[0xcadams]

What

Carry the existing control-outage/certificate diagnostics and the new exact workload-denial evidence together on the native carrier-selection stack. Stacked on #483; the workload evidence is also isolated against its failing source in #484.

Why

#470's later 61033ba5 diagnostic commit was not an ancestor of #481–#483. Qualifying only those descendants therefore lost the allocation/process-lease and certificate observations that had been added for the unexplained control-outage EOF and split-startup readiness failure.

#482 subsequently failed the revoked-HTTP workload proof without retaining the response status or service. Keep both evidence paths on the source being qualified, rather than treating later focused passes as explanations of either failure.

Changes

• Carry 61033ba5 unchanged, preserving exact non-secret allocation/process-lease deadlines and split certificate-preparation evidence.
• Carry test: retain exact workload HTTP denial evidence #484 unchanged, identifying the workload fixture, service, HTTP status, and bounded control revocation/deadline snapshot when denied HTTP unexpectedly succeeds or redirects.
• Preserve every existing assertion, selector, request, and timeout. This changes test evidence only; it does not fix or suppress the original failures, enable native production admission, or change serving behavior.

[0xcadams]

the new failure is retained separately from carrier startup selection:

• fix: retain classified server component exit evidence #482 CI: QUIC TestIntegrationWorkloadTransportLifecycle failed at revoked HTTP (workload_transport_integration_test.go:156); binary passed. the original assertion did not identify the service or distinguish HTTP 200 from a redirect. original run: https://github.com/tnldotdev/tnl/actions/runs/40608618921/job/122554317800.
• signed/pushed test: retain exact workload HTTP denial evidence #484 at 76db6c52d6ef647695fcd240aafd789a3e0aa1a7 changes only evidence: exact fixture/service/status and a failure-only, one-second control snapshot containing observation/revocation/deadlines, with no credentials, keys, claims, bodies, or URLs.
• focused QUIC proof passed locally with the original serving source/assertions/budgets in 224.764s (223.12s subtest). routine Go/public API, daemon races, lint, formatting, and generation verification passed. this pass does not explain the CI failure.
• the disposable Linux reproduction is running against the same signed diagnostic source; no assertion, HTTP request, serving timeout, or admission retry was changed.
• test: reconcile runtime authority evidence on the native transport stack #485 carries that evidence and feat: integrate public ingress and native peer paths #470's previously missing 61033ba5 control-outage/certificate diagnostics on top of fix: activate only the selected native relay carrier #483. its combined control-restart/native-packet/workload qualification is running; no final-matrix success is claimed.
• test: reconcile runtime authority evidence on the native transport stack #485's initial routine Go run failed before full-duplex assertions: the unchanged QUIC contract fixture could not connect within five seconds (contract_test.go:87, no recent network activity). that log is retained separately; the later lint/format/generation targets in that command were not reached. no transport deadline is being increased to hide it.

all PRs remain unmerged drafts. no deployment, live infrastructure change, release, or deployed benchmark occurred; native production admission remains disabled.

[0xcadams]

disposable Linux reproduction completed on signed #484 source 76db6c52d6ef647695fcd240aafd789a3e0aa1a7:

task go:test:integration RUN='^TestIntegrationWorkloadTransportLifecycle/quic$' passed in 223.298s (222.20s QUIC subtest), crossing revocation, the unrenewed lease, renewed continuity, and fixed expiry with the original assertions and serving deadlines. the local macOS proof also passed in 224.764s.

the #482 CI revoked-HTTP failure remains unexplained. neither pass identifies the original response status/service, so the exact-response/control-deadline diagnostics remain in #484 and the combined #485 stack. no admission retry, timeout increase, serving change, production operation, or claim of final qualification was introduced.

the integrated #485 routine run separately hit a five-second QUIC fixture connection timeout before full-duplex assertions. its focused unchanged TestSessionContract race proof passed in 1.439s; the first failure is retained and routine validation is being repeated after the Linux workload completed.

[0xcadams]

combined source reconciliation is signed/pushed in #485 at 9b7d4b8f7ce91a7ce1132663ffdeaf740b4ae82e, stacked on #483. it includes #470's later 61033ba5 authority/certificate evidence and #484's exact workload-denial evidence, without modifying product behavior or weakening assertions.

on that combined source:

• the disposable-PostgreSQL race invocation task go:test:integration RUN='^TestIntegration(ControlRestartPreservesDataPlane|PeerPackets.*|WorkloadTransportLifecycle)$' passed in 649.373s.
• all ten native packet-loss cases passed (120.76s total); checked relay-claim renewal passed (62.69s). one target socket survived the original pair deadline, and both claims advanced by at least 30.019s.
• control restart passed in 23.60s, with the exact allocation and process-lease snapshot retained before shutdown.
• workload lifecycle passed QUIC in 223.05s and TLS/TCP in 217.62s, including revocation, unrenewed expiry, renewed continuity, and fixed expiry.
• daemon races, routine Go/public API, harness races, lint, formatting, and generation verification passed. routine Go's first attempt had a separate five-second QUIC fixture connection timeout before full-duplex assertions; the unchanged focused contract and subsequent routine run passed. the initial failure remains retained, not diagnosed by those passes.

#484's isolated Linux QUIC workload reproduction also passed in 223.298s. neither it nor the combined proof explains #482's original revoked-HTTP response, the earlier manual-Compose startup failure, or the original control-outage EOF. their evidence and open qualification status remain intact.

latest CI snapshot: #483 has 48 passing checks, one expected skip, and Runtime workloads still running; #485 has 43 passing checks, one expected skip, and runtime shards/workload/load still running. this is not final-matrix completion.

remaining product work includes reconnect handoff (active outer closure still retires its registration), assignment/source/network-change recovery, ICE/direct upgrade, public-ingress cutover, proxy-source qualification, guest serving-tail/metrics, and remaining website service-access/source-pin reconciliation. production native admission remains disabled. nothing merged or deployed; no live infrastructure, release, or deployed benchmark operation occurred.