[scotwells]

Summary

Inventory lifecycle and trust: proposed documentation only. Select canonical identity, atomic physical plans and reservation interests, witnessed passive/server trust profiles, independent evidence, gate-ordered invalidation, observational adoption, movement/repair/retirement and conservative restoration. Distinct physical, supply, allocation and installation identities remain intact.

Give unallocated field work its exact PhysicalMaintenance join, including own-transition identity, optional supply, shared L1 reservations/custody/closure and scoped active-owner prerequisites. Add the concrete panel-17 move trace, idle-server variation, no-work baseline, unknown/restore handling, I36–I39 and separate post-clearance physical/compute revalidation.

Remaining P2 response and preserved boundaries

Responds to the exact fresh complete-set review. The earlier commissioning/adopted-settlement findings remain resolved in the proposed contracts; this revision does not replace them with maintenance.

• physical-maintenance-v1 adds one explicit subject to the existing shared custody/slot/journal/release protocol, not a second allocator or executor.
• Passive Device work has exact asset/resource/custody identity, current action/input authority, protected finite work inputs and one-use technician permits; no MachineCapacity, Machine, quota hold, Installation or bootstrap is invented.
• Active dependent devices and connections retain their own custody and writers. Their separately authorized, effective prerequisite fences precede field admission; target clearance cannot reset, disconnect, wipe or reconnect them.
• Unknown work, delivery, cessation, identity, accounting or physical clearance retains custody and conservative old/new interests. Restoration reconciles independent owner/field history and excludes old crews before any recovery authority.
• L5, R2, physical reservation disposition and fresh inventory eligibility remain separate. Observational adoption causes no effects. Catalog withdrawal blocks acquisition but does not revoke retained runtime capabilities; current action/input rights and separate suspension remain mandatory.

No runtime implementation, core #41/#51/#58/#59 change, managed-service scope, compatibility machinery, new PR, merge, watch or self-signoff. This existing branch remains based on origin/main at 8ebec19513a0cbc8f219d3acae46f89ab471510b; companion branch diffs are not imported.

Exact final complete-set manifest

PR	Exact final head
#41	f04e63ddd9d10cbf306daf3a0232961debd85e7f
#51	fa07c2236801a33a58efc914b555586c8e146cc6
#58	a922ff1eb3275e26af6ae750a7515ddde245a754
#59	d7ff793b03711203dbfc9fac87d43922cc649b6f
#60	80c72446a574202c9dac5f6d3c26ce4a0af875ba
#61	8101f645cc8167f71a07147e6ea1a9cdf69a57cf
#62	496ec4530aa3bacdb4858d0b22192be1a92b0c48
#63	ce4a30a36ee476073281b40b8353ac5eb2c99e0c
#64	4495e20f4c3ee7697dfd97a5a95823ca5fa7b448
#65	94824bf7ef614fcdecf3ce813c289e259367e90c
#66	ffe6ed28e261578bbc3d0226585b5e80f5d5985c

This PR's final head is ce4a30a36ee476073281b40b8353ac5eb2c99e0c. Core heads are unchanged. #60–#65 pin immutable contract-bearing snapshots; #66 pins their final source heads. Post-contract commits refresh only pins/review provenance, avoiding circular final-head dependencies. Older embedded pins in snapshots are drafting history, not authority to substitute an older contract for this aligned set.

PR	Immutable contract-bearing snapshot
#60	4bf770db8bd2b065748c3b9384d4c72f9b8ec0e1
#61	25fef48790b13da95900de64ffd2d1b36e0510eb
#62	4f9934980b3f441c1d777157fa0ba1dcfce372d7
#63	2b384517fd08c04cf078923ebda2cddcfa1dc424
#64	58a6596d30b3819d0b3799192730626439ef9885
#65	310a55d97394bb296c579bd3ad01177455c15cc4
#66	26601c7121542d7c89ddac84c1f8592f08cb8372

Documentation validation

• Combined all eleven revisions with temporary git merge-tree/commit objects only: conflict-free; no branch or PR merge and no shell worktree. Combined tree c5c26cf30c2ee1f974404576220c106ad32961f2, local validation commit 036e40a0573be61b506fff7e8604bac4377117a0.
• Repository link checker plus fence-aware validation: 48 Markdown files, 647 local targets, 355 local anchors, no missing targets/anchors or undefined explicit references. All 21 unique pinned Fleet source paths exist.
• 15 SVGs parse/render; both DOT sources render; all three PlantUML sources pass check-only; four JSON examples parse. Three changed SVGs visually inspected for clipping/layout.
• D01–D40, I1–I39 and N1–N23 have unique contiguous definitions. All preexisting D01–D35, I1–I35 and N1–N21 rows remain byte-for-byte unchanged. New scenarios are specifications, not qualification runs.
• Per-PR changes remain inside each intended enhancement directory; original unrelated branch changes preserved. Original supplied head is an ancestor of each published head. Per-PR and combined whitespace checks pass.
• External HTTP sources were not comprehensively revalidated. docs: propose standalone Metal network handoff #61's previously unavailable cloud attachment reference remains an explicit owner prerequisite, not an assumed integration.

Remaining prerequisites and review status

Fresh independent complete-set integration review is required for this exact changed manifest; no previous approval or author check signs off these revisions. Implementation still needs the shared ledger hooks and synchronous storage/restore interlocks, independent R/KMS/PKI and physical fences, registered owner gates, protected inputs/evidence, qualified online field permits and site/crew exclusion, active-custody/network owner agreements, accounting applicability proofs, measured profile limits and real qualification/drills. QP does not qualify compute or supplier execution. R-history-loss reactivation remains unsupported until separately implemented and qualified.

No runtime, hardware, provider, Q0/Q1/QP/QD/QE qualification, owner approval or independent signoff is claimed. Ready for the requested fresh independent review, not merge or deployment approval.

[scotwells]

ARCHITECTURAL SIGN-OFF

Reviewed SHA: 8fe054101ac3bea822e5d16e40cb375a884e7e56. Refreshed PR metadata and fetched refs/pull/63/head before this verdict; both still identify this exact commit.

Scope: independent adversarial review of the proposed standalone Fleet/Metal architecture only. Managed nodes, clusters and node services are excluded; no backwards-compatibility requirement is imposed. This is not implementation verification, hardware/security/facilities qualification, platform-owner approval, production readiness, or a formal GitHub approval.

No blocking architectural finding identified in the requested concurrency and failure traces:

• Physical reservation atomicity: concurrent overlapping rack/termination plans and response loss after commit have a defined winner: one SERIALIZABLE transaction retains the complete graph, decision and outbox; endpoint alias binding checks direct Device reservations; successor plans retain old/new interests until clearance. Partial acceptance, timeout-based release and stale unbound-plan enrollment are prohibited (lines 253–309).
• Upstream power accounting: two individually admissible loads sharing a breaker must be summed at every upstream element for the required failure scenarios, with phase/derating/inrush envelopes. A/B labels cannot establish independent UPS domains. Limit reductions close admission but retain existing commitments rather than inventing headroom or powering off tenants (lines 311–341).
• Identity and replacement: cross-project enrollment, replay after a lost response, reused BMC addresses and component replacement are constrained by global canonical adjudication, exclusive bindings, consumed challenges and incarnation-bound evidence. An unauthenticated duplicate allegation cannot disable another tenant. Whole-asset replacement cannot retarget the old allocation (lines 217–251, 384–437, 602–624).
• Revision-bound invalidation: allocation versus closure is ordered on docs: propose allocation admission and quota custody #60's gates. Reopening a coarse gate cannot resurrect evaluations from its previous epoch; expiry is checked at commit, and verified conflicts close the gate in the same transaction as their recording. Already-admitted effects are not falsely treated as cancelled by closure (lines 185–215, 439–483).
• Allocated maintenance, adoption and retirement: planned maintenance admits bounded authority atomically with closure, then requires destination reservation, consumer consent and actual quiescence before field work. A crash after movement retains both locations. Adoption racing a prior allocation preserves the custody conflict; unknown geometry/load quarantines its enclosing domain. Retirement requires independent execution, network, quota and physical-clearance settlement, not merely deletion or a successful disconnect (lines 514–659).
• Restoration: a backup predating enrollment or field-work permits cannot establish empty capacity. Independent recovery epochs, old-writer/effect fencing, disabled replay and reconciliation of union reservations prevent old signatures or missing records from authorizing reuse (lines 661–687).

Integration comparison used the requested immutable baselines:

• docs: propose allocation admission and quota custody #60 2563b2a2f177a72d20c1d62265c89ff15688ba25
• docs: propose standalone Metal network handoff #61 ed6edec5b056fd53343e11d58d979af495f1bd7c
• docs: concrete operation execution, fencing, and recovery #62 7fa823050a443c1f5b85c56e85ed04ebaa5bd2cb
• docs: propose secure customer BMC access #41 f04e63ddd9d10cbf306daf3a0232961debd85e7f
• docs: propose Fleet management service #51 fa07c2236801a33a58efc914b555586c8e146cc6
• docs: propose provider offerings and consumer access #58 a922ff1eb3275e26af6ae750a7515ddde245a754
• docs: propose PXE installation architecture #59 d7ff793b03711203dbfc9fac87d43922cc649b6f

The proposal preserves their allocation/operation identity, retained-input, current-authority, network ownership and settlement boundaries. In particular, #62 does not make a changed fence or expired session proof that old physical effects stopped.

Qualification boundary: authenticated BMC bootstrap, independent technician evidence, pre-boot NIC mapping/protected delivery, electrical profiles, maintenance admission/closure and recovery hooks, and independent recovery infrastructure are explicitly fail-closed enablement prerequisites. Their absence blocks the relevant capability; it is not permission to implement a weaker fallback. I am not treating those expressly required external qualifications as missing architectural protocols, nor claiming that the companion proposals already implement them.

Validation here is document/contract review, not execution of the proposed acceptance scenarios. No repository files were edited, and no runtime or hardware tests were run. At the final refresh all six reported checks/statuses were successful and no formal reviews were present.