PANTHEON_DEVICE_RECOVERY_FIRST_CODEX_DIRECTIVE.md

1# PANTHEON DEVICE RECOVERY FIRST — CODEX EXECUTION DIRECTIVE 2 3## Controlling decision 4 5This directive must be completed **before** the Pantheon operational-unification directive begins. 6 7Set and enforce: 8 9```text 10PANTHEON_PHASE=DEVICE_RECOVERY 11PANTHEON_DEVICE_REPAIR_LOCK=true 12PANTHEON_ORCHESTRATION_ALLOWED=false 13PANTHEON_INTEGRATION_ALLOWED=false 14PANTHEON_DEVICE_FLEET_READY=false 15NEW_AI_BUILD_ALLOWED=false 16NEW_FEATURE_WORK_ALLOWED=false 17M2_PANTHEON_RUNTIME_ALLOWED=false 18DONOR_RUNTIME_ALLOWED=false 19DESTRUCTIVE_DATA_LOSS_ALLOWED=false 20UNVERIFIED_STORAGE_MUTATION_ALLOWED=false 21``` 22 23The only active mission is to repair, stabilize, protect, and verify every Pantheon device and its existing local services. Do not combine the AIs, redesign Pantheon, ingest donors, add capabilities, or begin cross-device orchestration until the final fleet gate passes. 24 25## Scope 26 27### Core runtime devices that must pass 28 291. **MEGAMIND-AGI Windows** 302. **MEGAMIND Ubuntu WSL2** 313. **M4 Mac mini** 324. **M1 / VALKYRIE MacBook Pro** 335. **Bubbles Debian node** 34 35### Operator device 36 376. **M2 MacBook Pro** — operator, audit, and evidence terminal only. It must remain unnecessary for Pantheon runtime operation. 38 39### Historical remote devices 40 417. **IONOS-MediaMind** 428. **BATMAN** 43 44IONOS-MediaMind and BATMAN must end in exactly one verified state: 45 46- `REAUTHENTICATED_DORMANT_READY` 47- `REAUTHENTICATED_ASSIGNED_ROLE` 48- `RETIRED_NOT_PANTHEON` 49- `BLOCKED_NO_LONGER_CONTROLLED` 50 51They may not remain `UNKNOWN` while being counted as Pantheon devices. 52 53The iPhone and iPad are not Pantheon compute/storage nodes and must remain excluded. 54 55## Current issue ledger that this directive must resolve 56 57### MEGAMIND Windows / WSL 58 59- Windows C: is storage-exhausted with less than 1 GB free. 60- The 926 GB `ext4.vhdx` contains the stopped WSL environment and candidate-authoritative ORACLE, graph, PostgreSQL/WAL, and generation-157 state. 61- WSL is stopped. 62- Windows port proxies point to a historical stopped WSL address and reset connections. 63- Windows Tailnet identity was offline at the audit cut. 64- ORACLE and graphd cannot be verified while WSL is unavailable. 65 66### M1 / VALKYRIE 67 68- Internal storage is critical at about 13–14 GB free. 69- Live VALKYRIE, Endless, Atlas, embedding, and homeostasis services must not be damaged during cleanup. 70- Endless Table has modified and untracked production files. 71- Seferim PID files are stale. 72- M1 intentionally has an embedding model only; it must not be falsely reported as a language generator. 73 74### M4 75 76- Pantheon/MEGAMIND/model/database launch agents are disabled. 77- No local language/model backend is currently live. 78- Core source trees are not independently versioned. 79- Internal storage has limited headroom. 80- The 6 TB `/Volumes/MEGAMIND` drive is mounted and must be verified as a reliable backup/runtime target. 81- A separate 5 TB HFS disk is present but unmounted and unknown. 82- Port `4222` is owned by Tailscale Funnel, not Pantheon NATS. 83- Secret-bearing files exist and cannot be reused blindly. 84 85### Bubbles 86 87- Bubbles carries the most active NATS/corpus workload and must be treated as a critical node. 88- `/home/user/mmk` is untracked inside an unrelated repository. 89- `mmteach` is degraded. 90- `mmloop` is passive rather than autonomously cycling. 91- Current orchestration/certification can overstate success. 92- Bubbles has wired and Wi-Fi addresses; the Pantheon route must have one explicit primary interface. 93 94### M2 95 96- Preserved Pantheon evidence and historical data are mostly unversioned. 97- `megamind-irreplaceable-backup` has not been proved redundant by cross-storage hashes. 98- M2 must not acquire a Pantheon runtime dependency. 99 100## Global safety rules 101 1021. **Protect unique state before repair.** The WSL VHD and its graph/WAL, M1 VALKYRIE/Endless state, Bubbles brain/corpora/indexes, M4 history/state, and M2 evidence are protected inputs. 1032. **No blind deletion.** Delete only regenerable cache/log/temp material after recording the path, size, classification, and rollback or reproduction method. 1043. **No WSL unregister before proof.** `wsl --unregister` is forbidden unless a complete export exists on independent storage, its hash and contents are verified, an isolated restore/import has passed, critical databases/graph records have been read back, and the rollback procedure has been tested. 1054. **No disk erase or format.** Never initialize, erase, repartition, or reformat the unknown M4 5 TB disk. 1065. **No ad-hoc VHD surgery.** Compaction, movement, repair, or import must use supported offline WSL/VHD procedures after verified backup. 1076. **No operating-system upgrade as cleanup.** Do not update macOS, Windows, Debian, firmware, WSL, package sets, or kernels unless the current repair is impossible without it and the change has a tested rollback. 1087. **No archived secret reuse.** Record required variable names only. Quarantine old values and rotate credentials before external services are enabled. 1098. **Donor models stay off.** GPT-OSS, DeepSeek, Kimi, and other donor inference runtimes remain disabled. 1109. **Wired LAN is primary.** Use the local wired network for Pantheon data traffic. Tailscale is the remote-management/failover path unless a measured reason requires otherwise. 11110. **Do not confuse listeners with health.** A PID, port proxy, launch definition, stale PID file, or open port is not a healthy service. 11211. **One change at a time.** Record before-state, exact action, after-state, test, rollback, and evidence before continuing. 11312. **Never make M2 a dependency.** Recovery commands may be launched from M2, but all backups, manifests, service definitions, and required runtime state must exist independently of M2. 114 115## Evidence and logging standard 116 117Create one recovery run ID: 118 119```text 120PANTHEON_DEVICE_RECOVERY_<UTC_TIMESTAMP> 121``` 122 123For every device, maintain: 124 125```text 126<run-id>/<device>/ 127 before.json 128 storage-before.txt 129 network-before.txt 130 processes-before.txt 131 services-before.txt 132 protected-paths.json 133 backup-manifest.json 134 actions.log 135 verification.log 136 after.json 137 rollback.md 138 blockers.md 139``` 140 141Store the authoritative recovery evidence in two independent locations when available: 142 143- Bubbles: `/mnt/data/pantheon-recovery/<run-id>/` 144- M4: `/Volumes/MEGAMIND/pantheon-recovery/<run-id>/` 145 146M2 may hold a read-only convenience copy, never the only copy. 147 148Do not write secrets into these artifacts. 149 150## Fleet acceptance thresholds 151 152These are Pantheon operational thresholds for this recovery, not generic hardware claims. 153 154- System clocks agree within 2 seconds across the wired cluster. 155- No duplicate LAN address or ambiguous hostname remains. 156- Ten-minute wired packet-loss test between every core pair shows 0% loss under idle conditions. 157- Every runtime device can be managed without M2 remaining powered on after services are configured. 158- Every protected data store has at least one independent verified backup or application-consistent snapshot. 159- Every running local service maps to a source commit, captured rescue commit, or preserved binary hash plus configuration hash. 160- Every service manager definition survives a controlled reboot. 161- No system volume remains in a critical free-space state. 162- No current health endpoint reports success when a required dependency is absent. 163 164Target minimum free-space gates: 165 166- MEGAMIND Windows C: at least **100 GB and 10% free**. 167- M1 internal: at least **40 GB and 15% free**. 168- M4 internal: at least **40 GB and 15% free**. 169- Bubbles root: at least **20% free**. 170- Bubbles `/mnt/data`: retain at least **25% free** after recovery copies. 171- M2 internal: retain at least **50 GB free**; no Pantheon runtime may be installed to use it. 172 173If a target cannot be reached without deleting candidate-unique state, stop with a precise storage blocker rather than lowering the threshold silently. 174 175# Execution order 176 177## Phase D0 — Freeze and fresh read-only fleet baseline 178 1791. Verify `MANIFEST.sha256` for the supplied Pantheon audit packet. 1802. Stop all unrelated Codex tasks and new builds. 1813. Do not start ORACLE, graphd, M4 models, named minds, donor workers, or new orchestration routes. 1824. Collect fresh host identity, OS/build, uptime, CPU/RAM, disk inventory, filesystem state, free space, mount state, SMART/health where supported, power settings, time sync, DNS, routing, firewall, process ownership, listeners, service-manager state, and current backups from every accessible device. 1835. Confirm the current wired and Tailnet addresses rather than trusting historical values. 1846. Verify Bubbles `/mnt/data` and M4 `/Volumes/MEGAMIND` have enough real free capacity to serve as independent recovery targets. 1857. Run non-destructive disk verification on those backup targets before copying authoritative state. 1868. Produce a ranked blocker list. MEGAMIND capacity remains P0 unless fresh evidence disproves it. 187 188**D0 gate:** all reachable devices inventoried; two backup targets measured; no state mutation; protected paths frozen. 189 190## Phase D1 — Certify backup targets first 191 192### Bubbles target certification 193 194- Verify `/mnt/data` filesystem health, mount options, free space, inode availability, ownership, and sustained read/write checksum behavior in a temporary test directory. 195- Verify the test directory can be removed without touching corpus/state paths. 196- Confirm the recovery destination is excluded from corpus ingestion and automatic cleanup. 197 198### M4 target certification 199 200- Verify `/Volumes/MEGAMIND` identity, filesystem, capacity, mount stability, and non-destructive disk health. 201- Run Apple-supported storage verification in the correct volume/container/device order when applicable. 202- Test write, flush, unmount/remount if safe, readback, and checksum in a temporary recovery test directory. 203- Confirm the volume automatically remounts after a controlled reboot or document the required mount service. 204 205**D1 gate:** at least one target is certified for the complete WSL export and both targets are certified for critical-state backups. If neither target passes, stop with `BLOCKED_NO_SAFE_BACKUP_TARGET`. 206 207## Phase D2 — MEGAMIND emergency recovery 208 209### D2.1 Preserve WSL before capacity repair 210 2111. Keep Ubuntu stopped. 2122. Record WSL version/status, distro registration, VHD path, file size, Windows volume state, and current port-proxy rules. 2133. Create a complete independent recovery copy using one supported route that does not stage another full copy on C:: 214 - a direct WSL export to independent storage; or 215 - a stopped, byte-preserving copy of `ext4.vhdx` to independent storage. 2164. Create a second critical-state preservation set for Windows-visible ORACLE/cluster source, service definitions, manifests, and other state accessible without starting WSL. After the complete-copy gate passes and WSL is started in maintenance mode, add application-consistent PostgreSQL logical dumps, WAL/archive metadata, graph state, ORACLE configuration, and package manifests. 2175. Hash the complete recovery object and all critical-state artifacts. 2186. Validate the complete recovery object by the strongest supported non-destructive method available: 219 - isolated WSL import/restore on suitable Windows-compatible local or external storage; or 220 - read-only VHD validation/mount plus filesystem and expected-path inspection; or 221 - another documented WSL/VHD integrity check that proves the object is complete and readable. 2227. An isolated import/restore is preferred, but absence of a spare Windows-compatible disk must not force unsafe same-disk work. In that case record `RESTORE_TEST_DEFERRED_NEEDS_SPARE_WINDOWS_STORAGE`, retain the verified full copy, and do not unregister or replace the original distribution. 2238. Read back expected ORACLE/graph/PostgreSQL/generation-157 paths from the validated copy when the chosen validation method permits it. 2249. Do not unregister, replace, move, or compact the original distribution until the complete-copy and validation gates pass. 225 226### D2.2 Recover Windows capacity 227 228After D2.1 passes: 229 230- Inventory C: usage by category. 231- First remove or relocate only regenerable Windows temporary files, crash dumps, update residue, installer caches that Windows can safely recreate, and other explicitly non-authoritative material. 232- Preserve logs required to diagnose the incident before rotation/removal. 233- Measure the real used/free space inside the WSL filesystem. 234- If the VHD contains reclaimable unused blocks, use a supported offline compact/move procedure only after the backup and restore gates pass. 235- Prefer moving the WSL distribution to a dedicated local physical volume with sufficient headroom rather than returning it to a nearly full system disk. 236- Never host the active WSL VHD on an unreliable or transient network share. 237- Do not use `wsl --unregister` unless the verified export/import rollback gate above has passed. 238 239### D2.3 Restore Windows and WSL host health 240 241- Reach the Windows free-space gate. 242- Verify Windows filesystem and physical-disk health. 243- Restore Windows Tailnet connectivity with a current device identity. 244- Start WSL in controlled maintenance mode. 245- Verify WSL filesystem health, internal free space, DNS, time, networking, default user, systemd/service manager, and package-manager consistency. 246- Verify PostgreSQL/WAL integrity before allowing graphd or ORACLE to write. 247- Verify generation 157, 1,312 nodes, 515 edges, `brain.live_coverage`, and `brain.human_equivalence.status` from the preserved authoritative state. 248- Keep scientific equivalence false and donor runtimes off. 249- Replace the stale hard-coded port-proxy target with a supported stable routing method. Do not retain a proxy to historical WSL IP `172.31.126.135` unless that is freshly verified as current. 250- Require endpoint dependency checks so Windows proxy listeners cannot report ORACLE healthy when WSL or ORACLE is down. 251- Reboot Windows once and prove WSL, storage, network identity, routes, and local service readiness recover predictably. 252 253**D2 acceptance:** 254 255```text 256MEGAMIND_WINDOWS=HEALTHY 257MEGAMIND_WSL=HEALTHY 258WINDOWS_C_FREE_BYTES>=100000000000 259WSL_EXPORT_VERIFIED=true 260WSL_RESTORE_TEST_PASSED=true 261POSTGRES_WAL_INTEGRITY=PASS 262GENERATION_157_VERIFIED=true 263ORACLE_LOCAL_HEALTH=PASS 264GRAPHD_LOCAL_HEALTH=PASS 265DONOR_RUNTIME=OFF 266``` 267 268Do not register ORACLE with Pantheon yet. This is local device/service recovery only. 269 270## Phase D3 — M1 / VALKYRIE storage and state recovery 271 2721. Quiesce each stateful service using its supported method; do not copy open SQLite/Badger state blindly. 2732. Create application-consistent backups of: 274 - `/Users/beandaddy/valkyrie-data` 275 - `/Users/beandaddy/endless-table-server/data/endless.db` plus required WAL/SHM state 276 - `/Users/beandaddy/.seferim` 277 - service definitions and launch configuration 278 - `/Users/beandaddy/endless-table-server` source and dirty worktree 2793. Hash and verify the backups on both certified targets where capacity permits. 2804. Capture the dirty Endless worktree into a private rescue branch/commit without discarding tracked changes or untracked production files. 2815. Capture binary and configuration hashes for VALKYRIE, Endless, Atlas, Ollama, and homeostasis. 2826. Inventory internal storage by category. 2837. Offload or remove only regenerable caches, duplicate installers, obsolete build products, rotated logs, and verified duplicate archives. 2848. Do not move or delete live VALKYRIE, Endless, Seferim, Atlas, or embedding state merely to satisfy the threshold. 2859. Remove stale `builder.pid`, `nexus.pid`, and `federation/bridge.pid` only after confirming no matching live process and recording the cleanup. 28610. Verify internal filesystem health; if repair requires macOS Recovery, record the exact manual repair gate and do not pretend it passed. 28711. Restore and test local services independently: 288 - VALKYRIE `brain_new` 289 - Endless Table 290 - Endless Pantheon local dependencies 291 - Atlas 292 - Ollama embedding model 293 - homeostasis 29412. Keep M1 classified as embedding-only. Do not install a language generator merely to remove a `MISSING` label. 29513. Reboot M1 and prove services, mounts, state counts, and Bubbles NATS connectivity return without state loss. 296 297**D3 acceptance:** 298 299```text 300M1_STORAGE_FREE_GB>=40 301M1_STORAGE_FREE_PERCENT>=15 302VALKYRIE_STATE_BACKUP=VERIFIED 303ENDLESS_SQLITE_BACKUP=VERIFIED 304ENDLESS_SOURCE_RESCUE_COMMIT=CREATED 305STALE_PIDS=RESOLVED 306VALKYRIE_LOCAL_HEALTH=PASS 307ENDLESS_LOCAL_HEALTH=PASS 308ATLAS_LOCAL_HEALTH=PASS 309EMBEDDING_RUNTIME=PASS 310M1_REBOOT_TEST=PASS 311``` 312 313## Phase D4 — M4 storage, source, network, and local runtime readiness 314 3151. Verify the internal APFS storage and the mounted 6 TB `/Volumes/MEGAMIND` device. 3162. Reach the M4 internal free-space gate by relocating only verified non-authoritative archives, caches, build products, model download residue, and duplicate externalized copies after hashes/provenance are recorded. 3173. Inventory all Pantheon/MEGAMIND/MLX/Atlas/model/database source and state roots on internal storage and the 6 TB volume. 3184. Compare internal and externalized source copies by path, timestamp, size, and hash where practical. Do not assume the externalized mirror is newer. 3195. Create private rescue repositories or immutable source manifests for currently unversioned deployable trees. Do not rewrite original timestamps or discard divergent copies. 3206. Inspect the separate 5 TB HFS disk read-only if the hardware and filesystem permit. Never erase, initialize, or reformat it. Record its identity, health, partitions, mount result, top-level inventory, and whether it contains unique Pantheon state. 3217. If the 5 TB disk cannot be safely read, classify it `BLOCKED_DISK_NEEDS_MANUAL_INSPECTION`; do not call it empty or redundant. 3228. Resolve port `4222` ownership: 323 - Bubbles remains the Pantheon NATS broker. 324 - M4 `:4222` must not be advertised as NATS while owned by Tailscale Funnel. 325 - Relocate or disable that Funnel mapping if it is not explicitly required, or reserve/document the conflict so no Pantheon configuration targets it. 3269. Validate launchd definitions, ownership, working directories, dependencies, resource limits, logs, and restart behavior for existing approved local services. 32710. Quarantine archived secret values and produce a variable-name-only configuration manifest. 32811. Keep Pantheon, MEGAMIND, model, database, and generator launch agents disabled during device recovery. Validate their definitions, paths, permissions, dependencies, and logs without activating the AI stack. 32912. Record whether an approved non-donor generator asset appears present, but defer generation startup and behavioral testing to the Pantheon orchestration directive. 33013. Reboot M4 and verify internal/external mounts, source paths, launch definitions, and host readiness without any disabled AI service starting unexpectedly. 331 332**D4 acceptance:** 333 334```text 335M4_STORAGE_FREE_GB>=40 336M4_STORAGE_FREE_PERCENT>=15 337M4_INTERNAL_DISK_HEALTH=PASS 338M4_6TB_DISK_HEALTH=PASS 339M4_5TB_DISK=INVENTORIED_READ_ONLY|BLOCKED_MANUAL_INSPECTION 340M4_SOURCE_LINEAGE=CAPTURED 341M4_PORT_4222_FALSE_NATS=RESOLVED 342M4_LAUNCHD_VALIDATION=PASS 343M4_AI_STACK_REMAINS_DISABLED=true 344M4_GENERATOR_ASSET_STATUS=PRESENT_UNVERIFIED|MISSING|UNKNOWN 345M4_REBOOT_TEST=PASS 346``` 347 348A missing approved generator asset does not make the hardware unhealthy, but it must remain an explicit blocker for the later Pantheon integration phase. 349 350## Phase D5 — Bubbles durability, source, network, and local service recovery 351 3521. Verify root NVMe and `/mnt/data` filesystem/physical-disk health, free space, inodes, mount persistence, and log growth. 3532. Back up and hash: 354 - `/home/user/mmk` 355 - `/home/user/brain-data` 356 - NATS configuration and persistent state 357 - service-manager definitions 358 - corpus manifests, index metadata, current harvester state, and irreplaceable small control files 3593. Do not duplicate the entire corpus blindly when deterministic corpus manifests and restore instructions can prove reconstruction. Preserve candidate-unique indexes and state explicitly. 3604. Create a clean private rescue repository for `/home/user/mmk` from the exact active tree. Record the unrelated parent repository/branch but do not leave `mmk` untracked. 3615. Map every running Bubbles binary to the rescue commit or a preserved binary hash and configuration hash. 3626. Make wired `192.168.1.132` the explicit Pantheon primary route. Keep Wi-Fi secondary only if it has a tested purpose and cannot cause asymmetric routing or duplicate service advertisement. 3637. Verify NATS configuration, permissions, subjects, monitoring, persistence, restart behavior, and VALKYRIE client reconnection. 3648. Diagnose and repair `mmteach` locally: backlog, file descriptors, event loop, dependencies, callers, health timeout, and service limits must be measured before restart. 3659. Define `mmloop` honestly as `ON_DEMAND` or `EVENT_DRIVEN`; eliminate stale autonomous-health claims. 36610. Fix local health semantics so `mmorch`, `mmcert`, or any gateway cannot report success from HTTP errors, empty output, query echo, or missing required dependency. Do not yet add cross-device ORACLE orchestration. 36711. Add bounded log rotation and disk-growth alarms that cannot delete protected evidence or corpus state. 36812. Reboot Bubbles and prove NATS, brain state, corpora, harvesters, and repaired local services recover in the correct order. 369 370**D5 acceptance:** 371 372```text 373BUBBLES_ROOT_FREE_PERCENT>=20 374BUBBLES_DATA_FREE_PERCENT>=25 375BUBBLES_DISK_HEALTH=PASS 376MMK_RESCUE_REPOSITORY=CREATED 377BRAIN_DATA_BACKUP=VERIFIED 378NATS_LOCAL_HEALTH=PASS 379VALKYRIE_RECONNECT=PASS 380MMTEACH_LOCAL_HEALTH=PASS 381MMLOOP_MODE=ON_DEMAND|EVENT_DRIVEN 382FALSE_SUCCESS_HEALTH=RESOLVED 383BUBBLES_REBOOT_TEST=PASS 384``` 385 386## Phase D6 — M2 operator/evidence protection without runtime 387 3881. Confirm no Pantheon runtime process or launch agent exists on M2. 3892. Hash and back up to both certified targets where practical: 390 - `/Users/josephanady/pantheon_pending_commit` 391 - `/Users/josephanady/megamind-irreplaceable-backup` 392 - `/Users/josephanady/.seferim` 393 - current device-recovery and architecture packets 3943. Compare the 2.1 GB irreplaceable backup against other storage by hash/manifests and record what is truly unique. 3954. Put preserved source/evidence into a private provenance-controlled repository or immutable manifest without changing original evidence copies. 3965. Maintain at least 50 GB free using only ordinary non-Pantheon cleanup. 3976. Test that M2 can be powered off while every core runtime device and local service remains healthy. 398 399**D6 acceptance:** 400 401```text 402M2_PANTHEON_RUNTIME=false 403M2_EVIDENCE_BACKUP=VERIFIED 404M2_UNIQUE_STATE_CLASSIFIED=true 405M2_FREE_GB>=50 406M2_POWER_OFF_TEST=PASS 407``` 408 409## Phase D7 — IONOS-MediaMind and BATMAN resolution 410 411For each remote historical node: 412 4131. Verify current ownership and authorization. 4142. Replace expired authentication/Tailnet enrollment with new credentials; never reuse archived keys. 4153. Verify hostname, OS, storage, filesystem health, free space, source/state, services, and network identity. 4164. Do not start archived AI services during inventory. 4175. Assign an explicit role only if unique capability/state and a current operational need are proved. 4186. Otherwise mark it `RETIRED_NOT_PANTHEON` and remove it from live device counts and required routes without deleting historical evidence. 4197. If the device is no longer controlled, mark `BLOCKED_NO_LONGER_CONTROLLED` and remove it from runtime requirements. 420 421**D7 acceptance:** no remote node remains `UNKNOWN` or falsely counted as live. 422 423## Phase D8 — Cross-device fleet verification, still without Pantheon orchestration 424 4251. Verify hostnames, wired addresses, Tailnet addresses, DNS, time sync, and routing table on every core node. 4262. Run ten-minute packet-loss and latency tests across every core pair on wired LAN. 4273. Run bounded throughput tests without disrupting NATS, databases, or corpora. 4284. Verify SSH/remote-management paths and least-privilege access. 4295. Verify firewall rules expose only required management and local-service ports. 4306. Restart each core node one at a time and prove the other nodes remain healthy. 4317. Verify each node's local services return in dependency order. 4328. Verify all recovery evidence exists on both Bubbles and M4 and is readable without M2. 4339. Verify no donor runtime, new AI, or cross-device Pantheon orchestration was started. 43410. Produce the final device matrix with `PASS`, `BLOCKED`, or `RETIRED` for every device and every issue from the original ledger. 435 436## Final device-fleet gate 437 438Set: 439 440```text 441PANTHEON_DEVICE_FLEET_READY=true 442``` 443 444only when all of the following are true: 445 446- MEGAMIND Windows and WSL pass D2. 447- M1 passes D3. 448- M4 passes D4, with generator assets merely inventoried and all AI activation deferred to the integration phase. 449- Bubbles passes D5. 450- M2 passes D6 and is not required. 451- IONOS-MediaMind and BATMAN are resolved to verified active/dormant, retired, or no-longer-controlled states. 452- All protected state has verified independent recovery evidence. 453- Storage thresholds pass. 454- Filesystem and disk health checks pass or an exact physical-service blocker is recorded. 455- Wired/Tailnet identity and routing are unambiguous. 456- Reboot and one-node-at-a-time recovery tests pass. 457- Local service health is honest and dependency-aware. 458- Donor runtimes remain off. 459- No Pantheon cross-device orchestration has begun. 460 461If any core device is blocked, leave: 462 463```text 464PANTHEON_DEVICE_FLEET_READY=false 465PANTHEON_ORCHESTRATION_ALLOWED=false 466``` 467 468and report the exact blocker, required physical resource or credential, preserved evidence, and safest next action. 469 470## Required final report 471 472At the end of every device phase, print: 473 474```text 475PHASE=D<number> 476DEVICE=<device-or-fleet> 477STATUS=PASS|FAIL|BLOCKED|RETIRED 478ISSUES_FOUND=<exact list> 479CHANGES=<exact reversible changes> 480DATA_PROTECTED=<paths and backup IDs> 481STORAGE_BEFORE=<bytes and percent> 482STORAGE_AFTER=<bytes and percent> 483HEALTH_TESTS=<results> 484REBOOT_TEST=<result> 485ROLLBACK=<tested rollback> 486BLOCKERS=<none or exact blocker> 487PANTHEON_DEVICE_FLEET_READY=false 488PANTHEON_ORCHESTRATION_ALLOWED=false 489``` 490 491After D8, produce: 492 493- `PANTHEON_DEVICE_RECOVERY_RESULTS.json` 494- `PANTHEON_DEVICE_FINAL_MATRIX.csv` 495- `PANTHEON_DEVICE_PROTECTED_PATHS.json` 496- `PANTHEON_DEVICE_BACKUP_MANIFEST.json` 497- `PANTHEON_DEVICE_NETWORK_MAP.json` 498- `PANTHEON_DEVICE_SERVICE_MANIFEST.json` 499- `PANTHEON_DEVICE_SOURCE_LINEAGE.json` 500- `PANTHEON_DEVICE_ROLLBACK_RUNBOOK.md` 501- `PANTHEON_DEVICE_BLOCKERS.md` 502 503Do not begin the Pantheon operational-unification directive until `PANTHEON_DEVICE_FLEET_READY=true` is supported by these artifacts and the measured results. 504