[scotwells]

Summary

Allocation admission and custody: proposed documentation only. Select one SERIALIZABLE PostgreSQL admission ledger, registered close-before-change authority gates, protected charged escrow, immutable MachineBinding, canonical occupancy, ProviderGuard and transactional recovery outboxes. Keep runtime action/input rights distinct from offering acquisition. Preparation and adopted settlement remain explicit non-consumer custody paths.

Add PhysicalMaintenance to the existing AssetCustody/Occupancy union. Exact Device and optional supply, current custodian/service/technician authority, prior-work proof, dependency-owner barriers and all old/new physical keys participate in one ordered L1. Atomically reserve destination interests, retain old ones, close inventory, acquire custody/slot and retain inputs/outbox. No second allocator or synthetic compute/boot prerequisites.

Remaining P2 response and preserved boundaries

Responds to the exact fresh complete-set review. The earlier commissioning/adopted-settlement findings remain resolved in the proposed contracts; this revision does not replace them with maintenance.

• physical-maintenance-v1 adds one explicit subject to the existing shared custody/slot/journal/release protocol, not a second allocator or executor.
• Passive Device work has exact asset/resource/custody identity, current action/input authority, protected finite work inputs and one-use technician permits; no MachineCapacity, Machine, quota hold, Installation or bootstrap is invented.
• Active dependent devices and connections retain their own custody and writers. Their separately authorized, effective prerequisite fences precede field admission; target clearance cannot reset, disconnect, wipe or reconnect them.
• Unknown work, delivery, cessation, identity, accounting or physical clearance retains custody and conservative old/new interests. Restoration reconciles independent owner/field history and excludes old crews before any recovery authority.
• L5, R2, physical reservation disposition and fresh inventory eligibility remain separate. Observational adoption causes no effects. Catalog withdrawal blocks acquisition but does not revoke retained runtime capabilities; current action/input rights and separate suspension remain mandatory.

No runtime implementation, core #41/#51/#58/#59 change, managed-service scope, compatibility machinery, new PR, merge, watch or self-signoff. This existing branch remains based on origin/main at 8ebec19513a0cbc8f219d3acae46f89ab471510b; companion branch diffs are not imported.

Exact final complete-set manifest

PR	Exact final head
#41	f04e63ddd9d10cbf306daf3a0232961debd85e7f
#51	fa07c2236801a33a58efc914b555586c8e146cc6
#58	a922ff1eb3275e26af6ae750a7515ddde245a754
#59	d7ff793b03711203dbfc9fac87d43922cc649b6f
#60	80c72446a574202c9dac5f6d3c26ce4a0af875ba
#61	8101f645cc8167f71a07147e6ea1a9cdf69a57cf
#62	496ec4530aa3bacdb4858d0b22192be1a92b0c48
#63	ce4a30a36ee476073281b40b8353ac5eb2c99e0c
#64	4495e20f4c3ee7697dfd97a5a95823ca5fa7b448
#65	94824bf7ef614fcdecf3ce813c289e259367e90c
#66	ffe6ed28e261578bbc3d0226585b5e80f5d5985c

This PR's final head is 80c72446a574202c9dac5f6d3c26ce4a0af875ba. Core heads are unchanged. #60–#65 pin immutable contract-bearing snapshots; #66 pins their final source heads. Post-contract commits refresh only pins/review provenance, avoiding circular final-head dependencies. Older embedded pins in snapshots are drafting history, not authority to substitute an older contract for this aligned set.

PR	Immutable contract-bearing snapshot
#60	4bf770db8bd2b065748c3b9384d4c72f9b8ec0e1
#61	25fef48790b13da95900de64ffd2d1b36e0510eb
#62	4f9934980b3f441c1d777157fa0ba1dcfce372d7
#63	2b384517fd08c04cf078923ebda2cddcfa1dc424
#64	58a6596d30b3819d0b3799192730626439ef9885
#65	310a55d97394bb296c579bd3ad01177455c15cc4
#66	26601c7121542d7c89ddac84c1f8592f08cb8372

Documentation validation

• Combined all eleven revisions with temporary git merge-tree/commit objects only: conflict-free; no branch or PR merge and no shell worktree. Combined tree c5c26cf30c2ee1f974404576220c106ad32961f2, local validation commit 036e40a0573be61b506fff7e8604bac4377117a0.
• Repository link checker plus fence-aware validation: 48 Markdown files, 647 local targets, 355 local anchors, no missing targets/anchors or undefined explicit references. All 21 unique pinned Fleet source paths exist.
• 15 SVGs parse/render; both DOT sources render; all three PlantUML sources pass check-only; four JSON examples parse. Three changed SVGs visually inspected for clipping/layout.
• D01–D40, I1–I39 and N1–N23 have unique contiguous definitions. All preexisting D01–D35, I1–I35 and N1–N21 rows remain byte-for-byte unchanged. New scenarios are specifications, not qualification runs.
• Per-PR changes remain inside each intended enhancement directory; original unrelated branch changes preserved. Original supplied head is an ancestor of each published head. Per-PR and combined whitespace checks pass.
• External HTTP sources were not comprehensively revalidated. docs: propose standalone Metal network handoff #61's previously unavailable cloud attachment reference remains an explicit owner prerequisite, not an assumed integration.

Remaining prerequisites and review status

Fresh independent complete-set integration review is required for this exact changed manifest; no previous approval or author check signs off these revisions. Implementation still needs the shared ledger hooks and synchronous storage/restore interlocks, independent R/KMS/PKI and physical fences, registered owner gates, protected inputs/evidence, qualified online field permits and site/crew exclusion, active-custody/network owner agreements, accounting applicability proofs, measured profile limits and real qualification/drills. QP does not qualify compute or supplier execution. R-history-loss reactivation remains unsupported until separately implemented and qualified.

No runtime, hardware, provider, Q0/Q1/QP/QD/QE qualification, owner approval or independent signoff is claimed. Ready for the requested fresh independent review, not merge or deployment approval.

[scotwells]

ARCHITECTURAL SIGN-OFF

Reviewed head 2563b2a, refreshed again before posting. Independent adversarial review of the complete allocation-admission proposal against the baseline lifecycle/source proposals and current #41/#51/#58/#59 heads (matching the pinned revisions). Scope: standalone Fleet/Metal only.

No architectural blockers found under the explicitly required contracts. In particular:

• Revocation/replay: broad dependency gates cover indirect IAM changes rather than just positive grants; mutation-ID/epoch reopening rejects stale openings, and request-lifetime invalidation history prevents revoke/restore from reviving an unbound request. See authority protocol, lines 194–255.
• Quota/concurrency: delayed Acquire after abort meets a cancellation tombstone; commit-versus-abort shares ledger locks; Bind is annotation of charged, non-expiring escrow, not a later veto. Serializable transactions, ordered locks and global enrollment/occupancy uniqueness address competing Machines and cross-provider aliases. See identity/storage, lines 122–192 and escrow, lines 302–347.
• Boundary ownership: ingress retains the actual actor/request; acquisition does not authorize installation; runtime checks current action/input authority against retained capabilities. Committed outboxes preserve exact identities, retirement retains obligations, and release keeps occupancy through quota acknowledgment. Independent recovery epochs prevent treating a stale backup as proof of absence. See caller/runtime, lines 275–300 and handoff/retirement/release/restoration, lines 391–490.

This is design sign-off, not implementation verification or runtime/hardware readiness. IAM/Milo/quota, storage/recovery, executor, network and release-owner implementation and fault-injection qualification remain mandatory; production enablement must remain closed without them (lines 558–565, 632–650). This review neither substitutes for those owner approvals nor approves a merge. No source changes or approval review submitted.