0.12.0 release acceptance: the refactored runtime is proven end to end, or the milestone does not close

[stephrobert]

The gate this milestone cannot be closed without. It adds no product code:
it is impossible to close until the whole of feint has been exercised under the
new contract.

Why it exists

0.12.0 replaced three diverging runtime paths with one. The temptation after
such a change is to merge the refactor, watch the unit tests pass, and defer the
rest. This repository already knows what that costs: #475 survived for months
because every test was green while two packs of three enforced nothing.

So the criterion is not that the contract compiles. It is that the contract
can really express everything the three clouds need. A stack that passes at
the API level while its traffic no longer flows proves the contract is
incomplete.

What must be exercised, per provider

The same sequence on each, with the resources that provider actually serves:

apply  →  empty second plan  →  runtime witnesses  →  destroy  →  nil delta

• Scaleway — VPC, private network, server, public IP or gateway, security
  group, and the load balancer's control plane (its dataplane is declared absent,
  enforced.balancing = ["outscale"], so the balancing assertion skips out
  loud rather than passing).
• Outscale — Net and Subnet, Vm, root volume, security group, public
  address, LBU with its dataplane, which is the only one this emulator
  materialises.
• Exoscale — instance, private network, security group, instance pool and
  NLB where applicable, block storage. Driven by the exo CLI: Terraform is
  refused for this pack until upstream honours the endpoint (feint down on the exoscale stack sent five signed requests to api-ch-*.exoscale.com: the published provider splits, the stack lifts the only refusal, and only the fake signature stood #525), and what
  that leaves uncovered is named rather than skipped in silence.

And it must be real traffic

API says running is no longer enough — that sentence is exactly what hid four
defects on 2026-08-26. For every claimed dataplane:

claim	what must be observed
a machine	it exists on the host, booted, carrying the address the API published
a network	the interfaces are really attached; isolation and reachability behave as declared
a firewall	a port a rule opens answers, and a port no rule opens refuses — in the same pass
a balancer	a packet really reaches more than one backend
cleanup	nothing is left behind, measured rather than swept

Reachability is measured the way a user reaches it — through the published
address — never through incus exec, which bypasses the network, the firewall
and the address and would have found none of the four defects.

The release invariant: no axis regresses unexplained

v0.11.0 → v0.12.0
  driven  probed  contract  dataplane  shape  behaviour  negative   >= baseline

A fall is either a defect or a proof that was false. The second is
legitimate, so this invariant must never become a number that stops a bad
proof being withdrawn: a regression is acceptable when it is written down with
its reason, on the model corpus/accepted.json already uses.

One trap, measured on this repository: three of the seven axes are verdict
strings, not booleans. "unobserved" and "unchecked" are non-empty and have
been counted as successes here more than once. A comparison that treats them as
numbers will report a green regression check over a milestone that measured
less. #488 designs exactly this machinery and should be read before any
comparison is written.

What the fourth provider does and does not prove

internal/cli/testdata/provider-four/ (#517) answers is the contract generic
enough? It does not answer does Scaleway still work? The two are
complementary and this gate needs both: synthetic pack for the architecture
proof, three real packs for the product proof.

Where it stops

Closing this issue requires, all of them:

• architecture — no pack reaches the concrete driver, no pack knows Incus or
  OVN, the fourth pack passes, the contract is closed and falsified;
• functional — the three providers pass their reference scenarios; network,
  firewall and balancing really exercised where claimed and skipped by name
  where not; snapshot and restore; cleanup; concurrency;
• clients — the official CLIs, Terraform and OpenTofu, the retained
  third-party stacks;
• conformance — replay, contract, shapes, negative, behaviour, dataplane, and
  no unexplained fall against 0.11.0;
• quality — -race, crash and recovery, generated docs checked, changelog,
  release preflight.

One thing this gate must not become

A checklist somebody ticks. Every line above is a measurement with a witness,
and the pass that produces them says which of them it did not obtain. A gate
that reports only what it managed to check reads exactly like a gate that
checked everything.

[stephrobert]

The remaining decisions of 0.12.0, taken 2026-08-28

This issue judges the milestone, so the decisions that shape what it will judge
belong here rather than only in the issues they touch. Six, each with what founds
it, and the order they run in.

The milestone's own measure is the frame: feint changed its architecture deeply,
and on the way out every function promised to users still really works. So a
promised function that does not work outranks a claim that is not inspectable,
which outranks prose.

---

A — #548 is not a limit. It is a guess to remove.

PR #581 measured the third path end to end and it works: 443 open, 80 refused
with a listener behind it, 8080 refused with none as the negative control, and
outbound intact. Port 80 was open before the migration.

It was not shipped because Incus.Inspect decides which address a machine
"answers on" by taking the first global IPv4 of the lowest-named interface —
so after the migration Binding.Address would report the private address.

That inference is the defect. The plan already declares which address is
public; Attachment and Plan.PublicBlock carry it, and #541 gave the layer
Reconciler.PublicAddressOf for exactly this class of question. Interface order
is a convention, and this repository's rule is that what varies becomes a
field.

Two steps: Binding.Address reads the declaration (a defect fix on its own,
nothing a client sees changes), then the third path ships and #548 closes.
Recorded on #548.

B — #504 goes next, and today is the whole argument.

conformance:functional is the only gate that boots real machines and applies
the example stacks, and nothing in CI runs it. It is what surfaced the
isolation-detach race; finding that cost three pull requests, and the defect
was older than the entire range bisected.

The gate that would have caught today's three-PR defect on the day it landed is
the one this issue asks for. It must carry the doorstep at both ends, the mode
named in its output, a red that names the stack and the machine, and an
intermittency budget — that class struck 9 times in 13 runs, so a gate that
plays the suite once and reads a green as a proof is measuring luck. Recorded on
#504.

C — #520 is measured before it is scheduled.

Three merges today touched Exoscale. An issue describing a symptom from before
them may be describing nothing. Four issues have been overtaken by measurement
this week — #542 on its own site count, #365 on its premise, #566 on its scope,
#477 on its own preferred remedy. Measure, then decide.

D — #403 and #476 are one cheap batch, and earlier than they look.

#403 says the README promises the one client this emulator deliberately
refuses. That is the first thing anyone reads. Solidity starts at the front
door, not in the driver, and this has been wrong for two releases.

E — #571 step 1 is a defect fix, not a prerequisite.

sbs_volume is honoured today and its disk lands in block/v1, while
attach-volume, the update's volume map, CreateSnapshot, GetVolume and
DeleteVolume all resolve kindVolume alone. A client asking for a block root
disk today already has one none of those five can find, and the anti-theft
guard does not cover it.

So step 1 — the five operations resolve both kinds — is claimable on its own and
changes nothing for anybody. Step 2 is then the one-line flip this issue believed
it was, and #365 closes with it. Recorded on #571 and #365.

F — #572: declare the project catalogue, minimal form.

feint.yaml, defaulting to [default]. Echoing whatever name is asked is the
class #83 measured and closed on all three packs: an inventory that exists
because somebody asked for it. Its quieter half goes in the same change —
GetProject already echoes an unknown identifier, so the list filters honestly
and only the read invents. Recorded on #572.

---

The order

#504 + #520  →  #548 (via A)  →  #403 + #476  →  #571 step 1
             →  #571 step 2 + #365  →  #572  →  #545

One batch at a time. Two batches in parallel cost a day this week: they collided
on the station, on coverage/evidence.json, and produced two false attributions
because five runs were compared across two runtime modes nobody had named.

What this milestone has already been taught, and #545 must check

Seven instruments lied this week, each found by accident: $EPOCHREALTIME unset
in zsh, a stale golangci-lint cache twice, three network suites concluding
"the segment is broken" without ever asking whether the listener existed,
evidence:update silently overriding an exported FEINT_VM, a Route.Unearnable
whose reason had outlived its cause, and a bisection column of zeros presented as
a measurement.

So the release acceptance is not only do the axes hold. It is do the
instruments that answer that question still bite — which is what falsify is
for, and why every guard added this week ships with the mutation that reddens it.

[stephrobert]

The eleven measurements, each with its witness

Run on main@58d0115, the maintainer's station, FEINT_VM=incus-ovn, 2026-08-29.

what the contract demands	how it was obtained	verdict
the three providers pass their reference scenarios	mise run conformance	1655 s · 220 ok · 1 SKIP · 0 FAIL
the example stacks under real traffic	conformance:functional	rc=0
a claimed dataplane has its witness on the runtime	conformance:witness	rc=0
crash and recovery	conformance:crash	rc=0, kill -9 included
a real SSH login	conformance:ssh	rc=0
the README's own four commands	conformance:quickstart	rc=0
zones	conformance:zones	rc=0
the shipped container image drives the same clients	conformance:image	rc=0
the contract is closed and falsified	mise run falsify:all	988 mutations, 153 falsifications, 0 survived
-race, generated docs, changelog, release preflight	mise run prepush	rc=0
no axis of evidence regresses against 0.11.0	mise run evidence:verify	364 levels pinned, every one still delivered
the same gate on a GitHub runner	scheduled Runtime proof, run 33249879475	the three main legs green

The one SKIP, and why it is the right answer

SKIP: incus-ovn declares private_from_host=false;
      reachability is proven on the public plane (ssh suite)

The suite reads capabilities.private_from_host and skips naming where the
proof lives instead. That is what this issue asks for in as many words —
skipped by name where not claimed — and it is the rule CLAUDE.md states: an
undeclared capability counts as absent.

witness does the same, out loud:

SKIP: scaleway does not declare enforced.balancing — a property it never
      promised is not demanded of it (#481)

The release invariant, measured by an instrument rather than by hand

This morning I checked it by reading two JSON files side by side. That is the
shape this issue distrusts, and #545 named #488 as the machinery that should
exist first — sitting three milestones away in 0.15.0. It was brought forward and
shipped (#607):

mise run evidence:verify        held against v0.11.0
                                364 operation(s) pinned on 7 axes
                                every level is still delivered      rc=0
with two regressions planted:   REGRESSED dataplane true → false
                                REGRESSED shape observed → unobserved   rc=2

The invariant is now enforceable by anybody, including a downstream consumer, and
a withdrawal passes only when somebody wrote down why.

---

What this pass did NOT obtain

This section is the one the issue asks for by name: a gate that reports only what
it managed to check reads exactly like a gate that checked everything.

1. The population where the wait defects live

Three of today's fixes are about waiting — #587, #600, and the listen_for
capture. None of them is visible on this station. Measured today: a first
boot answers here in 0.038–0.083 s, and conformance:crash did its whole
sequence — boot, kill -9, survive, restart, sweep — in 3.58 s.

A local pass proves no regression and nothing else. The proof that those three
fixes work is the scheduled run on a GitHub runner, and the one taken today is a
single night.

2. Twenty-three routes no client drove

exoscale 18 · ipam 3 · block 1 · vpc 1

The eighteen are three different facts, and #611 separates them: seven are
blocked upstream by exoscale#573 (the reads-by-id a Terraform provider walks),
six are blocked by the exo CLI itself, and five nobody has triaged.

3. 385 fields on 139 operations that no recording arbitrates

The pass prints this itself. It is the shape blind spot, and #612, #613 and
#614 now carry it per pack — because it is not evenly spread: Outscale 0 %,
Scaleway 43 %, Exoscale 68 %.

4. Address parity: four divergences, unchanged since 2026-08-24

conformance:parity reports scaleway=1/1 outscale=1/1 exoscale=2/2, one root
cause: an Exoscale instance carries 192.0.2.1 on eth0 that its own API
publishes nowhere. mise.toml recorded exactly these figures five days ago,
along with the condition for the suite to join the aggregate. Not a regression
— a known bound, dated, with a written return criterion.

5. Eight suites are not in the conformance aggregate

I got this wrong at first and it is worth recording: I reported "every suite of
#545 passed" after the aggregate alone. functional, crash, witness, ssh,
quickstart, parity, zones and image are deliberately outside it, each for
a reason mise.toml states. All eight were then run separately, and all eight
are in the table above.

---

What this milestone earned, plainly

Three runtime paths that had diverged were replaced by one contract, and then the
whole of feint — API, Terraform, real clients, real machines, networks, firewalls
and balancers — was replayed to check the simplification was not paid for in
fidelity. It was not: no axis of evidence fell, and the one instrument that
could have told us otherwise was built rather than assumed.