[nikhilunni]

Summary

Fixes #1615. The nightly chaos swarm has failed one seed per night since 2026-10-08 with single-ownership — session owns 2 live sandboxes across the fleet. All 27 reported seeds reproduce on main, and all have the same shape. The same seeds fail identically on the last green nightly's tree (8e116acc0), so this is not a regression from the 10-07 landings: the class is as old as the durable teleport machine and the day-derived seed windows reached it for the first time on 10-08.

The shape

An admin drain plans a snapshot teleport. Capture holds the source paused, the destination restores and attaches, and the release step destroys the source and writes its tombstone in the same breath (ADR 0123 B5/B7). The source host sits in a deferred-effect window, so the destroy is acked but not yet applied. The world still lists the paused, entombed source next to the running destination, and the oracle counted two owners for a finished, correct move.

The idle-evict path never trips this because its resume prefers the same host, so the replacement VM's create effect queues behind the destroy in causal order. A teleport lands on a different host by definition, so only the source side is deferred.

The fix

The oracle reads "live" the way ADR 0116 A-D5 defines ownership:

• An entombed sandbox is not an owner. A sandbox_tombstones row is the coordinator's durable decree that the VM is dead: nothing routes to it again, its late outputs are fenced by the binding epoch, and the host destroys it on heartbeat consumption even when the destroy RPC's effect was lost. Counting it would make the oracle demand a host-affirmed probe before every teleport release, which ADR 0123 B7 deliberately does not require. Quiescence still catches a tombstone that never lands: the leftover VM is unclaimed and no-orphan-sandboxes fails on it.
• An open teleport row owns two resident VMs by design (the held source and the running destination). Exactly the row's source and destination count as one owner while the row is open; quiescence-open-teleport forbids the row to outlive the run.

A partitioned-but-up host's VMs, a falsely evicted session's first VM (#787), and a retained Idle binding resumed elsewhere (#896) still count as before; their pinned tests still pass.

Validation

• Seed 33194461 is pinned in crates/engram-dst/tests/regression_seeds.rs (fails without the change at step 56, passes with it).
• All 27 nightly seeds from nightly sim: single-ownership violated #1615 converge through 5000 steps plus quiescence with the change.
• cargo nextest run -p engram-dst: 58 passed. cargo clippy -p engram-dst --all-targets -D warnings, cargo fmt --all --check, cargo hakari generate --diff clean.

Nightly workflow

A job that fails before the swarm runs (a package mirror outage during Install protoc, a build break, a runner death) no longer opens an "infra failure (no failure report)" issue; the red job is the signal. The three jobs' copy-pasted filing steps now share .github/scripts/sim-failure-issue.sh, which files or updates an issue only when a --failure-report exists and keeps the one-issue-per-slug dedup. Validated with yaml.safe_load, actionlint (only the pre-existing custom runner-label notes remain) and shellcheck.

Related issues

#1492, #1493, #1494 were closed separately: that run's Install protoc step failed on a transient Ubuntu mirror fetch, and every nightly since has installed it normally.

🤖 Generated with Claude Code