[Casey-allard]

A host owner can die while one of its resource processes remains alive. Replacing that owner from PID absence or a clean-looking new directory cannot establish resource retirement. This draft adds an existing, bounded owner/holder epoch primitive for review before host-agent activation.

The original owner holds owner EX; every participating resource holds SH for the exact installation/profile/epoch. Retirement needs a fresh separately opened holder EX. Drop never marks Clean. Private local storage, exact directory/lock descriptor identities, a fixed 176-byte record, generation checks and durable publication barriers are preserved. This proves exclusion only of actual participants; it grants no boot/mailbox authority and does not prove original Child collection or recover unparticipating legacy resources.

Standalone head: 7cd704aefe01ed90169037415dd1574f876fdfea, based on upstream a707f5e817982d5140e50e05228eb155ed2200a8. Ten files; no mailbox service/launch/process, journal, guest-reader, SDK, #5328 API or active daemon changes. It imports the existing MIT SpiralCore component and original tests, preserving the complete notice and exact provenance. The only dependency change adds an edge to the already locked sha2 0.11.0 package; no package/version is added.

Qualification is deliberately source-scoped:

• The identical imported implementation and private tests passed 11 Linux integration entries (ten behavior scenarios plus one subprocess fixture), six private units, strict VMM library/test Clippy, format checks and independent code/Rust/security review on the declared development composition. Source-bound report and declared additive Core overlay.
• Fresh qualification now also passes on this exact standalone head, with no source overlays: Linux x86_64 / Rust 1.97.1 / release+locked / two jobs / serial tests / umask022. The original integration target passes 11 entries (ten behavior scenarios plus one subprocess fixture); the private scope passes six units, with 1,070 unrelated tests filtered; strict VMM library/integration-target Clippy passes. All 4,446 regular source files match the immutable Git export before and after execution. Complete workspace/features/conformance and native platform checks remain required before readiness.
• No guest, WAN, throughput, capacity, durable mailbox, production or FIPS qualification is asserted.

Please review the resource-exclusion/storage contract here while #5328 remains the shared mailbox interface discussion and #5336 remains the independent persistent SDK fix. SpiralCore #114 tracks cooperative watcher/worker/signer drain; #111 tracks actual helper ownership and collection. Canonical fresh-install provisioning and explicit legacy reconciliation remain integration requirements. This draft does not complete or close #4629 or those delivery gates.

[Casey-allard]

Fresh standalone-head qualification for 7cd704aefe01ed90169037415dd1574f876fdfea is complete for the declared component scopes. An immutable Git export was streamed directly to the authorized Linux x86_64 host; there were no service/Core overlays. All 4,446 regular source files were unchanged before/after.

Rust 1.97.1, release/locked, two build jobs, serial subprocess fixtures, incremental disabled, umask022:

cargo test --release --locked -p mvm-vmm --test installed_owner -- --test-threads=1
cargo test --release --locked -p mvm-vmm --lib host::installed_owner -- --test-threads=1
cargo clippy --release --locked -p mvm-vmm --lib --test installed_owner -- -D warnings

Results: integration 11 passed (ten behavior scenarios plus one fixture); private six passed, 1,070 unrelated tests filtered; strict Clippy passed. Zero failures or ignored tests in these executed scopes. Full outputs and source receipts are retained, with SHA-256:

• Integration: 54658252d27379513464b8def5c5641a06ea6060b8e30568ed09058c226073a7
• Private units: b3499115b229a60d777e8bdbf4187548bf538becef1b986f4912178d9296803b
• Clippy: 523308f4861246ab44de4248710bd7eab63ed0b15606bafb2ceba16db36434ac

The PR body now records this newer result separately from historical checks. This remains a draft: complete workspace/gated-feature/conformance and platform review gates are open. No guest, daemon activation, original-child collection, WAN, fleet or FIPS qualification follows from these component tests.

[auser]

Review seam from proposed mailbox rebuild handoff ADR, PR #5304: cutover cannot infer old-owner retirement from a missing PID or a fresh state directory. The draft now requires evidence that every participating mailbox/credential/egress/shared-state holder is fenced before a new VM can accept MVM-mediated effects or shared writes; unknown custody refuses cutover. A replacement may prewarm concurrently only if it cannot execute effectful workload code before the fence, otherwise stop the old execution first. This matches the conservative scope in #5340's resource-holder exclusion primitive, but does not claim it covers non-participants, activates the host agent, or proves guest/mailer cutoff. Please review the ADR wording against your actual participant/lock contract. No code overlap with #5340 and no production/rollover readiness claim.

[Casey-allard]

Confirmed against the proposed ADR-059 at a1e7e60 and #5340's current participant/lock contract. We accept the conservative cutover boundary.

The epoch lock can establish retirement only for resources that actually hold the original profile/epoch participant lock. A missing PID, a new state directory, or disappearance of the owner is insufficient. The coordinator must acquire the original holder exclusion and separately establish the required VM/helper/credential/egress/shared-state retirement before authorizing effects in the replacement. An unaccounted holder or unknown custody refuses cutover. Prewarming is compatible only while the replacement cannot execute effectful workload code before that fence.

#5340 remains a component contribution. It does not by itself activate the daemon or establish cutoff for unregistered resources. Our current original-helper recovery work retains the original Child, original VMM exit observer, signed boot/grants and original reader enrollment; it does not infer retirement from a reused PID or mint a replacement enrollment. Its paired subprocess recovery regression remains under qualification.

For reviewable native evidence on the separate installed shutdown path, the pinned two-Firecracker-guest 65-message run delivered every 257-byte object exactly and collected both original helpers on their first stop. Source, measurement scopes and limits. This is a completed original shutdown witness; the forced-replacement/cutover requirements remain open.

[auser]

Resource-holder epoch exclusion remains a source-scoped component, not active host lifecycle qualification. Integration, retirement and recovery are tracked in #5466 (handoff: #5466 (comment)); #4629 is not completed. Closing draft without merging or branch deletion.