.com/mulgadc/spinifex/contracts/lambda/v1"
-	"github.com/mulgadc/spinifex/spinifex/runtime/compute/lambda/guestconn"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-type result struct {
-	code int
-	err  error
-}
-
-func runAsync(ctx context.Context, s startup) <-chan result {
-	out := make(chan result, 1)
-	go func() {
-		code, err := s.run(ctx)
-		out <- result{code, err}
-	}()
-	return out
-}
-
-func TestStartupAuthenticatesAfterSealingFwCfg(t *testing.T) {
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-	h := newHost(t)
-	h.accept(ctx)
-	g := newGuest(t, h.entries())
-	done := runAsync(ctx, g.startup())
-
-	conn := h.guest(t)
-	select {
-	case <-g.sealedAt:
-	default:
-		t.Fatal("guest dialled before fw_cfg was sealed")
-	}
-	_, err := os.Stat(g.root)
-	assert.ErrorIs(t, err, os.ErrNotExist, "fw_cfg still readable while connected")
-
-	require.NoError(t, conn.Close())
-	res := wait(t, done, "startup to return")
-	assert.Equal(t, exitClosed, res.code)
-	assert.NoError(t, res.err)
-	assert.Equal(t, 1, g.unloads)
-}
-
-func TestStartupRefusesHostData(t *testing.T) {
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-	h := newHost(t)
-	h.accept(ctx)
-	done := runAsync(ctx, newGuest(t, h.entries()).startup())
-
-	conn := h.guest(t)
-	defer conn.Close()
-	_, err := conn.Write([]byte{0})
-	require.NoError(t, err)
-	res := wait(t, done, "startup to return")
-	assert.Equal(t, exitLink, res.code)
-	assert.ErrorIs(t, res.err, errNoProtocol)
-}
-
-// The host pins another generation's guest; the guest learns of the refusal
-// on its first read and fails with a link error, never a clean close.
-func TestStartupFailsWhenHostRefusesGuest(t *testing.T) {
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-	h := newHost(t)
-	h.accept(ctx)
-	other, err := guestconn.NewGeneration(scope, time.Hour)
-	require.NoError(t, err)
-	entries := h.entries()
-	wrong := other.GuestEntries(h.ln.Addr().String())
-	entries[lambdav1.EntryGuestKey], entries[lambdav1.EntryGuestCert] = wrong[lambdav1.EntryGuestKey], wrong[lambdav1.EntryGuestCert]
-	g := newGuest(t, entries)
-
-	res := wait(t, runAsync(ctx, g.startup()), "startup to return")
-	assert.Equal(t, exitLink, res.code)
-	require.Error(t, res.err)
-	assert.Contains(t, res.err.Error(), "bad certificate")
-	assert.Equal(t, 1, g.unloads)
-	select {
-	case a := <-h.conn:
-		require.Error(t, a.err, "host accepted a guest it does not pin")
-	default:
-	}
-}
-
-func TestStartupRefusesWithoutDialling(t *testing.T) {
-	h := newHost(t)
-	cases := map[string]struct {
-		entries map[string][]byte
-		unload  func(g *guest) func() error
-		want    string
-	}{
-		"missing entry": {
-			entries: func() map[string][]byte { e := h.entries(); delete(e, lambdav1.EntryHostCert); return e }(),
-			want:    "read host-cert",
-		},
-		"fw_cfg stays readable": {
-			entries: h.entries(),
-			unload:  func(*guest) func() error { return func() error { return errors.New("module is built in") } },
-			want:    "fw_cfg still readable",
-		},
-		"unload claims success but tree remains": {
-			entries: h.entries(),
-			unload:  func(*guest) func() error { return func() error { return nil } },
-			want:    "unload reported success",
-		},
-	}
-	for name, tc := range cases {
-		t.Run(name, func(t *testing.T) {
-			g := newGuest(t, tc.entries)
-			s := g.startup()
-			if tc.unload != nil {
-				s.unload = tc.unload(g)
-			}
-			code, err := s.run(context.Background())
-			assert.Equal(t, exitRefused, code)
-			assert.ErrorContains(t, err, tc.want)
-		})
-	}
-
-	// Nothing dialled the host in any case above.
-	require.NoError(t, h.ln.SetDeadline(time.Now().Add(50*time.Millisecond)))
-	_, err := h.ln.Accept()
-	var ne net.Error
-	require.ErrorAs(t, err, &ne)
-	assert.True(t, ne.Timeout())
-}
-
-// A missing entry still seals fw_cfg: the key may be present even when
-// another entry is not.
-func TestStartupSealsEvenWhenIdentityIsIncomplete(t *testing.T) {
-	h := newHost(t)
-	e := h.entries()
-	delete(e, lambdav1.EntryHostAddr)
-	g := newGuest(t, e)
-	code, err := g.startup().run(context.Background())
-	assert.Equal(t, exitRefused, code)
-	assert.ErrorContains(t, err, "read host-addr")
-	assert.Equal(t, 1, g.unloads)
-	_, statErr := os.Stat(g.root)
-	assert.ErrorIs(t, statErr, os.ErrNotExist)
-}
-
-func TestStartupStopsWithContext(t *testing.T) {
-	ctx, cancel := context.WithCancelCause(context.Background())
-	defer cancel(nil)
-	h := newHost(t)
-	h.accept(ctx)
-	done := runAsync(ctx, newGuest(t, h.entries()).startup())
-	conn := h.guest(t)
-	defer conn.Close()
-
-	reason := errors.New("guest shutting down")
-	cancel(reason)
-	res := wait(t, done, "startup to return")
-	assert.Equal(t, exitLink, res.code)
-	assert.ErrorIs(t, res.err, reason)
-}
@@ -1,138 +0,0 @@
-//go:build lambdatestlink
-
-package main
-
-import (
-	"context"
-	"errors"
-	"flag"
-	"fmt"
-	"log/slog"
-	"net"
-	"net/http"
-	"os"
-	"os/exec"
-	"time"
-
-	"github.com/mulgadc/spinifex/spinifex/agents/lambda/agent"
-	"github.com/mulgadc/spinifex/spinifex/agents/lambda/hostlink"
-	"github.com/mulgadc/spinifex/spinifex/agents/lambda/runtimeapi"
-)
-
-const (
-	runtimeAddr = "127.0.0.1:9001"
-	taskRoot    = "/var/task"
-)
-
-var handler = flag.String("handler", os.Getenv("_HANDLER"), "function handler passed to the bootstrap")
-
-// testlink relays one invocation over the test carrier on the authenticated
-// connection; the carrier is not the guest protocol.
-type testlink struct {
-	startup
-	pkg            taskPackage
-	runtimeAddr    string
-	startBootstrap func(ctx context.Context, env []string) (*exec.Cmd, error)
-}
-
-func start(ctx context.Context) int {
-	t := testlink{
-		startup:     defaultStartup(),
-		pkg:         devTaskPackage(),
-		runtimeAddr: runtimeAddr,
-		startBootstrap: func(ctx context.Context, env []string) (*exec.Cmd, error) {
-			return agent.StartBootstrap(ctx, taskRoot+"/bootstrap", env, os.Stdout, os.Stderr)
-		},
-	}
-	code, err := t.run(ctx)
-	if err != nil {
-		slog.Error("lambda-agent stopping", "exit", code, "err", err)
-	}
-	return code
-}
-
-func (t testlink) run(parent context.Context) (int, error) {
-	// The package values are fw_cfg entries, so read them before connect seals it.
-	spec, specErr := readPackageSpec(t.fwCfgDir)
-	conn, code, err := t.connect(parent)
-	if err != nil {
-		return code, errors.Join(err, specErr)
-	}
-	defer conn.Close()
-	if specErr != nil {
-		return exitRefused, specErr
-	}
-	link := hostlink.NewTestStream(conn)
-
-	// The handshake can return before the host refuses the guest, so nothing
-	// tenant-facing starts until the host's first valid frame arrives.
-	first, err := link.Next(parent)
-	if errors.Is(err, hostlink.ErrShutdown) {
-		return exitClosed, nil
-	}
-	if err != nil {
-		return exitLink, fmt.Errorf("first frame from host: %w", err)
-	}
-	if parent.Err() != nil {
-		return exitLink, context.Cause(parent)
-	}
-	if err := t.pkg.install(spec); err != nil {
-		return exitRefused, fmt.Errorf("install package: %w", err)
-	}
-
-	srv := runtimeapi.New()
-	ln, err := net.Listen("tcp", t.runtimeAddr)
-	if err != nil {
-		return exitLink, fmt.Errorf("listen runtime api: %w", err)
-	}
-	hs := &http.Server{Handler: srv.Handler(), ReadHeaderTimeout: 10 * time.Second}
-	go func() { _ = hs.Serve(ln) }()
-	defer hs.Close()
-
-	ctx, cancel := context.WithCancelCause(parent)
-	defer cancel(nil)
-	cmd, err := t.startBootstrap(ctx, []string{
-		"AWS_LAMBDA_RUNTIME_API=" + ln.Addr().String(),
-		"_HANDLER=" + *handler,
-		"LAMBDA_TASK_ROOT=" + taskRoot,
-		"PATH=/bin:/sbin:/usr/bin",
-	})
-	if err != nil {
-		return exitLink, fmt.Errorf("start bootstrap: %w", err)
-	}
-	exited := make(chan struct{})
-	go func() {
-		defer close(exited)
-		err := cmd.Wait()
-		cancel(fmt.Errorf("bootstrap exited: %w", err))
-	}()
-
-	err = agent.Run(ctx, &oneInvocation{Link: link, first: &first}, srv)
-	cancel(errors.New("agent stopping"))
-	<-exited
-	if err != nil {
-		return exitLink, err
-	}
-	return exitClosed, nil
-}
-
-// oneInvocation serves the host's first request and then stops the agent:
-// each test VM runs a single invocation.
-type oneInvocation struct {
-	hostlink.Link
-	first *hostlink.Request
-}
-
-var _ hostlink.Link = (*oneInvocation)(nil)
-
-func (o *oneInvocation) Next(ctx context.Context) (hostlink.Request, error) {
-	if err := ctx.Err(); err != nil {
-		return hostlink.Request{}, err
-	}
-	if o.first == nil {
-		return hostlink.Request{}, hostlink.ErrShutdown
-	}
-	req := *o.first
-	o.first = nil
-	return req, nil
-}
@@ -1,246 +0,0 @@
-//go:build lambdatestlink
-
-package main
-
-import (
-	"bytes"
-	"context"
-	"crypto/sha256"
-	"encoding/hex"
-	"io"
-	"net/http"
-	"os"
-	"os/exec"
-	"path/filepath"
-	"strconv"
-	"testing"
-	"time"
-
-	lambdav1 "github.com/mulgadc/spinifex/contracts/lambda/v1"
-	"github.com/mulgadc/spinifex/spinifex/agents/lambda/hostlink"
-	"github.com/mulgadc/spinifex/spinifex/runtime/compute/lambda/guestconn"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-const helperEnv = "LAMBDA_AGENT_TEST_BOOTSTRAP"
-
-// TestHelperBootstrap is the fake function bootstrap, run as a subprocess: it
-// echoes one invocation through the Runtime API, then waits for the next.
-func TestHelperBootstrap(t *testing.T) {
-	if os.Getenv(helperEnv) != "1" {
-		return
-	}
-	base := "http://" + os.Getenv("AWS_LAMBDA_RUNTIME_API") + "/2018-06-01/runtime/invocation/"
-	resp, err := http.Get(base + "next")
-	require.NoError(t, err)
-	body, err := io.ReadAll(resp.Body)
-	require.NoError(t, err)
-	resp.Body.Close()
-	id := resp.Header.Get("Lambda-Runtime-Aws-Request-Id")
-	post, err := http.Post(base+id+"/response", "application/json", bytes.NewReader(body))
-	require.NoError(t, err)
-	post.Body.Close()
-	_, _ = http.Get(base + "next")
-}
-
-type bootstrapStarts struct {
-	n       int
-	started chan struct{}
-	task    string
-	sealed  bool
-}
-
-// testlink builds a guest whose fw_cfg also carries a controlled package,
-// installed into a temp dir without mounting anything.
-func (b *bootstrapStarts) testlink(t *testing.T, entries map[string][]byte) testlink {
-	t.Helper()
-	zipBytes := testZip(t, map[string]string{"bootstrap": "#!/bin/sh\n", "lib/data.txt": "data"})
-	disk := filepath.Join(t.TempDir(), "disk")
-	require.NoError(t, os.WriteFile(disk, zipBytes, 0o600))
-	sum := sha256.Sum256(zipBytes)
-	entries[entryPackageSize] = []byte(strconv.Itoa(len(zipBytes)))
-	entries[entryPackageSHA256] = []byte(hex.EncodeToString(sum[:]))
-	g := newGuest(t, entries)
-	b.started = make(chan struct{}, 1)
-	b.task = t.TempDir()
-	return testlink{
-		startup: g.startup(),
-		pkg: taskPackage{
-			device: disk, dir: b.task,
-			loadDriver: func() error { return nil },
-			mountDir:   func(string) error { return nil },
-			sealDir:    func(string) error { b.sealed = true; return nil },
-		},
-		runtimeAddr: "127.0.0.1:0",
-		startBootstrap: func(ctx context.Context, env []string) (*exec.Cmd, error) {
-			b.n++
-			b.started <- struct{}{}
-			cmd := exec.CommandContext(ctx, os.Args[0], "-test.run=^TestHelperBootstrap$")
-			cmd.Env = append(env, helperEnv+"=1")
-			return cmd, cmd.Start()
-		},
-	}
-}
-
-func runTestlinkAsync(ctx context.Context, tl testlink) <-chan result {
-	out := make(chan result, 1)
-	go func() {
-		code, err := tl.run(ctx)
-		out <- result{code, err}
-	}()
-	return out
-}
-
-type result struct {
-	code int
-	err  error
-}
-
-func TestTestlinkServesOneInvocationThenStops(t *testing.T) {
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-	h := newHost(t)
-	h.accept(ctx)
-	var b bootstrapStarts
-	done := runTestlinkAsync(ctx, b.testlink(t, h.entries()))
-
-	conn := h.guest(t)
-	defer conn.Close()
-	select {
-	case <-b.started:
-		t.Fatal("bootstrap started before the host sent a frame")
-	case <-time.After(100 * time.Millisecond):
-	}
-	hs := hostlink.NewTestStream(conn)
-	req := hostlink.Request{GrantID: "g-1", AttemptID: "a-1", RequestID: "r-1", DeadlineMs: time.Now().Add(5 * time.Second).UnixMilli(), Payload: []byte(`{"a":40,"b":2}`)}
-	require.NoError(t, hs.HostSend(req))
-	got, err := hs.HostResult(ctx)
-	require.NoError(t, err)
-	assert.Equal(t, hostlink.Response{GrantID: "g-1", AttemptID: "a-1", RequestID: "r-1", Payload: req.Payload}, got)
-
-	// A second invocation on the same VM is never served. The agent may
-	// already have closed the connection, so a failed send is a refusal too.
-	second := req
-	second.RequestID = "r-2"
-	sendErr := hs.HostSend(second)
-	res := wait(t, done, "agent to stop after one invocation")
-	assert.Equal(t, exitClosed, res.code)
-	assert.NoError(t, res.err)
-	if sendErr == nil {
-		_, err = hs.HostResult(ctx)
-		assert.Error(t, err, "agent answered a second invocation")
-	}
-	assert.Equal(t, 1, b.n)
-	assert.True(t, b.sealed, "task dir not made read-only")
-	assert.FileExists(t, filepath.Join(b.task, "lib", "data.txt"))
-}
-
-func TestTestlinkShutdownBeforeInvocationNeverStartsBootstrap(t *testing.T) {
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-	h := newHost(t)
-	h.accept(ctx)
-	var b bootstrapStarts
-	done := runTestlinkAsync(ctx, b.testlink(t, h.entries()))
-
-	conn := h.guest(t)
-	defer conn.Close()
-	require.NoError(t, hostlink.NewTestStream(conn).HostShutdown())
-	res := wait(t, done, "agent to stop")
-	assert.Equal(t, exitClosed, res.code)
-	assert.NoError(t, res.err)
-	assert.Zero(t, b.n)
-}
-
-// The guest's handshake completes, but the host pins another generation's
-// guest; the refusal arrives on first read and the bootstrap never starts.
-func TestTestlinkHostRefusalNeverStartsBootstrap(t *testing.T) {
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-	h := newHost(t)
-	h.accept(ctx)
-	other, err := guestconn.NewGeneration(scope, time.Hour)
-	require.NoError(t, err)
-	entries := h.entries()
-	wrong := other.GuestEntries(h.ln.Addr().String())
-	entries[lambdav1.EntryGuestKey], entries[lambdav1.EntryGuestCert] = wrong[lambdav1.EntryGuestKey], wrong[lambdav1.EntryGuestCert]
-	var b bootstrapStarts
-
-	res := wait(t, runTestlinkAsync(ctx, b.testlink(t, entries)), "agent to stop")
-	assert.Equal(t, exitLink, res.code)
-	require.Error(t, res.err)
-	assert.Contains(t, res.err.Error(), "bad certificate")
-	assert.Zero(t, b.n)
-}
-
-func TestTestlinkHostCloseBeforeFrameNeverStartsBootstrap(t *testing.T) {
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-	h := newHost(t)
-	h.accept(ctx)
-	var b bootstrapStarts
-	done := runTestlinkAsync(ctx, b.testlink(t, h.entries()))
-
-	require.NoError(t, h.guest(t).Close())
-	res := wait(t, done, "agent to stop")
-	assert.Equal(t, exitLink, res.code)
-	assert.ErrorContains(t, res.err, "first frame from host")
-	assert.Zero(t, b.n)
-}
-
-// A cancelled context is reported before the buffered request is delivered,
-// and the request stays undelivered.
-func TestOneInvocationHonoursCancelledContext(t *testing.T) {
-	ctx, cancel := context.WithCancel(context.Background())
-	cancel()
-	o := &oneInvocation{first: &hostlink.Request{RequestID: "r-1"}}
-	_, err := o.Next(ctx)
-	require.ErrorIs(t, err, context.Canceled)
-
-	req, err := o.Next(context.Background())
-	require.NoError(t, err)
-	assert.Equal(t, "r-1", req.RequestID)
-}
-
-// A package that fails its check is refused after authentication, and the
-// bootstrap never starts.
-func TestTestlinkBadPackageNeverStartsBootstrap(t *testing.T) {
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-	h := newHost(t)
-	h.accept(ctx)
-	var b bootstrapStarts
-	tl := b.testlink(t, h.entries())
-	tl.pkg.device = filepath.Join(t.TempDir(), "other")
-	require.NoError(t, os.WriteFile(tl.pkg.device, testZip(t, map[string]string{"bootstrap": "x"}), 0o600))
-	done := runTestlinkAsync(ctx, tl)
-
-	conn := h.guest(t)
-	defer conn.Close()
-	require.NoError(t, hostlink.NewTestStream(conn).HostSend(hostlink.Request{RequestID: "r-1"}))
-	res := wait(t, done, "agent to stop")
-	assert.Equal(t, exitRefused, res.code)
-	assert.ErrorContains(t, res.err, "install package")
-	assert.Zero(t, b.n)
-	assert.False(t, b.sealed)
-}
-
-// Missing package values still seal fw_cfg, and the agent refuses before
-// waiting for any frame.
-func TestTestlinkMissingPackageSpecRefuses(t *testing.T) {
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Second)
-	defer cancel()
-	h := newHost(t)
-	h.accept(ctx)
-	var b bootstrapStarts
-	tl := b.testlink(t, h.entries())
-	require.NoError(t, os.RemoveAll(filepath.Join(tl.fwCfgDir, entryPackageSHA256)))
-
-	res := wait(t, runTestlinkAsync(ctx, tl), "agent to stop")
-	assert.Equal(t, exitRefused, res.code)
-	assert.ErrorContains(t, res.err, "read "+entryPackageSHA256)
-	assert.Zero(t, b.n)
-	_, err := os.Stat(tl.fwCfgRoot)
-	assert.ErrorIs(t, err, os.ErrNotExist, "fw_cfg not sealed")
-}
@@ -19,7 +19,7 @@ import (
 	"syscall"

 	"github.com/mulgadc/bluebottle/pkg/otelsetup"
-	lbagent "github.com/mulgadc/spinifex/spinifex/agents/elbv2"
+	"github.com/mulgadc/spinifex/spinifex/lbagent"

 	_ "github.com/mulgadc/bluebottle/pkg/fipsboot"
 )
@@ -1,140 +0,0 @@
-// sqs-worker runs inside the SQS microVM, next to its own SQS NATS server.
-//
-// Usage:
-//
-//	sqs-worker boot
-//	sqs-worker ready
-//
-// boot selects and mounts the guest's data disk named by fw_cfg, asks the
-// gateway for its receipt key decision with its instance-role credentials,
-// then loads the recorded key, or creates one on a new volume and records its
-// fingerprint, before the guest's SQS store first starts on that disk. ready
-// then keeps checking the guest's own loopback JetStream, keeping a readiness
-// marker only while it answers, and serves SQS owner calls against it, pulling
-// them from the gateway with the same credentials.
-//
-// Serving is refused unless the gateway reports a single-node host cluster.
-// A disk whose receipt key is missing or does not match the recorded one
-// refuses to serve; recovering it needs a procedure not yet designed, and
-// nothing deletes or replaces the volume.
-package main
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"os"
-	"os/signal"
-	"syscall"
-	"time"
-
-	"github.com/nats-io/nats.go/jetstream"
-
-	"github.com/mulgadc/spinifex/internal/gwsign"
-	"github.com/mulgadc/spinifex/internal/sqsworkergw"
-	"github.com/mulgadc/spinifex/spinifex/agents/sqs/workerboot"
-	"github.com/mulgadc/spinifex/spinifex/agents/sqs/workerkey"
-	"github.com/mulgadc/spinifex/spinifex/domains/sqs/workerserve"
-	"github.com/mulgadc/spinifex/spinifex/foundation/state/clustersize"
-)
-
-// The cluster CA the daemon supplies; the only root the client trusts.
-const caPath = "/sys/firmware/qemu_fw_cfg/by_name/opt/spinifex/ca-cert/raw"
-
-// newClaimer signs with the IMDS instance-role credentials only; there is
-// no static-key fallback.
-func newClaimer() workerboot.NewClaimer {
-	return func(region, gatewayURL string) (workerkey.Claimer, error) {
-		c, err := newClient(region, gatewayURL)
-		if err != nil {
-			return nil, err
-		}
-		return workerboot.GatewayClaimer{Client: c}, nil
-	}
-}
-
-func newClient(region, gatewayURL string) (*sqsworkergw.Client, error) {
-	ca, err := os.ReadFile(caPath)
-	if err != nil {
-		return nil, fmt.Errorf("read cluster CA: %w", err)
-	}
-	return sqsworkergw.New(gatewayURL, region, ca, gwsign.NewInstanceRole())
-}
-
-func main() {
-	if len(os.Args) != 2 || (os.Args[1] != "boot" && os.Args[1] != "ready") {
-		fmt.Fprintln(os.Stderr, "usage: sqs-worker boot|ready")
-		os.Exit(2)
-	}
-	logf := func(msg string) { fmt.Fprintf(os.Stderr, "[sqs-worker] %s\n", msg) }
-	run := boot
-	if os.Args[1] == "ready" {
-		run = ready
-	}
-	if err := run(logf); err != nil {
-		if os.Args[1] == "boot" && workerboot.Transient(err) {
-			logf("boot not settled, will retry: " + err.Error())
-			os.Exit(exitTransient)
-		}
-		logf("FATAL: " + err.Error())
-		os.Exit(1)
-	}
-}
-
-// exitTransient tells the guest's supervisor that boot may be run again.
-const exitTransient = 75
-
-func config(logf func(string)) workerboot.Config {
-	return workerboot.Config{
-		FwCfgDir:      "/sys/firmware/qemu_fw_cfg/by_name/opt/spinifex/sqs-worker",
-		SysBlock:      "/sys/block",
-		DevDir:        "/dev",
-		MountInfo:     "/proc/self/mountinfo",
-		DataDir:       "/data",
-		RunDir:        "/run/sqs-worker",
-		Disk:          workerboot.SystemDisk{E2fsck: "/sbin/e2fsck"},
-		IsBlockDevice: workerboot.IsBlockDevice,
-		NewClaimer:    newClaimer(),
-		Attempts:      60,
-		Wait:          5 * time.Second,
-		Log:           logf,
-	}
-}
-
-func boot(logf func(string)) error {
-	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Minute)
-	defer cancel()
-	_, err := workerboot.Boot(ctx, config(logf))
-	return err
-}
-
-// ready runs until init stops it; the marker is removed on the way out.
-func ready(logf func(string)) error {
-	ctx, cancel := signal.NotifyContext(context.Background(), syscall.SIGTERM, syscall.SIGINT)
-	defer cancel()
-	// The store is one guest, so its streams and buckets are R1.
-	if err := clustersize.Declare(1); err != nil {
-		return err
-	}
-	err := workerboot.Watch(ctx, workerboot.ReadyConfig{
-		Config:      config(logf),
-		Checker:     workerboot.NATSChecker{},
-		CallTimeout: 30 * time.Second,
-		Refresh:     30 * time.Second,
-		Refused:     5 * time.Minute,
-		Serve: &workerboot.ServeConfig{
-			Connector: workerboot.NATSConnector{},
-			Run: func(ctx context.Context, region, gatewayURL string, js jetstream.JetStream, receiptKey []byte) error {
-				c, err := newClient(region, gatewayURL)
-				if err != nil {
-					return err
-				}
-				return workerserve.Run(ctx, c, js, receiptKey, logf)
-			},
-		},
-	})
-	if errors.Is(err, context.Canceled) {
-		return nil
-	}
-	return err
-}
@@ -1,52 +0,0 @@
-# Admission contract, version 1
-
-This package owns the cross-process contract for the admission domain's
-quota override. It is not an in-process service interface or the owner of
-quota state.
-
-## Seal account quota override
-
-`SealAccountQuotaOverrideSubject` (`admission.v1.SealAccountQuotaOverride`) is
-a request/reply route on which a gateway, in the `awsgw-quota-seal` queue
-group, irreversibly seals one account's quota override record.
-`domains/admission/quota` owns it: `awsgw` serves it.
-`operator/accountlifecycle` is the consumer: it calls this subject to fence every
-override writer at the quota owner before the account record is removed.
-
-The request names the account in its body (`account_id`) and may carry an
-opaque `correlation_ref` that is echoed for logs.
-`awsgw` ignores `X-Account-ID` for this subject: the account sealed is the one
-named in the body.
-A seal is refused with `IncorrectState` unless IAM already holds the account
-as `TERMINATING`; a precondition read failure, or no termination checker
-wired, answers `InternalError`.
-Both refusals write nothing and never open the override bucket.
-
-A reply is sent only on success: `disposition` is always `sealed` and
-`revision` is the stream leader's accepted write for that seal.
-A failure is the standard awserrors error payload, not this reply shape.
-Sealing is idempotent: a seal on an already-sealed record re-writes the same
-value and returns a fresh, higher revision.
-Any current gateway may answer; the leader-accepted revision is the evidence
-whichever one does, and the override bucket is opened at seal time even on a
-gateway whose quotas were disabled at startup.
-
-## Seal-quota-override capability
-
-`AccountQuotaOverrideSealCapabilitySubject(node)` (`admission.v1.AccountQuotaOverrideSealCapability.<node>`) is a per-node, read-only request/reply route on which `operator/accountlifecycle` asks one configured gateway whether it supports the quota override seal, immediately before every seal attempt.
-The quota owner (`domains/admission/quota`) owns it: `awsgw` serves it with no queue group, so a request addressed to one node reaches only subscribers configured as that node, and two gateways sharing a node ID both answer.
-The consumer's quota seal reaper probes every configured node that runs `awsgw` and sends no seal request unless every one answers compatible.
-
-`AccountQuotaOverrideSealCapabilityVersion` is a claim about the whole binary's writers, not about the responder: version 1 means every quota override writer in the binary is revision-guarded and refuses a sealed record, and the binary serves the seal subject.
-A gateway binary without this responder has no subscriber, so the probe for that node reads as incomplete (`no-reply`), the same as a stopped or partitioned node.
-The reply proves nothing beyond the moment it was sent: a gateway downgraded or replaced after a successful probe is outside the guarantee.
-
-### Compatibility boundary
-
-The subject name carries the contract major; `account_quota_seal_test.go` and `account_quota_seal_capability_test.go`
-preserve the version-1 JSON shapes and the subject builder.
-Producer and consumer are in the coordinated Spinifex release, so the window
-is N and N-1.
-A gateway that predates the subject has no subscription, so the request gets
-no responder.
-An incompatible change to the subject or fields needs a new major.
@@ -1,31 +0,0 @@
-// Package admissionv1 holds the admission domain's cross-process contract:
-// the subjects, request/reply shapes and wire vocabulary the quota owner and
-// its consumers share.
-package admissionv1
-
-// SealAccountQuotaOverrideSubject is the request/reply subject on which a
-// gateway seals one account's quota override record. Sealing is irreversible
-// and refused unless IAM already holds the account as TERMINATING.
-const SealAccountQuotaOverrideSubject = "admission.v1.SealAccountQuotaOverride"
-
-// AccountQuotaOverrideDispositionSealed is the only disposition a successful
-// reply carries: a reply is sent only on success, so there is no other value.
-const AccountQuotaOverrideDispositionSealed = "sealed"
-
-// SealAccountQuotaOverrideRequest asks for one account's quota override to be
-// sealed. CorrelationRef is an opaque caller reference echoed for logs; it
-// grants nothing and is never a fence or authority to write.
-type SealAccountQuotaOverrideRequest struct {
-	AccountID      string `json:"account_id"`
-	CorrelationRef string `json:"correlation_ref,omitempty"`
-}
-
-// SealAccountQuotaOverrideReply confirms accountID's quota override record
-// was sealed at Revision, the stream leader's accepted write for that seal.
-// A failure is the standard awserrors error payload, not this type.
-type SealAccountQuotaOverrideReply struct {
-	AccountID      string `json:"account_id"`
-	CorrelationRef string `json:"correlation_ref,omitempty"`
-	Disposition    string `json:"disposition"`
-	Revision       uint64 `json:"revision"`
-}
@@ -1,39 +0,0 @@
-package admissionv1
-
-import "strings"
-
-// AccountQuotaOverrideSealCapabilityVersion is the version this binary reports.
-// Version 1: every quota override writer in the binary is revision-guarded and
-// refuses a sealed record, and the seal subject is served.
-const AccountQuotaOverrideSealCapabilityVersion = 1
-
-// AccountQuotaOverrideSealCapabilitySubject is one gateway's read-only
-// seal-capability route, addressed per node so a probe reaches exactly the
-// node it asks about.
-func AccountQuotaOverrideSealCapabilitySubject(node string) string {
-	return "admission.v1.AccountQuotaOverrideSealCapability." + node
-}
-
-// ValidSealCapabilityNode reports whether node is exactly one NATS subject
-// token. Responder and probe both check it before building a subject, so
-// neither can address a wildcard or another node's route.
-func ValidSealCapabilityNode(node string) bool {
-	return node != "" && !strings.ContainsAny(node, ".*>\t\n\r ")
-}
-
-// AccountQuotaOverrideSealCapabilityRequest asks node whether it supports the
-// quota override seal. CorrelationRef is an opaque caller reference echoed for
-// logs; it grants nothing and is never a fence or authority to write.
-type AccountQuotaOverrideSealCapabilityRequest struct {
-	Node           string `json:"node"`
-	CorrelationRef string `json:"correlation_ref,omitempty"`
-}
-
-// AccountQuotaOverrideSealCapabilityReply reports the responding node's
-// capability version. It carries no account data and proves nothing beyond
-// the moment it was sent.
-type AccountQuotaOverrideSealCapabilityReply struct {
-	Node              string `json:"node"`
-	CapabilityVersion int    `json:"capability_version"`
-	CorrelationRef    string `json:"correlation_ref,omitempty"`
-}
@@ -1,43 +0,0 @@
-package admissionv1
-
-import (
-	"encoding/json"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-)
-
-func TestAccountQuotaOverrideSealCapabilitySubject(t *testing.T) {
-	require.Equal(t, "admission.v1.AccountQuotaOverrideSealCapability.node-1", AccountQuotaOverrideSealCapabilitySubject("node-1"))
-	require.Equal(t, "admission.v1.AccountQuotaOverrideSealCapability.node-2", AccountQuotaOverrideSealCapabilitySubject("node-2"))
-}
-
-func TestAccountQuotaOverrideSealCapabilityRequestJSONContract(t *testing.T) {
-	data, err := json.Marshal(AccountQuotaOverrideSealCapabilityRequest{Node: "node-1", CorrelationRef: "req-1"})
-	require.NoError(t, err)
-	require.JSONEq(t, `{"node":"node-1","correlation_ref":"req-1"}`, string(data))
-
-	data, err = json.Marshal(AccountQuotaOverrideSealCapabilityRequest{Node: "node-1"})
-	require.NoError(t, err)
-	require.JSONEq(t, `{"node":"node-1"}`, string(data))
-}
-
-func TestAccountQuotaOverrideSealCapabilityReplyJSONContract(t *testing.T) {
-	reply := AccountQuotaOverrideSealCapabilityReply{Node: "node-1", CapabilityVersion: 1, CorrelationRef: "req-1"}
-	data, err := json.Marshal(reply)
-	require.NoError(t, err)
-	require.JSONEq(t, `{"node":"node-1","capability_version":1,"correlation_ref":"req-1"}`, string(data))
-
-	data, err = json.Marshal(AccountQuotaOverrideSealCapabilityReply{Node: "node-1", CapabilityVersion: 1})
-	require.NoError(t, err)
-	require.JSONEq(t, `{"node":"node-1","capability_version":1}`, string(data))
-}
-
-func TestValidSealCapabilityNode(t *testing.T) {
-	for _, node := range []string{"node-1", "node_2", "n3"} {
-		require.True(t, ValidSealCapabilityNode(node), node)
-	}
-	for _, node := range []string{"", "a.b", "*", ">", "node-*", "node >", "node\t1", "node\n1"} {
-		require.False(t, ValidSealCapabilityNode(node), "%q", node)
-	}
-}
@@ -1,43 +0,0 @@
-package admissionv1
-
-import (
-	"encoding/json"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-)
-
-func TestSealAccountQuotaOverrideSubject(t *testing.T) {
-	require.Equal(t, "admission.v1.SealAccountQuotaOverride", SealAccountQuotaOverrideSubject)
-}
-
-func TestSealAccountQuotaOverrideRequestJSONContract(t *testing.T) {
-	data, err := json.Marshal(SealAccountQuotaOverrideRequest{AccountID: "111122223333", CorrelationRef: "req-1"})
-	require.NoError(t, err)
-	require.JSONEq(t, `{"account_id":"111122223333","correlation_ref":"req-1"}`, string(data))
-
-	data, err = json.Marshal(SealAccountQuotaOverrideRequest{AccountID: "111122223333"})
-	require.NoError(t, err)
-	require.JSONEq(t, `{"account_id":"111122223333"}`, string(data))
-}
-
-func TestSealAccountQuotaOverrideReplyJSONContract(t *testing.T) {
-	reply := SealAccountQuotaOverrideReply{
-		AccountID:      "111122223333",
-		CorrelationRef: "req-1",
-		Disposition:    AccountQuotaOverrideDispositionSealed,
-		Revision:       42,
-	}
-	data, err := json.Marshal(reply)
-	require.NoError(t, err)
-	require.JSONEq(t, `{
-		"account_id": "111122223333",
-		"correlation_ref": "req-1",
-		"disposition": "sealed",
-		"revision": 42
-	}`, string(data))
-
-	data, err = json.Marshal(SealAccountQuotaOverrideReply{AccountID: "111122223333", Disposition: AccountQuotaOverrideDispositionSealed})
-	require.NoError(t, err)
-	require.JSONEq(t, `{"account_id":"111122223333","disposition":"sealed","revision":0}`, string(data))
-}
@@ -1,217 +0,0 @@
-package clusterv1
-
-import "regexp"
-
-const (
-	// NodeFactsSubject fans out a request for each daemon's hardware and
-	// cabling description. Its reply payload is NodeFacts.
-	NodeFactsSubject = "spinifex.node.facts"
-
-	nodeNetTestPrefix = "spinifex.node.nettest."
-)
-
-var nodeIDPattern = regexp.MustCompile(`^[A-Za-z0-9_-]{1,64}$`)
-
-// ValidNodeID reports whether a node name is safe to place in a subject: no
-// NATS token separator or wildcard can get through.
-func ValidNodeID(node string) bool {
-	return nodeIDPattern.MatchString(node)
-}
-
-// NodeFactsOfSubject asks one node alone for its NodeFacts.
-func NodeFactsOfSubject(node string) string {
-	return NodeFactsSubject + "." + node
-}
-
-// NetTestServeSubject asks one node to start a one-shot throughput server.
-func NetTestServeSubject(node string) string {
-	return nodeNetTestPrefix + node + ".serve"
-}
-
-// NetTestRunSubject asks one node to run the client side of a throughput test.
-func NetTestRunSubject(node string) string {
-	return nodeNetTestPrefix + node + ".run"
-}
-
-// Planes a node's NICs can carry, named as the installer names them.
-const (
-	PlaneWAN = "wan"
-	PlaneLAN = "lan"
-	PlaneVPC = "vpc"
-)
-
-// NetTestPort is the TCP port reserved for node-to-node throughput tests.
-const NetTestPort = 5001
-
-// NodeFacts describes one node's hardware, OS and cabling. Fields a host
-// cannot report are left empty, and Sources says why.
-type NodeFacts struct {
-	Node        string            `json:"node"`
-	CollectedAt string            `json:"collected_at,omitempty"`
-	FormFactor  string            `json:"form_factor"`
-	Virt        string            `json:"virt,omitempty"`
-	System      SystemFacts       `json:"system"`
-	OS          OSFacts           `json:"os"`
-	CPU         CPUFacts          `json:"cpu"`
-	Memory      MemoryFacts       `json:"memory"`
-	NICs        []NICFacts        `json:"nics"`
-	Planes      []PlaneFacts      `json:"planes"`
-	Sources     map[string]string `json:"sources"`
-}
-
-// SystemFacts is the machine's identity from DMI.
-type SystemFacts struct {
-	Vendor       string `json:"vendor,omitempty"`
-	Product      string `json:"product,omitempty"`
-	Family       string `json:"family,omitempty"`
-	Version      string `json:"version,omitempty"`
-	Serial       string `json:"serial,omitempty"`
-	UUID         string `json:"uuid,omitempty"`
-	ChassisType  string `json:"chassis_type,omitempty"`
-	ChassisAsset string `json:"chassis_asset,omitempty"`
-	BoardVendor  string `json:"board_vendor,omitempty"`
-	BoardProduct string `json:"board_product,omitempty"`
-	BoardSerial  string `json:"board_serial,omitempty"`
-	BIOSVendor   string `json:"bios_vendor,omitempty"`
-	BIOSVersion  string `json:"bios_version,omitempty"`
-	BIOSDate     string `json:"bios_date,omitempty"`
-	DeviceModel  string `json:"device_model,omitempty"`
-}
-
-// OSFacts names the running OS and Spinifex build.
-type OSFacts struct {
-	Name          string `json:"name,omitempty"`
-	Kernel        string `json:"kernel,omitempty"`
-	Arch          string `json:"arch,omitempty"`
-	Version       string `json:"spx_version,omitempty"`
-	Commit        string `json:"spx_commit,omitempty"`
-	UptimeSeconds int64  `json:"uptime_seconds,omitempty"`
-	Hostname      string `json:"hostname,omitempty"`
-}
-
-// CPUFacts summarises the sockets. Threads and Cores are totals. Features are
-// the flags worth naming; Flags is every flag the CPU reports.
-type CPUFacts struct {
-	Model          string   `json:"model,omitempty"`
-	Vendor         string   `json:"vendor,omitempty"`
-	Sockets        int      `json:"sockets"`
-	CoresPerSocket int      `json:"cores_per_socket,omitempty"`
-	Cores          int      `json:"cores"`
-	Threads        int      `json:"threads"`
-	MaxMHz         int      `json:"max_mhz,omitempty"`
-	CurrentMHz     int      `json:"current_mhz,omitempty"`
-	Virtualization string   `json:"virtualization,omitempty"`
-	Features       []string `json:"features,omitempty"`
-	Flags          []string `json:"flags,omitempty"`
-}
-
-// MemoryFacts groups identical DIMMs so a 32-slot board reads as one line.
-type MemoryFacts struct {
-	TotalBytes    uint64        `json:"total_bytes"`
-	SlotsUsed     int           `json:"slots_used"`
-	SlotsTotal    int           `json:"slots_total"`
-	MaxCapacity   string        `json:"max_capacity,omitempty"`
-	ECC           string        `json:"ecc,omitempty"`
-	Groups        []MemoryGroup `json:"groups"`
-	OSTotalBytes  uint64        `json:"os_total_bytes,omitempty"`
-	OSAvailBytes  uint64        `json:"os_available_bytes,omitempty"`
-	HugePageBytes uint64        `json:"huge_page_bytes,omitempty"`
-}
-
-// MemoryGroup is a set of DIMMs alike in every field shown. ConfiguredMTs
-// below SpeedMTs means the board runs them slower than rated.
-type MemoryGroup struct {
-	Count         int      `json:"count"`
-	SizeBytes     uint64   `json:"size_bytes"`
-	Type          string   `json:"type,omitempty"`
-	TypeDetail    string   `json:"type_detail,omitempty"`
-	FormFactor    string   `json:"form_factor,omitempty"`
-	SpeedMTs      int      `json:"speed_mts,omitempty"`
-	ConfiguredMTs int      `json:"configured_mts,omitempty"`
-	Manufacturer  string   `json:"manufacturer,omitempty"`
-	PartNumber    string   `json:"part_number,omitempty"`
-	Rank          string   `json:"rank,omitempty"`
-	Serials       []string `json:"serials,omitempty"`
-}
-
-// NICFacts is one physical network interface and, where LLDP reports it, the
-// switch port it is cabled to.
-type NICFacts struct {
-	Name      string        `json:"name"`
-	MAC       string        `json:"mac,omitempty"`
-	Driver    string        `json:"driver,omitempty"`
-	Firmware  string        `json:"firmware,omitempty"`
-	BusInfo   string        `json:"bus_info,omitempty"`
-	Model     string        `json:"model,omitempty"`
-	SpeedMbps int           `json:"speed_mbps,omitempty"`
-	MaxMbps   int           `json:"max_mbps,omitempty"`
-	Duplex    string        `json:"duplex,omitempty"`
-	Port      string        `json:"port,omitempty"`
-	MTU       int           `json:"mtu,omitempty"`
-	State     string        `json:"state"`
-	Master    string        `json:"master,omitempty"`
-	Planes    []string      `json:"planes,omitempty"`
-	Neighbor  *LLDPNeighbor `json:"neighbor,omitempty"`
-}
-
-// LLDPNeighbor is what the switch on the other end of a NIC advertises.
-type LLDPNeighbor struct {
-	ChassisID         string   `json:"chassis_id"`
-	SystemName        string   `json:"system_name,omitempty"`
-	SystemDescription string   `json:"system_description,omitempty"`
-	PortID            string   `json:"port_id,omitempty"`
-	PortDescription   string   `json:"port_description,omitempty"`
-	Capabilities      []string `json:"capabilities,omitempty"`
-}
-
-// PlaneFacts is the address a plane uses on this node and the NICs under it.
-type PlaneFacts struct {
-	Plane   string   `json:"plane"`
-	Bridge  string   `json:"bridge,omitempty"`
-	Address string   `json:"address,omitempty"`
-	Prefix  int      `json:"prefix,omitempty"`
-	NICs    []string `json:"nics,omitempty"`
-	MTU     int      `json:"mtu,omitempty"`
-}
-
-// NetTestServeRequest starts a server bound to the node's address on Plane.
-type NetTestServeRequest struct {
-	Plane           string `json:"plane"`
-	DurationSeconds int    `json:"duration_seconds"`
-}
-
-// NetTestServeResponse names the address the server listens on.
-type NetTestServeResponse struct {
-	Address string `json:"address,omitempty"`
-	Port    int    `json:"port,omitempty"`
-	Error   string `json:"error,omitempty"`
-}
-
-// NetTestRunRequest runs the client towards Address from the node's own
-// address on Plane. Address must be what Target reports for that plane.
-type NetTestRunRequest struct {
-	Plane           string `json:"plane"`
-	Target          string `json:"target"`
-	Address         string `json:"address"`
-	Port            int    `json:"port"`
-	DurationSeconds int    `json:"duration_seconds"`
-	Streams         int    `json:"streams"`
-}
-
-// NetTestRunResponse is one direction of a pair's measurement.
-type NetTestRunResponse struct {
-	SourceAddress string    `json:"source_address,omitempty"`
-	BitsPerSecond float64   `json:"bits_per_second"`
-	Bytes         int64     `json:"bytes"`
-	Seconds       float64   `json:"seconds"`
-	Streams       int       `json:"streams"`
-	StreamBPS     []float64 `json:"stream_bps,omitempty"`
-	RTTMinMillis  float64   `json:"rtt_min_ms,omitempty"`
-	RTTAvgMillis  float64   `json:"rtt_avg_ms,omitempty"`
-	RTTMaxMillis  float64   `json:"rtt_max_ms,omitempty"`
-	PacketLoss    float64   `json:"packet_loss_percent,omitempty"`
-	LinkMbps      int       `json:"link_mbps,omitempty"`
-	MTU           int       `json:"mtu,omitempty"`
-	Tool          string    `json:"tool,omitempty"`
-	Error         string    `json:"error,omitempty"`
-}
@@ -1,29 +0,0 @@
-package clusterv1
-
-import "time"
-
-// ClusterStateBucket is the KV bucket holding each daemon's heartbeat alongside
-// other cluster-wide state.
-const ClusterStateBucket = "spinifex-cluster-state"
-
-// HeartbeatKey is the ClusterStateBucket key a node writes its heartbeat under.
-func HeartbeatKey(node string) string {
-	return "heartbeat." + node
-}
-
-// HeartbeatTimestamp is the read side of a heartbeat for node liveness. It
-// decodes only the timestamp, so a reader does not depend on the capacity
-// figures the daemon writes beside it.
-type HeartbeatTimestamp struct {
-	Timestamp string `json:"timestamp"`
-}
-
-// Time returns when the heartbeat was written. A timestamp that is missing or
-// unparseable vouches for nothing, so ok is false.
-func (h HeartbeatTimestamp) Time() (written time.Time, ok bool) {
-	parsed, err := time.Parse(time.RFC3339, h.Timestamp)
-	if err != nil {
-		return time.Time{}, false
-	}
-	return parsed.UTC(), true
-}
@@ -1,35 +0,0 @@
-package clusterv1_test
-
-import (
-	"encoding/json"
-	"testing"
-	"time"
-
-	clusterv1 "github.com/mulgadc/spinifex/contracts/cluster/v1"
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// The bucket and key are the deployed layout: a rolling upgrade has old daemons
-// writing and new readers reading, so these strings cannot change.
-func TestHeartbeatKey_IsTheDeployedLayout(t *testing.T) {
-	assert.Equal(t, "spinifex-cluster-state", clusterv1.ClusterStateBucket)
-	assert.Equal(t, "heartbeat.node-a", clusterv1.HeartbeatKey("node-a"))
-}
-
-func TestHeartbeatTimestamp_ReadsAFullDaemonHeartbeat(t *testing.T) {
-	full := `{"node":"node-a","epoch":3,"timestamp":"2026-10-30T01:02:03Z","vm_count":4,"allocated_vcpu":8}`
-	var h clusterv1.HeartbeatTimestamp
-	require.NoError(t, json.Unmarshal([]byte(full), &h))
-
-	written, ok := h.Time()
-	require.True(t, ok)
-	assert.True(t, written.Equal(time.Date(2026, 10, 30, 1, 2, 3, 0, time.UTC)))
-}
-
-func TestHeartbeatTimestamp_UndatedBeatVouchesForNothing(t *testing.T) {
-	for _, ts := range []string{"", "yesterday"} {
-		_, ok := clusterv1.HeartbeatTimestamp{Timestamp: ts}.Time()
-		assert.False(t, ok, "timestamp %q", ts)
-	}
-}
@@ -60,42 +60,3 @@ The subject name carries the contract major; `platform_inventory_test.go` preser
 Producer and consumer are in the coordinated Spinifex release, so the window is N and N-1.
 A daemon that predates the subject has no subscription, so the request gets no responder; the consumer treats no responder, a timeout, an error reply, an undecodable reply, a reply for another account, and a missing, repeated or unknown-status kind as `scan-incomplete`, never clean.
 An incompatible change to the subject, fields or vocabulary needs a new major.
-
-## Seal account settings
-
-`SealAccountSettingsSubject` (`ec2.v1.SealAccountSettings`) is a request/reply route on which a daemon in the `spinifex-workers` queue group irreversibly seals one account's EC2 settings record.
-EC2 owns it: `domains/ec2/account` serves it through the daemon.
-`accountteardown`'s StageAccount seal reaper is the consumer: it calls this subject only after the seal-capability probe below reports every configured node compatible, and completes only once it holds a successful sealed reply.
-
-The request names the account in its body (`account_id`) and may carry an opaque `correlation_ref` that is echoed for logs.
-The daemon ignores `X-Account-ID` for this subject: the account sealed is the one named in the body.
-A seal is refused with `IncorrectState` unless IAM already holds the account as `TERMINATING`; a precondition read failure answers `InternalError`.
-Both refusals write nothing.
-
-A reply is sent only on success: `disposition` is always `sealed` and `revision` is the stream leader's accepted write for that seal.
-A failure is the standard awserrors error payload, not this reply shape.
-Sealing is idempotent: a seal on an already-sealed record re-writes the same value and returns a fresh, higher revision.
-
-### Compatibility boundary
-
-The subject name carries the contract major; `account_settings_seal_test.go` preserves the version-1 JSON shape.
-Producer and consumer are in the coordinated Spinifex release, so the window is N and N-1.
-A daemon that predates the subject has no subscription, so the request gets no responder.
-An incompatible change to the subject or fields needs a new major.
-
-## Seal-account-settings capability
-
-`AccountSettingsSealCapabilitySubject(node)` (`ec2.v1.AccountSettingsSealCapability.<node>`) is a per-node, read-only request/reply route on which `accountteardown` asks one configured daemon whether it supports the account-settings seal, immediately before every seal attempt.
-EC2 owns it: the daemon serves it with no queue group, so a request addressed to one node reaches only subscribers configured as that node, and two daemons sharing a node ID both answer.
-`accountteardown` is the consumer: its StageAccount seal reaper probes every configured node and sends no seal request unless every one answers compatible.
-
-`AccountSettingsSealCapabilityVersion` is a claim about the whole binary's writers, not about the responder: version 1 means every EC2 account-settings writer in the binary is revision-guarded and refuses a sealed record, and the binary serves the seal subject.
-A daemon binary without this responder — predating the capability, or carrying only the seal subject without it — has no subscriber, so the probe for that node reads as incomplete (`no-reply`), the same as a stopped or partitioned node.
-The reply proves nothing beyond the moment it was sent: a daemon downgraded or replaced after a successful probe is outside the guarantee.
-
-### Compatibility boundary
-
-The subject name carries the contract major; `account_settings_seal_capability_test.go` preserves the version-1 JSON shape and the subject builder.
-Producer and consumer are in the coordinated Spinifex release, so the window is N and N-1.
-A daemon that predates the capability has no subscription, so the probe gets no responder for that node.
-An incompatible change to the subject or fields needs a new major.
@@ -1,28 +0,0 @@
-package ec2v1
-
-// SealAccountSettingsSubject is the request/reply subject on which a daemon
-// seals one account's EC2 settings record. Sealing is irreversible and refused
-// unless IAM already holds the account as TERMINATING.
-const SealAccountSettingsSubject = "ec2.v1.SealAccountSettings"
-
-// AccountSettingsDispositionSealed is the only disposition a successful reply
-// carries: a reply is sent only on success, so there is no other value.
-const AccountSettingsDispositionSealed = "sealed"
-
-// SealAccountSettingsRequest asks for one account's EC2 settings to be
-// sealed. CorrelationRef is an opaque caller reference echoed for logs; it
-// grants nothing and is never a fence or authority to write.
-type SealAccountSettingsRequest struct {
-	AccountID      string `json:"account_id"`
-	CorrelationRef string `json:"correlation_ref,omitempty"`
-}
-
-// SealAccountSettingsReply confirms accountID's settings record was sealed at
-// Revision, the stream leader's accepted write for that seal. A failure is
-// the standard awserrors error payload, not this type.
-type SealAccountSettingsReply struct {
-	AccountID      string `json:"account_id"`
-	CorrelationRef string `json:"correlation_ref,omitempty"`
-	Disposition    string `json:"disposition"`
-	Revision       uint64 `json:"revision"`
-}
@@ -1,39 +0,0 @@
-package ec2v1
-
-import "strings"
-
-// AccountSettingsSealCapabilityVersion is the version this binary reports.
-// Version 1: every EC2 account-settings writer in the binary is
-// revision-guarded and refuses a sealed record, and the seal subject is served.
-const AccountSettingsSealCapabilityVersion = 1
-
-// AccountSettingsSealCapabilitySubject is one daemon's read-only
-// seal-capability route, addressed per node so a probe reaches exactly the
-// node it asks about.
-func AccountSettingsSealCapabilitySubject(node string) string {
-	return "ec2.v1.AccountSettingsSealCapability." + node
-}
-
-// ValidSealCapabilityNode reports whether node is exactly one NATS subject
-// token. Responder and probe both check it before building a subject, so
-// neither can address a wildcard or another node's route.
-func ValidSealCapabilityNode(node string) bool {
-	return node != "" && !strings.ContainsAny(node, ".*>\t\n\r ")
-}
-
-// AccountSettingsSealCapabilityRequest asks node whether it supports the
-// account-settings seal. CorrelationRef is an opaque caller reference echoed
-// for logs; it grants nothing and is never a fence or authority to write.
-type AccountSettingsSealCapabilityRequest struct {
-	Node           string `json:"node"`
-	CorrelationRef string `json:"correlation_ref,omitempty"`
-}
-
-// AccountSettingsSealCapabilityReply reports the responding node's capability
-// version. It carries no account data and proves nothing beyond the moment it
-// was sent.
-type AccountSettingsSealCapabilityReply struct {
-	Node              string `json:"node"`
-	CapabilityVersion int    `json:"capability_version"`
-	CorrelationRef    string `json:"correlation_ref,omitempty"`
-}
@@ -1,43 +0,0 @@
-package ec2v1
-
-import (
-	"encoding/json"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-)
-
-func TestAccountSettingsSealCapabilitySubject(t *testing.T) {
-	require.Equal(t, "ec2.v1.AccountSettingsSealCapability.node-1", AccountSettingsSealCapabilitySubject("node-1"))
-	require.Equal(t, "ec2.v1.AccountSettingsSealCapability.node-2", AccountSettingsSealCapabilitySubject("node-2"))
-}
-
-func TestAccountSettingsSealCapabilityRequestJSONContract(t *testing.T) {
-	data, err := json.Marshal(AccountSettingsSealCapabilityRequest{Node: "node-1", CorrelationRef: "req-1"})
-	require.NoError(t, err)
-	require.JSONEq(t, `{"node":"node-1","correlation_ref":"req-1"}`, string(data))
-
-	data, err = json.Marshal(AccountSettingsSealCapabilityRequest{Node: "node-1"})
-	require.NoError(t, err)
-	require.JSONEq(t, `{"node":"node-1"}`, string(data))
-}
-
-func TestAccountSettingsSealCapabilityReplyJSONContract(t *testing.T) {
-	reply := AccountSettingsSealCapabilityReply{Node: "node-1", CapabilityVersion: 1, CorrelationRef: "req-1"}
-	data, err := json.Marshal(reply)
-	require.NoError(t, err)
-	require.JSONEq(t, `{"node":"node-1","capability_version":1,"correlation_ref":"req-1"}`, string(data))
-
-	data, err = json.Marshal(AccountSettingsSealCapabilityReply{Node: "node-1", CapabilityVersion: 1})
-	require.NoError(t, err)
-	require.JSONEq(t, `{"node":"node-1","capability_version":1}`, string(data))
-}
-
-func TestValidSealCapabilityNode(t *testing.T) {
-	for _, node := range []string{"node-1", "node_2", "n3"} {
-		require.True(t, ValidSealCapabilityNode(node), node)
-	}
-	for _, node := range []string{"", "a.b", "*", ">", "node-*", "node >", "node\t1", "node\n1"} {
-		require.False(t, ValidSealCapabilityNode(node), "%q", node)
-	}
-}
@@ -1,43 +0,0 @@
-package ec2v1
-
-import (
-	"encoding/json"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-)
-
-func TestSealAccountSettingsSubject(t *testing.T) {
-	require.Equal(t, "ec2.v1.SealAccountSettings", SealAccountSettingsSubject)
-}
-
-func TestSealAccountSettingsRequestJSONContract(t *testing.T) {
-	data, err := json.Marshal(SealAccountSettingsRequest{AccountID: "111122223333", CorrelationRef: "req-1"})
-	require.NoError(t, err)
-	require.JSONEq(t, `{"account_id":"111122223333","correlation_ref":"req-1"}`, string(data))
-
-	data, err = json.Marshal(SealAccountSettingsRequest{AccountID: "111122223333"})
-	require.NoError(t, err)
-	require.JSONEq(t, `{"account_id":"111122223333"}`, string(data))
-}
-
-func TestSealAccountSettingsReplyJSONContract(t *testing.T) {
-	reply := SealAccountSettingsReply{
-		AccountID:      "111122223333",
-		CorrelationRef: "req-1",
-		Disposition:    AccountSettingsDispositionSealed,
-		Revision:       42,
-	}
-	data, err := json.Marshal(reply)
-	require.NoError(t, err)
-	require.JSONEq(t, `{
-		"account_id": "111122223333",
-		"correlation_ref": "req-1",
-		"disposition": "sealed",
-		"revision": 42
-	}`, string(data))
-
-	data, err = json.Marshal(SealAccountSettingsReply{AccountID: "111122223333", Disposition: AccountSettingsDispositionSealed})
-	require.NoError(t, err)
-	require.JSONEq(t, `{"account_id":"111122223333","disposition":"sealed","revision":0}`, string(data))
-}
@@ -1,7 +0,0 @@
-package ec2v1
-
-// VolumeHeldElsewhereText is the text of a start refused because another node
-// holds one of the instance's volumes. It crosses NATS as message text, so
-// readers match on it; the provider that refuses and every reader share this
-// string so they cannot drift.
-const VolumeHeldElsewhereText = "volume is leased by another owner"
@@ -126,8 +126,8 @@ type Assign struct {
 	ENIPrivateIP  string `json:"eniPrivateIp,omitempty"`
 	ENISubnetID   string `json:"eniSubnetId,omitempty"`
 	// TaskRoleARN is the task's IAM role (from the taskdef); when set, the agent
-	// serves its credentials at 169.254.170.2 under CredID, a scheduler-minted
-	// secret. An assign without a CredID gets no credentials.
+	// serves its credentials at 169.254.170.2 under CredID, defaulting CredID to
+	// the taskID when the scheduler leaves it empty.
 	CredID      string `json:"credId,omitempty"`
 	TaskRoleARN string `json:"taskRoleArn,omitempty"`
 	// ExecutionRoleARN is the task's execution role (from the taskdef); when set,
@@ -1,66 +0,0 @@
-# Lambda v1 contracts
-
-This package will own the Lambda process contracts declared by ADR-0009:S13.
-It holds the L-GUEST declaration and, in `guest.go`, the connection vocabulary both ends share: the scope, the URI SAN roles, the ALPN identifier and the fw_cfg entry names. The transport and authentication are decided (ADR-0009:S17); the invocation message types and framing are not chosen, so no message types are defined here.
-It is not an AWS tenant-facing API.
-
-## L-GUEST: node executor to guest agent
-
-**Owner:** the Lambda domain.
-
-**Producers and consumers:** the node-local executor (`runtime/compute/lambda`) and the in-guest Lambda agent (`agents/lambda`), in both directions.
-
-**Operations:** bootstrap with scoped material, readiness, invoke, completion, bounded logs, shutdown.
-
-**Transport:** TCP over the microVM's network (ADR-0009:S17).
-The agent dials one connection to a listener the executor owns for the environment, and the guest exposes no listener for host control.
-At most one authenticated control connection is active per environment, and the agent may reconnect; how a prior connection and its in-flight work are handled is open (ADR-0009 M1).
-The network is shared and untrusted: no source address, port or bridge membership is identity or authority.
-Tenant code may be able to reach the listener, but it cannot open the agent's connection or key material, so any connection it makes fails authentication.
-
-**Authentication:** mutual TLS 1.3, bound to the environment ID and realization generation, using material the user runtime cannot read (ADR-0009:S17).
-For each generation the executor creates ephemeral self-signed host and guest certificates whose single URI SAN is `spinifex-lambda://<Region>/<account>/<function ID>/<environment ID>/<generation>/<role>`, with role `host` or `guest`.
-Each end validates the peer certificate against the one pinned peer certificate and separately requires that URI SAN with the opposite role; hostname verification is not relied on.
-ALPN carries the L-GUEST major version, `spinifex-lambda-guest/1`, and an unsupported version fails the handshake.
-Under TLS 1.3 the guest's handshake can complete before the host refuses its certificate, so the guest treats the connection as accepted only after the host's first message.
-
-**Bootstrap material:** the executor passes these fw_cfg entries under `opt/spinifex/lambda/`, and the agent reads them as root and unloads `qemu_fw_cfg` before user code starts.
-
-| Entry | Content |
-|---|---|
-| `guest-key` | Guest private key, PEM |
-| `guest-cert` | Guest certificate, PEM |
-| `host-cert` | The one pinned host certificate, PEM |
-| `expect` | `<Region>/<account>/<function ID>/<environment ID>/<generation>` |
-| `host-addr` | Host listener as `host:port` |
-
-The guest's own interface settings come from `opt/spinifex/netcfg`, the entry other system VMs use.
-The agent unloads `qemu_fw_cfg` even when an entry is missing, and refuses to start if the fw_cfg tree is still readable afterwards.
-Until the message format exists, the agent authenticates and holds the connection but accepts no host message and starts no user code.
-
-**Authority:** one environment's attempt only.
-The user runtime never holds these keys, and sharing the guest with the agent gives user code no platform authority.
-
-**Idempotency and fencing:** an invoke carries the attempt-grant identity and the attempt ID.
-The agent accepts a run command only under a current grant, and a completion under a superseded grant is discarded and reported.
-How a grant is enforced and proven ended is open (ADR-0009 M1).
-
-**Errors and versions:** the agent and executor fail closed on an unknown protocol version or an identity mismatch.
-
-**Readiness:** environment readiness needs authenticated, current-generation agent evidence; a running hypervisor process does not count.
-
-**Payloads:** the contract must carry a synchronous payload and response of up to 6 MB and an asynchronous payload of up to 1 MB, plus framing, over a path whose size bound is declared.
-How payloads move is open (ADR-0009 M3).
-
-### Compatibility boundary
-
-The agent ships inside the runtime image pinned by each published version, so it is outside the coordinated release train.
-The executor supports every L-GUEST major carried by a still-supported runtime image.
-Retiring an image follows a published runtime-deprecation lifecycle that blocks create and update before it blocks invoke.
-
-Evidence required before the first agent image ships: a function on an old image invoked by a new executor, and the reverse during rollback.
-
-## L-RUNTIME
-
-The guest agent serves the AWS Lambda Runtime API, version `2018-06-01`, to the user runtime at `AWS_LAMBDA_RUNTIME_API`.
-Spinifex does not version this AWS contract, and conformance is measured against AWS.
@@ -1,54 +0,0 @@
-// Package lambdav1 holds the Lambda process-contract vocabulary shared by the
-// node executor and the guest agent. See README.md for the declarations.
-package lambdav1
-
-import (
-	"fmt"
-	"strings"
-)
-
-// ALPNv1 names L-GUEST major version 1; a peer offering any other fails the handshake.
-const ALPNv1 = "spinifex-lambda-guest/1"
-
-// FwCfgPrefix prefixes every fw_cfg entry the executor passes the guest.
-const FwCfgPrefix = "opt/spinifex/lambda/"
-
-// fw_cfg entry names under FwCfgPrefix.
-const (
-	EntryGuestKey  = "guest-key"
-	EntryGuestCert = "guest-cert"
-	EntryHostCert  = "host-cert"
-	EntryScope     = "expect"
-	EntryHostAddr  = "host-addr"
-)
-
-// Roles named as the last URI SAN path segment.
-const (
-	RoleHost  = "host"
-	RoleGuest = "guest"
-)
-
-const uriScheme = "spinifex-lambda"
-
-// Scope names one environment generation:
-// Region/account/function ID/environment ID/generation.
-type Scope string
-
-// ParseScope accepts exactly five non-empty, slash-separated segments.
-func ParseScope(s string) (Scope, error) {
-	parts := strings.Split(s, "/")
-	if len(parts) != 5 {
-		return "", fmt.Errorf("lambdav1: scope %q: want 5 segments, got %d", s, len(parts))
-	}
-	for _, p := range parts {
-		if p == "" || strings.ContainsAny(p, " \t\r\n?#%") {
-			return "", fmt.Errorf("lambdav1: scope %q: empty or invalid segment", s)
-		}
-	}
-	return Scope(s), nil
-}
-
-// URI is the single URI SAN a certificate for role in this scope carries.
-func (s Scope) URI(role string) string {
-	return uriScheme + "://" + string(s) + "/" + role
-}
@@ -1,20 +0,0 @@
-package lambdav1
-
-import (
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-func TestParseScope(t *testing.T) {
-	s, err := ParseScope("ap-southeast-2/000000000001/fn-1/env-1/gen-1")
-	require.NoError(t, err)
-	assert.Equal(t, "spinifex-lambda://ap-southeast-2/000000000001/fn-1/env-1/gen-1/host", s.URI(RoleHost))
-	for _, bad := range []string{
-		"", "a/b/c/d", "a/b/c/d/e/f", "a//c/d/e", "a/b/c/d/e/", "a/b/c/d/e?x", "a/b/c/d/e#x", "a b/b/c/d/e",
-	} {
-		_, err := ParseScope(bad)
-		assert.Error(t, err, bad)
-	}
-}
@@ -8,8 +8,3 @@ administration. It is separate from AWS tenant-facing service contracts.
 roles and Reed-Solomon configuration. It is an operational status contract,
 not a generic provider abstraction; do not change its subject or JSON shape
 incompatibly. Add a new version when that is required.
-
-`admin.go` holds the `/admin/<Method>` request and response bodies the private admin surface shares with the CLI.
-`AdminMethodNames` is the list of callable methods, and the gateway router builds its accept set from it.
-`AccountQuotaRequest`, `AccountQuotaResponse` and `DeleteAccountResponse` stay in the gateway until the `/admin` handlers move, because they embed types the contracts layer may not import.
-Do not change a field name, JSON tag or omitempty incompatibly; add a new version when that is required.
@@ -1,210 +0,0 @@
-package operatorv1
-
-import "slices"
-
-// adminMethodNames is the callable /admin/<Method> list. The gateway router
-// builds its accept set from it, so a name cannot be served without being listed.
-var adminMethodNames = []string{
-	"CreateAccount",
-	"DeleteAccount",
-	"DescribeAccountDeletion",
-	"GetAccountQuota",
-	"ListAccounts",
-	"PutAccountQuota",
-}
-
-// AdminMethodNames returns the callable /admin/<Method> names in sorted order.
-// Tooling that mints a credential grants these by name, so the list has to be
-// the one the router serves rather than a copy that can drift out of step.
-func AdminMethodNames() []string {
-	return slices.Sorted(slices.Values(adminMethodNames))
-}
-
-// Deletion job states.
-const (
-	DeletionStateRunning   = "RUNNING"
-	DeletionStateCompleted = "COMPLETED"
-	DeletionStateFailed    = "FAILED"
-
-	// DeletionStateExercised ends a non-finalizing run: the account is left
-	// TERMINATING and a later DeleteAccount takes the same operation over.
-	DeletionStateExercised = "EXERCISED"
-)
-
-// CreateAccountRequest is the /admin/CreateAccount request body.
-type CreateAccountRequest struct {
-	Name        string `json:"name"`
-	ClientToken string `json:"clientToken"`
-	Source      string `json:"source,omitempty"`
-}
-
-// CreateAccountResponse is the /admin/CreateAccount success body. It is stored
-// verbatim (with the secret encrypted) so a replay returns an identical answer.
-type CreateAccountResponse struct {
-	AccountID       string `json:"accountId"`
-	AccountName     string `json:"accountName"`
-	AdminUser       string `json:"adminUser"`
-	AccessKeyID     string `json:"accessKeyId"`
-	SecretAccessKey string `json:"secretAccessKey"`
-	DefaultVpcID    string `json:"defaultVpcId"`
-}
-
-// DeleteAccountRequest is the /admin/DeleteAccount request body.
-type DeleteAccountRequest struct {
-	AccountID   string `json:"accountId"`
-	AccountName string `json:"accountName"`
-	ClientToken string `json:"clientToken"`
-	Force       bool   `json:"force,omitempty"`
-	DryRun      bool   `json:"dryRun,omitempty"`
-
-	// NonFinalizing quiesces the account, cleans the quiesced EC2 platform
-	// kinds and stops. No legacy stage runs and the account record stays.
-	NonFinalizing bool `json:"nonFinalizing,omitempty"`
-}
-
-// DescribeAccountDeletionRequest is the /admin/DescribeAccountDeletion body.
-type DescribeAccountDeletionRequest struct {
-	AccountID string `json:"accountId"`
-}
-
-// AccountSummary is one row of /admin/ListAccounts. It carries no credential
-// material: the caller can already create and delete accounts, but that is no
-// reason for a listing to hand out keys.
-type AccountSummary struct {
-	AccountID   string `json:"accountId"`
-	AccountName string `json:"accountName"`
-	Status      string `json:"status"`
-	CreatedAt   string `json:"createdAt,omitempty"`
-}
-
-// ListAccountsResponse is the /admin/ListAccounts success body.
-type ListAccountsResponse struct {
-	Accounts []AccountSummary `json:"accounts"`
-	Count    int              `json:"count"`
-}
-
-// IAMQuiescence is the coordinator's recorded view of IAM quiescence for one
-// fence. Recording only: it admits nothing. QuiescedScope is filled only for a
-// non-finalizing run, and holds as of EvaluatedAt: a write after that is not caught.
-type IAMQuiescence struct {
-	OperationID   string            `json:"operationId"`
-	Fence         uint64            `json:"fence"`
-	Generation    uint64            `json:"generation"`
-	QuiescedScope []string          `json:"quiescedScope"`
-	Unresolved    []UnresolvedScope `json:"unresolved"`
-	Consumers     []ConsumerBasis   `json:"consumers"`
-	Writers       []AccountedWriter `json:"writers"`
-	Inventory     []InventoryStatus `json:"inventory"`
-	EvaluatedAt   string            `json:"evaluatedAt"`
-}
-
-// UnresolvedScope names a scope or writer that blocks quiescence, with a fixed
-// reason. It is never a timeout.
-type UnresolvedScope struct {
-	Scope  string `json:"scope"`
-	Class  string `json:"class"`
-	Reason string `json:"reason"`
-}
-
-// ConsumerBasis cites an enforcement consumer and the accepted contract that
-// lets it count as having applied the generation.
-type ConsumerBasis struct {
-	Consumer string `json:"consumer"`
-	Basis    string `json:"basis"`
-}
-
-// AccountedWriter is a writer that cannot be fenced and is covered by the
-// owner's inventory instead. Ref names the tracked work that closes the gap.
-type AccountedWriter struct {
-	Writer string `json:"writer"`
-	Basis  string `json:"basis"`
-	Ref    string `json:"ref"`
-}
-
-// InventoryStatus is the owner inventory's status for one kind at evaluation.
-type InventoryStatus struct {
-	Kind   string `json:"kind"`
-	Status string `json:"status"`
-}
-
-// Classes of an UnresolvedScope.
-const (
-	UnresolvedClassFence    = "fence"
-	UnresolvedClassConsumer = "consumer"
-	UnresolvedClassWriter   = "writer"
-)
-
-// Fixed reasons of an UnresolvedScope.
-const (
-	ReasonFenceMismatch                = "fence-mismatch"
-	ReasonIAMReadbackFailed            = "iam-readback-failed"
-	ReasonNoAcceptedEnforcement        = "no-accepted-enforcement-contract"
-	ReasonNoCompleteOwnerInventory     = "no-complete-owner-inventory"
-	ReasonParticipantNotDeclared       = "participant-not-declared"
-	ReasonOwnerInventoryIncomplete     = "owner-inventory-incomplete"
-	ReasonFinalInventoryRereadNotWired = "final-inventory-reread-not-wired"
-)
-
-// ExerciseResult is what a non-finalizing run did after IAM quiescence.
-type ExerciseResult struct {
-	// Skipped is the fixed reason no cleanup ran; Cleanup is then absent.
-	Skipped    string           `json:"skipped,omitempty"`
-	Cleanup    *PlatformCleanup `json:"cleanup,omitempty"`
-	Accounting []KindAccounting `json:"accounting,omitempty"`
-}
-
-// PlatformCleanup is the EC2 platform cleanup result. It carries resource IDs,
-// fixed reasons and counts only, never names, tags, key material or data.
-type PlatformCleanup struct {
-	Kinds  []CleanupKind  `json:"kinds"`
-	Items  []CleanupItem  `json:"items,omitempty"`
-	Counts []CleanupCount `json:"counts,omitempty"`
-}
-
-// CleanupKind is one kind's scan status after the cleanup's own re-scan.
-type CleanupKind struct {
-	Kind              string   `json:"kind"`
-	Status            string   `json:"status"`
-	IncompleteReasons []string `json:"incompleteReasons,omitempty"`
-}
-
-// CleanupItem is one resource by its ID with what the cleanup did to it.
-type CleanupItem struct {
-	ResourceID  string `json:"resourceId"`
-	Kind        string `json:"kind"`
-	Disposition string `json:"disposition"`
-	Reason      string `json:"reason,omitempty"`
-	MemberCount int    `json:"memberCount,omitempty"`
-}
-
-// CleanupCount is the number of records of one class that have no public ID.
-type CleanupCount struct {
-	Kind        string `json:"kind"`
-	Class       string `json:"class"`
-	Disposition string `json:"disposition"`
-	Reason      string `json:"reason,omitempty"`
-	Count       int    `json:"count"`
-}
-
-// KindAccounting is the final inventory re-read held against the cleanup result
-// for one kind. Quiescence is not rewritten from it.
-type KindAccounting struct {
-	Kind      string `json:"kind"`
-	Status    string `json:"status"`
-	Reason    string `json:"reason,omitempty"`
-	Remaining int    `json:"remaining"`
-}
-
-// Accounting statuses and fixed reasons of a KindAccounting.
-const (
-	AccountingAccounted   = "accounted"
-	AccountingUnaccounted = "unaccounted"
-
-	AccountingReasonRereadIncomplete = "reread-incomplete"
-	AccountingReasonUnnamedRemainder = "unnamed-remainder"
-)
-
-// Fixed reasons an exercise ran no cleanup.
-const (
-	ExerciseSkippedNoQuiescedKind = "no-quiesced-kind"
-)
@@ -1,86 +0,0 @@
-package operatorv1
-
-import (
-	"encoding/json"
-	"testing"
-
-	"github.com/stretchr/testify/require"
-)
-
-func goldenJSON(t *testing.T, v any, want string) {
-	t.Helper()
-	data, err := json.Marshal(v)
-	require.NoError(t, err)
-	require.JSONEq(t, want, string(data))
-}
-
-func TestAdminWire_CreateAccountRequest(t *testing.T) {
-	goldenJSON(t, CreateAccountRequest{Name: "acme", ClientToken: "tok-1", Source: "cli"},
-		`{"name":"acme","clientToken":"tok-1","source":"cli"}`)
-	goldenJSON(t, CreateAccountRequest{Name: "acme", ClientToken: "tok-1"},
-		`{"name":"acme","clientToken":"tok-1"}`)
-}
-
-func TestAdminWire_CreateAccountResponse(t *testing.T) {
-	goldenJSON(t, CreateAccountResponse{
-		AccountID: "000000000042", AccountName: "acme", AdminUser: "admin",
-		AccessKeyID: "AKIAEXAMPLE", SecretAccessKey: "secret", DefaultVpcID: "vpc-1",
-	}, `{"accountId":"000000000042","accountName":"acme","adminUser":"admin","accessKeyId":"AKIAEXAMPLE","secretAccessKey":"secret","defaultVpcId":"vpc-1"}`)
-}
-
-func TestAdminWire_DeleteAccountRequest(t *testing.T) {
-	goldenJSON(t, DeleteAccountRequest{AccountID: "000000000042", AccountName: "acme", ClientToken: "tok-2", Force: true, DryRun: true},
-		`{"accountId":"000000000042","accountName":"acme","clientToken":"tok-2","force":true,"dryRun":true}`)
-	goldenJSON(t, DeleteAccountRequest{AccountID: "000000000042", AccountName: "acme", ClientToken: "tok-2"},
-		`{"accountId":"000000000042","accountName":"acme","clientToken":"tok-2"}`)
-}
-
-func TestAdminWire_DescribeAccountDeletionRequest(t *testing.T) {
-	goldenJSON(t, DescribeAccountDeletionRequest{AccountID: "000000000042"}, `{"accountId":"000000000042"}`)
-}
-
-func TestAdminWire_DeletionStates(t *testing.T) {
-	require.Equal(t, "RUNNING", DeletionStateRunning)
-	require.Equal(t, "COMPLETED", DeletionStateCompleted)
-	require.Equal(t, "FAILED", DeletionStateFailed)
-	require.Equal(t, "EXERCISED", DeletionStateExercised)
-}
-
-func TestAdminWire_NonFinalizingDeleteRequest(t *testing.T) {
-	goldenJSON(t, DeleteAccountRequest{AccountID: "000000000042", AccountName: "acme", ClientToken: "tok-3", NonFinalizing: true},
-		`{"accountId":"000000000042","accountName":"acme","clientToken":"tok-3","nonFinalizing":true}`)
-}
-
-func TestAdminWire_ExerciseResult(t *testing.T) {
-	goldenJSON(t, ExerciseResult{
-		Cleanup: &PlatformCleanup{
-			Kinds:  []CleanupKind{{Kind: "key-pair", Status: "observed-clean-at-scan-time"}},
-			Items:  []CleanupItem{{ResourceID: "pg-1", Kind: "placement-group", Disposition: "blocked", Reason: "instance-members", MemberCount: 1}},
-			Counts: []CleanupCount{{Kind: "key-pair", Class: "public-key-object-without-metadata", Disposition: "deleted", Count: 2}},
-		},
-		Accounting: []KindAccounting{{Kind: "placement-group", Status: AccountingAccounted, Remaining: 1}},
-	}, `{"cleanup":{"kinds":[{"kind":"key-pair","status":"observed-clean-at-scan-time"}],
-		"items":[{"resourceId":"pg-1","kind":"placement-group","disposition":"blocked","reason":"instance-members","memberCount":1}],
-		"counts":[{"kind":"key-pair","class":"public-key-object-without-metadata","disposition":"deleted","count":2}]},
-		"accounting":[{"kind":"placement-group","status":"accounted","remaining":1}]}`)
-	goldenJSON(t, ExerciseResult{Skipped: ExerciseSkippedNoQuiescedKind}, `{"skipped":"no-quiesced-kind"}`)
-}
-
-func TestAdminWire_ListAccountsResponse(t *testing.T) {
-	goldenJSON(t, ListAccountsResponse{
-		Accounts: []AccountSummary{
-			{AccountID: "000000000042", AccountName: "acme", Status: "ACTIVE", CreatedAt: "2026-01-02T03:04:05Z"},
-			{AccountID: "000000000043", AccountName: "bolt", Status: "TERMINATING"},
-		},
-		Count: 2,
-	}, `{"accounts":[
-		{"accountId":"000000000042","accountName":"acme","status":"ACTIVE","createdAt":"2026-01-02T03:04:05Z"},
-		{"accountId":"000000000043","accountName":"bolt","status":"TERMINATING"}],"count":2}`)
-}
-
-func TestAdminWire_AdminMethodNames(t *testing.T) {
-	require.Equal(t, []string{
-		"CreateAccount", "DeleteAccount", "DescribeAccountDeletion",
-		"GetAccountQuota", "ListAccounts", "PutAccountQuota",
-	}, AdminMethodNames())
-}
@@ -1,71 +0,0 @@
-package telemetryv1
-
-import (
-	"regexp"
-)
-
-// LiveSamplePeriodMillis is how often a watched instance is sampled for the
-// console's live view.
-const LiveSamplePeriodMillis = 500
-
-// LiveWatchLeaseMillis is how long one watch keeps the live sampler running.
-// Watchers renew well inside it, so a viewer that goes away costs at most this.
-const LiveWatchLeaseMillis = 30_000
-
-// LiveRingSamples bounds the in-memory history a live sampler keeps for a
-// reconnecting viewer: five minutes at LiveSamplePeriodMillis.
-const LiveRingSamples = 5 * 60 * 1000 / LiveSamplePeriodMillis
-
-// Live subjects sit outside metrics.> so nothing that ingests the periodic
-// CloudWatch batches ever reads a sub-second rate as a period. The account is part
-// of the subject, so only the poller for that account's instance answers.
-const (
-	liveWatchSubjectPrefix  = "telemetry.watch.ec2."
-	liveSampleSubjectPrefix = "telemetry.live.ec2."
-)
-
-var (
-	liveAccountPattern  = regexp.MustCompile(`^[0-9]{12}$`)
-	liveInstancePattern = regexp.MustCompile(`^i-[0-9a-f]{8,17}$`)
-)
-
-// ValidLiveTarget reports whether accountID and instanceID are safe to place
-// in a live subject: no NATS token separators or wildcards can get through.
-func ValidLiveTarget(accountID, instanceID string) bool {
-	return liveAccountPattern.MatchString(accountID) && liveInstancePattern.MatchString(instanceID)
-}
-
-// LiveWatchSubject is where a viewer asks the owning node to keep sampling. A
-// request on it is answered with the ring since LiveWatch.SinceMillis.
-func LiveWatchSubject(accountID, instanceID string) string {
-	return liveWatchSubjectPrefix + accountID + "." + instanceID
-}
-
-// LiveSampleSubject carries one LiveSample per sampling period while watched.
-func LiveSampleSubject(accountID, instanceID string) string {
-	return liveSampleSubjectPrefix + accountID + "." + instanceID
-}
-
-// LiveWatch is the body of a watch. SinceMillis is the newest sample the
-// viewer already has; zero asks for the whole ring.
-type LiveWatch struct {
-	SinceMillis int64 `json:"since_ms,omitempty"`
-}
-
-// LiveRing answers a watch request with the samples newer than SinceMillis.
-type LiveRing struct {
-	Samples []LiveSample `json:"samples"`
-}
-
-// LiveSample is one live measurement. Every value is a rate over the interval
-// ending at TimeMillis, measured against the previous sample's clock.
-type LiveSample struct {
-	TimeMillis int64   `json:"t"`
-	CPUPercent float64 `json:"cpu"`
-	// NetworkIn and NetworkOut are bytes per second from the guest's side.
-	NetworkIn  float64 `json:"netIn"`
-	NetworkOut float64 `json:"netOut"`
-	// PacketsIn and PacketsOut are packets per second from the guest's side.
-	PacketsIn  float64 `json:"pktIn"`
-	PacketsOut float64 `json:"pktOut"`
-}
@@ -1,42 +0,0 @@
-package telemetryv1
-
-import (
-	"encoding/json"
-	"testing"
-
-	"github.com/stretchr/testify/assert"
-	"github.com/stretchr/testify/require"
-)
-
-// The console parses these names, so a rename here breaks its live charts.
-func TestLiveSampleJSONContract(t *testing.T) {
-	data, err := json.Marshal(LiveSample{
-		TimeMillis: 1793450123250, CPUPercent: 12.5,
-		NetworkIn: 48213, NetworkOut: 1290, PacketsIn: 41, PacketsOut: 12,
-	})
-	require.NoError(t, err)
-	require.JSONEq(t, `{"t":1793450123250,"cpu":12.5,"netIn":48213,"netOut":1290,"pktIn":41,"pktOut":12}`, string(data))
-}
-
-func TestValidLiveTarget(t *testing.T) {
-	assert.True(t, ValidLiveTarget("123456789012", "i-0123456789abcdef0"))
-	assert.True(t, ValidLiveTarget("123456789012", "i-0abc1234"))
-
-	for _, tc := range []struct{ account, instance string }{
-		{"", "i-0123456789abcdef0"},
-		{"12345678901", "i-0123456789abcdef0"},
-		{"123456789012", ""},
-		{"123456789012", ">"},
-		{"123456789012", "*"},
-		{"123456789012", "i-0123.abcdef"},
-		{"123456789012", "i-0123456789ABCDEF0"},
-		{"123456789012", "vol-0123456789abcdef0"},
-	} {
-		assert.False(t, ValidLiveTarget(tc.account, tc.instance), "%q %q", tc.account, tc.instance)
-	}
-}
-
-func TestLiveSubjectsAreOutsideMetrics(t *testing.T) {
-	assert.Equal(t, "telemetry.watch.ec2.123456789012.i-0abc1234", LiveWatchSubject("123456789012", "i-0abc1234"))
-	assert.Equal(t, "telemetry.live.ec2.123456789012.i-0abc1234", LiveSampleSubject("123456789012", "i-0abc1234"))
-}
@@ -1,53 +0,0 @@
-package telemetryv1
-
-import "regexp"
-
-// Node live subjects mirror the instance ones, keyed by node name. Only the
-// super-admin account's gateway handler subscribes to them.
-const (
-	nodeLiveWatchSubjectPrefix  = "telemetry.watch.node."
-	nodeLiveSampleSubjectPrefix = "telemetry.live.node."
-)
-
-var liveNodePattern = regexp.MustCompile(`^[A-Za-z0-9_-]{1,64}$`)
-
-// ValidLiveNode reports whether a node name is safe to place in a subject.
-func ValidLiveNode(node string) bool {
-	return liveNodePattern.MatchString(node)
-}
-
-// NodeLiveWatchSubject is where a viewer asks a node to keep sampling itself.
-// A request on it is answered with a NodeLiveRing.
-func NodeLiveWatchSubject(node string) string {
-	return nodeLiveWatchSubjectPrefix + node
-}
-
-// NodeLiveSampleSubject carries one NodeLiveSample per period while watched.
-func NodeLiveSampleSubject(node string) string {
-	return nodeLiveSampleSubjectPrefix + node
-}
-
-// NodeLiveRing answers a watch with the samples newer than its SinceMillis.
-type NodeLiveRing struct {
-	Samples []NodeLiveSample `json:"samples"`
-}
-
-// NodeLiveSample is one host measurement. Rates are per second over the
-// interval ending at TimeMillis.
-type NodeLiveSample struct {
-	TimeMillis int64   `json:"t"`
-	CPUPercent float64 `json:"cpu"`
-	// MemoryUsedPercent is used memory less page cache, as free(1) reports it.
-	MemoryUsedPercent float64 `json:"mem"`
-	Load1             float64 `json:"load1"`
-	// Planes holds the traffic of each plane's physical NICs, keyed wan, lan, vpc.
-	Planes map[string]NodeLivePlane `json:"planes"`
-}
-
-// NodeLivePlane is one plane's traffic from the host's side.
-type NodeLivePlane struct {
-	NetworkIn  float64 `json:"netIn"`
-	NetworkOut float64 `json:"netOut"`
-	PacketsIn  float64 `json:"pktIn"`
-	PacketsOut float64 `json:"pktOut"`
-}
@@ -60,10 +60,6 @@ moved to another node; the local daemon subscribes to stop the guest that
 was using it. Node-addressed, like mount and unmount: the guest is local, and
 no other node's daemon has anything to stop.

-The event is sent as a request and repeated until the daemon replies with `VolumeFencedAck`, because the fence often runs while the node's NATS server is restarting and a single publish can reach no subscriber.
-The daemon replies only when the event carries a reply subject, so a plain publish is still accepted.
-Repeats are harmless, since fencing a guest that is already fenced changes nothing.
-
 ## Abandon route

 `VolumeAbandonSubject(node)` is `ebs.<node>.abandon`. The daemon uses
@@ -17,7 +17,7 @@ func TestVolumeAbandonSubject_BothForms(t *testing.T) {
 	assert.Equal(t, "ebs.abandon", viperblocklegacyv1.VolumeAbandonSubject(""))
 }

-// TestVolumeAbandonRequest_JSON pins the request runtime/daemon/vm_adapters.go sends
+// TestVolumeAbandonRequest_JSON pins the request daemon/vm_adapters.go sends
 // on the abandon route.
 func TestVolumeAbandonRequest_JSON(t *testing.T) {
 	golden := `{"volume":"vol-1","reason":"instance owned by another node"}`
@@ -19,11 +19,3 @@ type VolumeFencedEvent struct {
 	Winner string `json:"winner"`
 	Reason string `json:"reason"`
 }
-
-// VolumeFencedAck is the daemon's answer to a VolumeFencedEvent. Any answer
-// ends the sender's retries; Instance names the guest stopped, if one was, and
-// Error says why the daemon could not act on the event.
-type VolumeFencedAck struct {
-	Instance string `json:"instance,omitempty"`
-	Error    string `json:"error,omitempty"`
-}
@@ -37,18 +37,3 @@ func TestVolumeFencedEvent_JSON(t *testing.T) {
 	require.NoError(t, json.Unmarshal([]byte(golden), &decoded))
 	assert.Equal(t, event, decoded)
 }
-
-// TestVolumeFencedAck_JSON pins the daemon's answer, which is what ends
-// viperblockd's retries of a fence notice.
-func TestVolumeFencedAck_JSON(t *testing.T) {
-	golden := `{"instance":"i-1","error":"bad event"}`
-	ack := viperblocklegacyv1.VolumeFencedAck{Instance: "i-1", Error: "bad event"}
-
-	marshaled, err := json.Marshal(ack)
-	require.NoError(t, err)
-	assert.JSONEq(t, golden, string(marshaled))
-
-	empty, err := json.Marshal(viperblocklegacyv1.VolumeFencedAck{})
-	require.NoError(t, err)
-	assert.JSONEq(t, `{}`, string(empty), "an ack for a volume with no local guest carries nothing")
-}
@@ -48,11 +48,6 @@ type EBSRequest struct {
 	NBDURI              string `json:"NBDURI"`
 	DeviceName          string `json:"DeviceName"`
 	HotplugPort         int    `json:"HotplugPort,omitempty"`
-	// BlockDevice and BlockSizeBytes describe a host block device export, the
-	// alternative to NBDURI; the guest sees BlockSizeBytes of it. Exactly one
-	// of NBDURI and BlockDevice may be set.
-	BlockDevice    string `json:"BlockDevice,omitempty"`
-	BlockSizeBytes uint64 `json:"BlockSizeBytes,omitempty"`
 }

 // EBSMountResponse is the response to an EBSRequest on MountSubject.
--- a/Show More
+++ b/Show More