[noahgift]

Ticket: PMAT-659

Closes #688, closes #661, closes #659. Master #900 (epic #879). Packed per TPK-001. Tests were not built locally (lambda is build-banned); CI is the check.

🤖 Generated with Claude Code

[noahgift]

LANE out117-w1 (claude-sonnet-5-5) · head 85ff359 · VERDICT FAIL
cargo test --lib on kfocus at this head: 13754 passed, 1 FAILED: resources::disk_budget::detect::tests::sweepable_refuses_a_candidate_outside_every_declared_root. Not checked whether it also fails on main (could be host-dependent: kfocus paths); author to confirm. Other checks: quorum receipt red, rest pending. Only --lib was run.

[noahgift]

LANE out117-w4 · head 85ff359 · VERDICT PASS (targeted)
Model: claude-sonnet-5-5. Host: intel (detached worktree at the exact head, nice 19). Ran cargo test --test falsification_659_check_unreachable_is_unmeasured --test falsification_661_lock_prune_scoped_to_config --test falsification_688_failed_resource_action_failed --test falsification_query_runlog --test falsification_runlog_doctor_imagelog: every result line ok, 0 failed (4, 2 and 2 passed in the three new falsification files, plus the two touched existing ones). These cover the three closed issues (#659 unreachable = unmeasured, #661 lock prune scoped to the config, #688 failed resource = action failed). Not verified: the full lib suite and clippy, and whether each new test goes red on a revert of its fix. The red quorum receipt check on the PR is the one forjar#897 is moving off the PR path.

🤖 Generated with Claude Code

[noahgift]

CORRECTION out117-w1: the single lib failure I cited (sweepable_refuses_a_candidate_outside_every_declared_root) also fails on main 269e180 on kfocus, so it is not caused by this PR. My lane at 85ff359 is withdrawn as FAIL on that basis; remaining result: 13754 passed, only that baseline failure. VERDICT PASS (lib only, no CI jobs run).

[noahgift]

Single-lane review (f20-i4), comment only, NOT an approval. Read: the PR body and about the first 330 diff lines of 9 files (+416/-69): check.rs, the new check_json.rs, the apply_args.rs doc line, lock_core.rs and the start of lock_prune_scope.rs. I did NOT read the rest of lock_prune_scope.rs, the ResourceRunStatus::Failed part (#688) or any tests. No tests were run.

1. Duplicate of #929. #929 (draft) carries the same Closes #661 / #659 / #688 under the same master #900 and the same three fixes (lock-prune scope, ssh 255 unmeasured, failed run-status). This PR is non-draft and counts against the D53 cap. Pick one and close the other as a duplicate with the link. If both stay, they will conflict on check.rs and lock_core.rs. My earlier comments on #929 apply here too (a probe that itself exits 255, a ConnectTimeout in the test, legacy failed:true round-trip).
2. The 255 branch checks transport::is_ssh_transport(machine), so a local command that exits 255 stays a failure. Good. But Err(e) => ("unmeasured", ...) now maps every transport Err to unmeasured, including errors that are not connection problems (a script-write failure, a spawn error). Narrow it to the connection class, or keep "error" for the rest.
3. "unmeasured" outranks drift: the check returns Err starting with CHECK_UNMEASURED_MARKER when any host could not be measured, even if other checks failed. The text line says (N failed), but the JSON all_passed is false for both cases with no separate field. Add "exit_class" to the JSON so a consumer can tell exit 4 from exit 1 without parsing the message.
4. The apply --check doc line now says exit 1 = changes needed, replacing "exit 2". Confirm that exit 1 really is the code, and update the book and any script in this repo that tests for 2.
5. lock-prune is now scoped to -f machines and refuses a machine another stack's stamp also lists. The "check every machine before any write" order is right. The guard relies on stamps because entries record no stack (#561). Say in the PR body that a machine with no stamp is treated as unowned, since that is the unsafe default for a delete.
6. The body says tests were not built locally and CI is the check. As of now the ARM64 clean-room jobs on forjar are starved, so no signal is available. Do not arm until they have run.
7. No sign-off visible. Needs a non-author round bound to the final commit.

[paiml-fleet]

GHC-001 R4 PR open > 4 h without a review PASS. Converted to draft (nothing lost). Mark ready again (gh pr ready 902 -R paiml/forjar) once it has a review PASS at its head.

[noahgift]

s-xpile-1 lane review at head ba15d11 (comment-only; not an approval; nothing built or run by me, diff read via git).

DUPLICATE RISK: #929 (head afcd18e, opened 2026-11-09 14:41Z, 161 additions) lists the same three tickets, Closes #661 / #659 / #688, under master 900, with the same three fixes described (lock-prune scope, ssh 255 unmeasured, failed status). #902 (opened 08:25Z, 472 additions) is the earlier and larger one. Two open PRs closing the same tickets will conflict; the owner should say which supersedes the other and close or trim one (closing stays the operator's / owner's call).

Read of #902 itself: lock_prune_scope.rs plus the cmd_lock_prune rewrite is sound: only machines the config declares, every machine checked for another stack's stamp before any write, so a refusal leaves the state dir untouched; refusal only fires when stale entries exist. CHECK_UNMEASURED_MARKER maps to ErrorClass::Connection (exit 4), consistent with the existing marker table.

Non-blocking: the diff also rewrites the doc comment on DRIFT_DECLINED_MARKER in error.rs (drops the 'never a verdict about resources from another manifest' wording). It is unrelated to #659 and loses information; I would restore it. Body says tests were not built (lambda is build-banned), so CI is the only check.

🤖 Generated with Claude Code