Hermes/multi-simadmin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
4e7bdea23019de95a453985e60fcc7bf15fbda68
multi-simadmin/docs/product/operation-acceptance-matrix.md
T

197 KiB
Raw Blame History

Operation acceptance matrix — upstream 58e2204

Generated from the structured ledger. Registry is the sole source for risk, confirmation, capability, and dedicated-flow facts; orchestration is bound by acceptance policy. registeredOperation is not a synonym for preparation Job.

REAL_READ means captured evidence and is restricted to captured-readonly. REAL_READ_DEFERRED marks denied candidates without a real fixture. Fixture disposition is metadata-only: runtime status, count, safe observed status categories, and reason; it never renders fixture body/response, alias, identity, or URL.

Control-plane acceptance (independent flows)

flowId route risk / subtype confirmation preconditions result failure recovery secret policy evidence
instance-create /instances/new R1 / configuration diff-confirm canonical origin and unique stable ID created instance revision and audit retain draft on validation or reconcile failure secret reference only; never return a value WF-01 + product policy
instance-update /settings/instances/:id R1 / configuration revision-diff current revision updated revision and audit 409 refreshes diff without losing edits preserve/set/clear explicit; never return a value WF-01 + product policy
instance-delete /settings/instances/:id R3 / destructive strong target restatement fresh revision and no conflicting job new jobId with two-phase deleting to tombstone result before boundary restore; after boundary manual recovery destroy reference without reading secret value WF-13
secret-set /settings/instances/:id R1 / secret-reference explicit set authorized SecretStore write new reference metadata and audit atomic rollback on reference write failure never return or log secret value WF-01
secret-preserve /settings/instances/:id R1 / secret-reference explicit preserve existing reference metadata unchanged reference metadata and audit revision conflict refreshes metadata only never read or return secret value WF-01
secret-clear /settings/instances/:id R1 / secret-reference explicit clear fresh revision reference removed and audit atomic rollback or explicit recovery state never return destroyed secret value WF-01
config-import-preview /settings/instances R0 / preview none validated upload and canonical origins redacted diff/conflict/count preview fix file and regenerate preview never include secret values in preview IA settings import
config-import-confirm /settings/instances R2 / bulk-configuration explicit preview token fresh unexpired preview new jobId with per-instance items retry failed items in new lineage references only; never import/export secret values IA settings import
credential-verify /instances/new R1 / session-sensitive actor initiated rate limit and registered target credential metadata-only result no automatic replay; actor may retry after backoff ephemeral input, never response/audit value WF-01
saved-secret-login /instances/new R1 / session-sensitive actor initiated saved reference and rate limit session metadata-only result no automatic replay; return to login flow resolve server-side; never expose value WF-12
temporary-secret-login /instances/new R1 / session-sensitive actor initiated one-shot input and rate limit session metadata-only result no automatic replay; require new actor input memory-only and never saved or returned WF-12
logout /settings/instances/:id R1 / session-sensitive actor initiated active session session cleared and metadata audit no replay; reconcile auth status no credential value involved WF-12
401-recovery /instances/:id/overview R1 / session-recovery actor chooses login 401 evidence and retained stale data return to owner; retry R0 only never replay writes; preserve draft for new prepare temporary/saved secret follows selected login policy WF-12
auth-setup /instances/new R3 / authentication-change strong confirmation fresh dedicated auth preflight new jobId and metadata-only audit new lineage after state verification password never returned or audited Registry postAuthSetup
auth-password-change /settings/instances/:id R3 / authentication-change strong confirmation fresh dedicated auth preflight new jobId and metadata-only audit new lineage after auth-status verification old/new password never returned or audited Registry postAuthPassword
auth-settings-read /settings/instances/:id R0 / authentication-read none registered instance and actor structured auth settings safe actor retry no password/cookie/token fields Registry getAuthSettings
auth-settings-write /settings/instances/:id R2 / authentication-change explicit confirmation fresh dedicated auth preflight new jobId and metadata-only audit new lineage; no replay never return credential values Registry postAuthSettings
job-cancel /jobs/:jobId R1 / job-control explicit confirmation cancelable current phase immutable cancellation event show non-cancelable boundary and reconcile no secret data in event IA jobs
job-retry /jobs/:jobId R2 / job-control explicit failed-item selection source terminal state and fresh preflight new jobId with retryOf/root/source lineage never mutate source or replay successful items redacted parameter summary only WF-10
audit-export /audit R0 / data-export explicit scope authorized filters redacted export artifact regenerate from immutable audit redaction applies; no sensitiveFields WF-11
system-settings-update /settings/system R1 / configuration revision-diff safe bounds and current revision updated revision and audit 409 refreshes diff; invalid bounds rejected no secrets accepted IA settings system

Upstream operation acceptance (exact 117)

operationId method/path domain route/surface UI availability/version evidence scenario applicability risk/confirmation/execution policy IDs and resolved policies real class fixture disposition (metadata-only: runtime status / n / categories / reason) evidence
getDevice GET /api/device device-system /instances/:id/overview
overview/device		 detail planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.)		 R0; none
direct		 query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link.		 REAL_READ captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures registry:getDevice
upstream:backend/src/main.rs:506-506
upstream:backend/src/handlers.rs:1076-1090
upstream:bruno-api/get_device_info.bru:8
fixture:captured-readonly
getSim GET /api/sim sim /instances/:id/overview
overview/sim		 detail planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.)		 R0; none
direct		 query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link.		 REAL_READ captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures registry:getSim
upstream:backend/src/main.rs:508-508
upstream:backend/src/handlers.rs:1126-1145
upstream:bruno-api/get_sim_info.bru:8
fixture:captured-readonly
postSimDetailsRefresh POST /api/sim/details/refresh sim /instances/:id/overview
overview/sim		 action planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R1; none
direct		 command-current-state/write-revision/version-probe/verify-write/route-result
Refresh current state when available and bind the actor decision to its revision.
Refresh current state or require an explicit recorded revision-bound override.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Writes require outcome verification before actor-initiated retry.
Structured result returns to the owning route with a redacted audit link.		 REAL_WRITE_LATER not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postSimDetailsRefresh
upstream:backend/src/main.rs:510-511
upstream:backend/src/handlers.rs:1148-1164
fixture:not-eligible-readonly-capture
postSimCache POST /api/sim/cache sim /instances/:id/overview
overview/sim		 form planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R1; none
direct		 command-current-state/write-revision/version-probe/verify-write/route-result
Refresh current state when available and bind the actor decision to its revision.
Refresh current state or require an explicit recorded revision-bound override.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Writes require outcome verification before actor-initiated retry.
Structured result returns to the owning route with a redacted audit link.		 REAL_WRITE_LATER not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postSimCache
upstream:backend/src/main.rs:514-515
upstream:backend/src/handlers.rs:1167-1213
fixture:not-eligible-readonly-capture
getNetwork GET /api/network cellular /instances/:id/cellular
cellular/serving-network		 detail planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.)		 R0; none
direct		 query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link.		 REAL_READ captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures registry:getNetwork
upstream:backend/src/main.rs:519-520
upstream:backend/src/handlers.rs:1218-1232
upstream:bruno-api/get_network_info.bru:8
fixture:captured-readonly
getCells GET /api/cells cellular /instances/:id/cellular
cellular/cells		 table planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:Y (Successful collection may contain no rows.)
partial:Y (Independent response sections may succeed or fail.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.)		 R0; none
direct		 query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link.		 REAL_READ captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures registry:getCells
upstream:backend/src/main.rs:522-522
upstream:backend/src/handlers.rs:1235-1249
upstream:bruno-api/get_cells_info.bru:8
fixture:captured-readonly
postCellMonitorStart POST /api/cell-monitor/start cellular /instances/:id/cellular
cellular/cells		 action planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R1; none
direct		 command-current-state/write-revision/version-probe/verify-write/route-result
Refresh current state when available and bind the actor decision to its revision.
Refresh current state or require an explicit recorded revision-bound override.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Writes require outcome verification before actor-initiated retry.
Structured result returns to the owning route with a redacted audit link.		 REAL_WRITE_LATER not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postCellMonitorStart
upstream:backend/src/main.rs:524-525
upstream:backend/src/handlers.rs:1252-1282
fixture:not-eligible-readonly-capture
postCellMonitorStop POST /api/cell-monitor/stop cellular /instances/:id/cellular
cellular/cells		 action planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R1; none
direct		 command-current-state/write-revision/version-probe/verify-write/route-result
Refresh current state when available and bind the actor decision to its revision.
Refresh current state or require an explicit recorded revision-bound override.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Writes require outcome verification before actor-initiated retry.
Structured result returns to the owning route with a redacted audit link.		 REAL_WRITE_LATER not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postCellMonitorStop
upstream:backend/src/main.rs:528-529
upstream:backend/src/handlers.rs:1285-1312
fixture:not-eligible-readonly-capture
getRadioMode GET /api/radio-mode radio-lock /instances/:id/cellular
cellular/radio-locks		 read-panel planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.)		 R0; none
direct		 query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link.		 REAL_READ captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures registry:getRadioMode
upstream:backend/src/main.rs:532-533
upstream:backend/src/handlers.rs:1315-1329
upstream:bruno-api/get_radio_mode.bru:8
fixture:captured-readonly
postRadioMode POST /api/radio-mode radio-lock /instances/:id/cellular
cellular/radio-locks		 form planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R1; none
direct		 command-current-state/write-revision/version-probe/verify-write/route-result
Refresh current state when available and bind the actor decision to its revision.
Refresh current state or require an explicit recorded revision-bound override.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Writes require outcome verification before actor-initiated retry.
Structured result returns to the owning route with a redacted audit link.		 REAL_WRITE_LATER not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postRadioMode
upstream:backend/src/main.rs:532-534
upstream:backend/src/handlers.rs:1332-1352
upstream:bruno-api/set_radio_mode_nr.bru:8
upstream:bruno-api/set_radio_mode_lte.bru:8
upstream:bruno-api/set_radio_mode_auto.bru:8
fixture:not-eligible-readonly-capture
getBandLock GET /api/band-lock radio-lock /instances/:id/cellular
cellular/radio-locks		 read-panel planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.)		 R0; none
direct		 query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link.		 REAL_READ captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures registry:getBandLock
upstream:backend/src/main.rs:538-539
upstream:backend/src/handlers.rs:1355-1369
upstream:bruno-api/get_band_lock.bru:8
fixture:captured-readonly
postBandLock POST /api/band-lock radio-lock /instances/:id/cellular
cellular/radio-locks		 job-action planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R2; explicit
preparation-job		 job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit.		 SIMULATED_HIGH_RISK not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postBandLock
upstream:backend/src/main.rs:538-540
upstream:backend/src/handlers.rs:1372-1392
upstream:bruno-api/set_band_lock_nr_n78.bru:8
upstream:bruno-api/set_band_lock_lte_b1_b3.bru:8
upstream:bruno-api/unlock_all_bands.bru:8
upstream:bruno-api/set_band_lock_lte_nr_mix.bru:8
fixture:not-eligible-readonly-capture
getNetworkInterfaces GET /api/network/interfaces device-network /instances/:id/device-network
device-network/interfaces		 table planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:Y (Successful collection may contain no rows.)
partial:Y (Independent response sections may succeed or fail.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.)		 R0; none
direct		 query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link.		 REAL_READ captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures registry:getNetworkInterfaces
upstream:backend/src/main.rs:544-545
upstream:backend/src/handlers.rs:1619-1644
upstream:bruno-api/get_network_interfaces.bru:8
fixture:captured-readonly
getNetworkConnectionAddresses GET /api/network/connection-addresses device-network /instances/:id/device-network
device-network/interfaces		 read-panel planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.)		 R0; none
direct		 query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link.		 REAL_READ captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures registry:getNetworkConnectionAddresses
upstream:backend/src/main.rs:548-549
upstream:backend/src/handlers.rs:1647-1666
fixture:captured-readonly
getDeviceNetworkDdnsConfig GET /api/device-network/ddns/config device-network /instances/:id/device-network
device-network/ddns		 read-panel planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.)		 R0; none
direct		 query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link.		 REAL_READ captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures registry:getDeviceNetworkDdnsConfig
upstream:backend/src/main.rs:552-553
upstream:backend/src/handlers.rs:1669-1679
upstream:bruno-api/get_device_ddns_config.bru:8
fixture:captured-readonly
postDeviceNetworkDdnsConfig POST /api/device-network/ddns/config device-network /instances/:id/device-network
device-network/ddns		 job-action planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R2; explicit
preparation-job		 job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit.		 SIMULATED_HIGH_RISK not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postDeviceNetworkDdnsConfig
upstream:backend/src/main.rs:552-554
upstream:backend/src/handlers.rs:1682-1721
upstream:bruno-api/set_device_ddns_config.bru:8
fixture:not-eligible-readonly-capture
getDeviceNetworkDdnsStatus GET /api/device-network/ddns/status device-network /instances/:id/device-network
device-network/ddns		 read-panel planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.)		 R0; none
direct		 query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link.		 REAL_READ captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures registry:getDeviceNetworkDdnsStatus
upstream:backend/src/main.rs:558-559
upstream:backend/src/handlers.rs:1750-1757
upstream:bruno-api/get_device_ddns_status.bru:8
fixture:captured-readonly
postDeviceNetworkDdnsSync POST /api/device-network/ddns/sync device-network /instances/:id/device-network
device-network/ddns		 action planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R1; none
direct		 command-current-state/write-revision/version-probe/verify-write/route-result
Refresh current state when available and bind the actor decision to its revision.
Refresh current state or require an explicit recorded revision-bound override.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Writes require outcome verification before actor-initiated retry.
Structured result returns to the owning route with a redacted audit link.		 REAL_WRITE_LATER not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postDeviceNetworkDdnsSync
upstream:backend/src/main.rs:562-563
upstream:backend/src/handlers.rs:1760-1781
upstream:bruno-api/post_device_ddns_sync.bru:8
fixture:not-eligible-readonly-capture
getDeviceNetworkDdnsLogs GET /api/device-network/ddns/logs device-network /instances/:id/device-network
device-network/ddns		 read-panel planned: Frozen-scope read is modeled but real capture was explicitly denied; runtime support is probed per instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:Y (Successful collection may contain no rows.)
partial:Y (Independent response sections may succeed or fail.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.)		 R0; none
direct		 query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link.		 REAL_READ_DEFERRED denied-readonly-candidate; n=0; categories=none; no safe limit contract registry:getDeviceNetworkDdnsLogs
upstream:backend/src/main.rs:566-567
upstream:backend/src/handlers.rs:1784-1790
upstream:bruno-api/get_device_ddns_logs.bru:8
fixture:denied-readonly-candidate
postDeviceNetworkDdnsLogsClear POST /api/device-network/ddns/logs/clear device-network /instances/:id/device-network
device-network/ddns		 job-action planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R2; explicit
preparation-job		 job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit.		 SIMULATED_HIGH_RISK not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postDeviceNetworkDdnsLogsClear
upstream:backend/src/main.rs:570-571
upstream:backend/src/handlers.rs:1793-1802
upstream:bruno-api/post_device_ddns_logs_clear.bru:8
fixture:not-eligible-readonly-capture
getDeviceNetworkWlanStatus GET /api/device-network/wlan/status device-network /instances/:id/device-network
device-network/wlan		 read-panel planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.)		 R0; none
direct		 query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link.		 REAL_READ captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures registry:getDeviceNetworkWlanStatus
upstream:backend/src/main.rs:574-575
upstream:backend/src/handlers.rs:1805-1819
upstream:bruno-api/get_device_wlan_status.bru:8
fixture:captured-readonly
postDeviceNetworkWlanEnabled POST /api/device-network/wlan/enabled device-network /instances/:id/device-network
device-network/wlan		 form planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R1; none
direct		 command-current-state/write-revision/version-probe/verify-write/route-result
Refresh current state when available and bind the actor decision to its revision.
Refresh current state or require an explicit recorded revision-bound override.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Writes require outcome verification before actor-initiated retry.
Structured result returns to the owning route with a redacted audit link.		 REAL_WRITE_LATER not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postDeviceNetworkWlanEnabled
upstream:backend/src/main.rs:578-579
upstream:backend/src/handlers.rs:1822-1841
upstream:bruno-api/set_device_wlan_enabled.bru:8
fixture:not-eligible-readonly-capture
postDeviceNetworkWlanScan POST /api/device-network/wlan/scan device-network /instances/:id/device-network
device-network/wlan		 action planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R1; none
direct		 command-current-state/write-revision/version-probe/verify-write/route-result
Refresh current state when available and bind the actor decision to its revision.
Refresh current state or require an explicit recorded revision-bound override.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Writes require outcome verification before actor-initiated retry.
Structured result returns to the owning route with a redacted audit link.		 REAL_WRITE_LATER not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postDeviceNetworkWlanScan
upstream:backend/src/main.rs:582-583
upstream:backend/src/handlers.rs:1844-1858
upstream:bruno-api/post_device_wlan_scan.bru:8
fixture:not-eligible-readonly-capture
getDeviceNetworkWlanProfiles GET /api/device-network/wlan/profiles device-network /instances/:id/device-network
device-network/wlan		 table planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:Y (Successful collection may contain no rows.)
partial:Y (Independent response sections may succeed or fail.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.)		 R0; none
direct		 query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link.		 REAL_READ captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures registry:getDeviceNetworkWlanProfiles
upstream:backend/src/main.rs:586-587
upstream:backend/src/handlers.rs:1861-1875
upstream:bruno-api/get_device_wlan_profiles.bru:8
fixture:captured-readonly
postDeviceNetworkWlanForget POST /api/device-network/wlan/forget device-network /instances/:id/device-network
device-network/wlan		 job-action planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R2; explicit
preparation-job		 job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit.		 SIMULATED_HIGH_RISK not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postDeviceNetworkWlanForget
upstream:backend/src/main.rs:590-591
upstream:backend/src/handlers.rs:1878-1897
upstream:bruno-api/post_device_wlan_forget.bru:8
fixture:not-eligible-readonly-capture
postDeviceNetworkWlanConnect POST /api/device-network/wlan/connect device-network /instances/:id/device-network
device-network/wlan		 form planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R1; none
direct		 command-current-state/write-revision/version-probe/verify-write/route-result
Refresh current state when available and bind the actor decision to its revision.
Refresh current state or require an explicit recorded revision-bound override.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Writes require outcome verification before actor-initiated retry.
Structured result returns to the owning route with a redacted audit link.		 REAL_WRITE_LATER not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postDeviceNetworkWlanConnect
upstream:backend/src/main.rs:594-595
upstream:backend/src/handlers.rs:1900-1955
upstream:bruno-api/post_device_wlan_connect.bru:8
fixture:not-eligible-readonly-capture
postDeviceNetworkWlanDisconnect POST /api/device-network/wlan/disconnect device-network /instances/:id/device-network
device-network/wlan		 action planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R1; none
direct		 command-current-state/write-revision/version-probe/verify-write/route-result
Refresh current state when available and bind the actor decision to its revision.
Refresh current state or require an explicit recorded revision-bound override.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Writes require outcome verification before actor-initiated retry.
Structured result returns to the owning route with a redacted audit link.		 REAL_WRITE_LATER not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postDeviceNetworkWlanDisconnect
upstream:backend/src/main.rs:598-599
upstream:backend/src/handlers.rs:1958-1991
upstream:bruno-api/post_device_wlan_disconnect.bru:8
fixture:not-eligible-readonly-capture
postDeviceNetworkWlanProfile POST /api/device-network/wlan/profile device-network /instances/:id/device-network
device-network/wlan		 form planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R1; none
direct		 command-current-state/write-revision/version-probe/verify-write/route-result
Refresh current state when available and bind the actor decision to its revision.
Refresh current state or require an explicit recorded revision-bound override.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Writes require outcome verification before actor-initiated retry.
Structured result returns to the owning route with a redacted audit link.		 REAL_WRITE_LATER not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postDeviceNetworkWlanProfile
upstream:backend/src/main.rs:602-603
upstream:backend/src/handlers.rs:1994-2013
upstream:bruno-api/post_device_wlan_profile.bru:8
fixture:not-eligible-readonly-capture
getNetworkSignalStrength GET /api/network/signal-strength cellular /instances/:id/cellular
cellular/signal		 read-panel planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.)		 R0; none
direct		 query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link.		 REAL_READ captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures registry:getNetworkSignalStrength
upstream:backend/src/main.rs:606-607
upstream:backend/src/handlers.rs:2016-2030
upstream:bruno-api/get_signal_strength.bru:8
fixture:captured-readonly
getLocationCellInfo GET /api/location/cell-info cellular /instances/:id/cellular
cellular/cells		 read-panel planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.)		 R0; none
direct		 query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link.		 REAL_READ captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures registry:getLocationCellInfo
upstream:backend/src/main.rs:610-611
upstream:backend/src/handlers.rs:1395-1409
upstream:bruno-api/get_cell_location_info.bru:8
fixture:captured-readonly
getNetworkOperators GET /api/network/operators cellular /instances/:id/cellular
cellular/operator-registration		 table planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:Y (Successful collection may contain no rows.)
partial:Y (Independent response sections may succeed or fail.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.)		 R0; none
direct		 query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link.		 REAL_READ captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures registry:getNetworkOperators
upstream:backend/src/main.rs:614-615
upstream:backend/src/handlers.rs:1412-1426
upstream:bruno-api/get_operators.bru:8
fixture:captured-readonly
getNetworkOperatorsScan GET /api/network/operators/scan cellular /instances/:id/cellular
cellular/operator-registration		 read-panel planned: Frozen-scope read is modeled but real capture was explicitly denied; runtime support is probed per instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:Y (A successful active operator scan may return no operators.)
partial:Y (The scan response may contain usable operators alongside per-result failures or incomplete entries.)
policy-forbidden:Y (Active scan may be blocked by capability, authorization, preflight, or active-scan policy.)
unknown-result:N (A timed-out scan result may be discarded; it is not an unknown persistent write outcome.)
owner-switch:Y (Owner switch discards scan responses with a mismatched instance key.)		 R0; none
direct		 command-current-state/write-revision/version-probe/verify-write/route-result
Refresh current state when available and bind the actor decision to its revision.
Refresh current state or require an explicit recorded revision-bound override.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Writes require outcome verification before actor-initiated retry.
Structured result returns to the owning route with a redacted audit link.		 REAL_READ_DEFERRED denied-readonly-candidate; n=0; categories=none; active radio/network scan registry:getNetworkOperatorsScan
upstream:backend/src/main.rs:618-619
upstream:backend/src/handlers.rs:1429-1443
upstream:bruno-api/scan_operators.bru:8
fixture:denied-readonly-candidate
postNetworkRegisterManual POST /api/network/register-manual cellular /instances/:id/cellular
cellular/operator-registration		 job-action planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R2; explicit
preparation-job		 job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit.		 SIMULATED_HIGH_RISK not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postNetworkRegisterManual
upstream:backend/src/main.rs:622-623
upstream:backend/src/handlers.rs:1446-1466
upstream:bruno-api/register_operator_manual.bru:8
fixture:not-eligible-readonly-capture
postNetworkRegisterAuto POST /api/network/register-auto cellular /instances/:id/cellular
cellular/operator-registration		 job-action planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R2; explicit
preparation-job		 job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit.		 SIMULATED_HIGH_RISK not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postNetworkRegisterAuto
upstream:backend/src/main.rs:626-627
upstream:backend/src/handlers.rs:1469-1486
upstream:bruno-api/register_operator_auto.bru:8
fixture:not-eligible-readonly-capture
getApn GET /api/apn data-connection /instances/:id/cellular
cellular/data-apn		 read-panel planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.)		 R0; none
direct		 query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link.		 REAL_READ captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures registry:getApn
upstream:backend/src/main.rs:630-631
upstream:backend/src/handlers.rs:1489-1504
upstream:bruno-api/get_apn_list.bru:8
fixture:captured-readonly
postApn POST /api/apn data-connection /instances/:id/cellular
cellular/data-apn		 form planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R1; none
direct		 command-current-state/write-revision/version-probe/verify-write/route-result
Refresh current state when available and bind the actor decision to its revision.
Refresh current state or require an explicit recorded revision-bound override.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Writes require outcome verification before actor-initiated retry.
Structured result returns to the owning route with a redacted audit link.		 REAL_WRITE_LATER not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postApn
upstream:backend/src/main.rs:630-632
upstream:backend/src/handlers.rs:1507-1571
upstream:bruno-api/set_apn.bru:8
fixture:not-eligible-readonly-capture
getCellLock GET /api/cell-lock radio-lock /instances/:id/cellular
cellular/radio-locks		 read-panel planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.)		 R0; none
direct		 query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link.		 REAL_READ captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures registry:getCellLock
upstream:backend/src/main.rs:636-637
upstream:backend/src/handlers.rs:1574-1582
upstream:bruno-api/get_cell_lock.bru:8
fixture:captured-readonly
postCellLock POST /api/cell-lock radio-lock /instances/:id/cellular
cellular/radio-locks		 job-action planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R2; explicit
preparation-job		 job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit.		 SIMULATED_HIGH_RISK not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postCellLock
upstream:backend/src/main.rs:636-638
upstream:backend/src/handlers.rs:1585-1603
upstream:bruno-api/set_cell_lock_lte.bru:8
upstream:bruno-api/set_cell_lock_nr.bru:8
upstream:bruno-api/unlock_cell_nr.bru:8
fixture:not-eligible-readonly-capture
postCellLockUnlockAll POST /api/cell-lock/unlock-all radio-lock /instances/:id/cellular
cellular/radio-locks		 job-action planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R2; explicit
preparation-job		 job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit.		 SIMULATED_HIGH_RISK not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postCellLockUnlockAll
upstream:backend/src/main.rs:642-643
upstream:backend/src/handlers.rs:1606-1616
upstream:bruno-api/unlock_all_cells.bru:8
fixture:not-eligible-readonly-capture
getData GET /api/data data-connection /instances/:id/cellular
cellular/data-apn		 read-panel planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.)		 R0; none
direct		 query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link.		 REAL_READ captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures registry:getData
upstream:backend/src/main.rs:647-648
upstream:backend/src/handlers.rs:2035-2062
upstream:bruno-api/get_data_status.bru:8
fixture:captured-readonly
postData POST /api/data data-connection /instances/:id/cellular
cellular/data-apn		 form planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R1; none
direct		 command-current-state/write-revision/version-probe/verify-write/route-result
Refresh current state when available and bind the actor decision to its revision.
Refresh current state or require an explicit recorded revision-bound override.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Writes require outcome verification before actor-initiated retry.
Structured result returns to the owning route with a redacted audit link.		 REAL_WRITE_LATER not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postData
upstream:backend/src/main.rs:647-649
upstream:backend/src/handlers.rs:2065-2131
upstream:bruno-api/set_data_status_disable.bru:8
upstream:bruno-api/set_data_status_enable.bru:8
fixture:not-eligible-readonly-capture
getRoaming GET /api/roaming data-connection /instances/:id/cellular
cellular/data-apn		 read-panel planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.)		 R0; none
direct		 query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link.		 REAL_READ captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures registry:getRoaming
upstream:backend/src/main.rs:653-654
upstream:backend/src/handlers.rs:2172-2193
upstream:bruno-api/get_roaming_status.bru:8
fixture:captured-readonly
postRoaming POST /api/roaming data-connection /instances/:id/cellular
cellular/data-apn		 form planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R1; none
direct		 command-current-state/write-revision/version-probe/verify-write/route-result
Refresh current state when available and bind the actor decision to its revision.
Refresh current state or require an explicit recorded revision-bound override.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Writes require outcome verification before actor-initiated retry.
Structured result returns to the owning route with a redacted audit link.		 REAL_WRITE_LATER not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postRoaming
upstream:backend/src/main.rs:653-655
upstream:backend/src/handlers.rs:2196-2247
upstream:bruno-api/set_roaming_enable.bru:8
upstream:bruno-api/set_roaming_disable.bru:8
fixture:not-eligible-readonly-capture
getAirplaneMode GET /api/airplane-mode data-connection /instances/:id/cellular
cellular/data-apn		 read-panel planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.)		 R0; none
direct		 query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link.		 REAL_READ captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures registry:getAirplaneMode
upstream:backend/src/main.rs:659-660
upstream:backend/src/handlers.rs:2315-2329
upstream:bruno-api/get_airplane_mode.bru:8
fixture:captured-readonly
postAirplaneMode POST /api/airplane-mode data-connection /instances/:id/cellular
cellular/data-apn		 form planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R1; none
direct		 command-current-state/write-revision/version-probe/verify-write/route-result
Refresh current state when available and bind the actor decision to its revision.
Refresh current state or require an explicit recorded revision-bound override.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Writes require outcome verification before actor-initiated retry.
Structured result returns to the owning route with a redacted audit link.		 REAL_WRITE_LATER not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postAirplaneMode
upstream:backend/src/main.rs:659-661
upstream:backend/src/handlers.rs:2250-2312
upstream:bruno-api/set_airplane_mode_disable.bru:8
upstream:bruno-api/set_airplane_mode_enable.bru:8
fixture:not-eligible-readonly-capture
postBasebandRestart POST /api/baseband/restart data-connection /instances/:id/cellular
cellular/data-apn		 job-action planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R3; strong
preparation-job		 job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit.		 SIMULATED_HIGH_RISK not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postBasebandRestart
upstream:backend/src/main.rs:665-666
upstream:backend/src/handlers.rs:2133-2159
fixture:not-eligible-readonly-capture
getBasebandRestartStatus GET /api/baseband/restart/status data-connection /instances/:id/cellular
cellular/data-apn		 read-panel planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.)		 R0; none
direct		 query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link.		 REAL_READ captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures registry:getBasebandRestartStatus
upstream:backend/src/main.rs:669-670
upstream:backend/src/handlers.rs:2161-2169
fixture:captured-readonly
getWorkMode GET /api/work-mode workmode-esim /instances/:id/esim
esim/mode		 read-panel planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.)		 R0; none
direct		 query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link.		 REAL_READ captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures registry:getWorkMode
upstream:backend/src/main.rs:674-675
upstream:backend/src/handlers.rs:352-365
fixture:captured-readonly
postWorkMode POST /api/work-mode workmode-esim /instances/:id/esim
esim/mode		 job-action planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R2; explicit
preparation-job		 job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit.		 SIMULATED_HIGH_RISK not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postWorkMode
upstream:backend/src/main.rs:674-676
upstream:backend/src/handlers.rs:368-405
fixture:not-eligible-readonly-capture
getEsimConfig GET /api/esim/config workmode-esim /instances/:id/esim
esim/config		 read-panel planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.)		 R0; none
direct		 query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link.		 REAL_READ captured-readonly; n=2; categories=unsupported; collector-selected fully-bound GET R0; two redacted real captures registry:getEsimConfig
upstream:backend/src/main.rs:680-681
upstream:backend/src/handlers.rs:456-462
fixture:captured-readonly
postEsimConfig POST /api/esim/config workmode-esim /instances/:id/esim
esim/config		 job-action planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R2; explicit
preparation-job		 job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit.		 SIMULATED_HIGH_RISK not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postEsimConfig
upstream:backend/src/main.rs:680-682
upstream:backend/src/handlers.rs:465-482
fixture:not-eligible-readonly-capture
getEsimLpacStatus GET /api/esim/lpac/status workmode-esim /instances/:id/esim
esim/lpac		 read-panel planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.)		 R0; none
direct		 query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link.		 REAL_READ captured-readonly; n=2; categories=auth-required; collector-selected fully-bound GET R0; two redacted real captures registry:getEsimLpacStatus
upstream:backend/src/main.rs:686-687
upstream:backend/src/handlers.rs:408-416
fixture:captured-readonly
postEsimLpacRepair POST /api/esim/lpac/repair workmode-esim /instances/:id/esim
esim/lpac		 job-action planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R2; explicit
preparation-job		 job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit.		 SIMULATED_HIGH_RISK not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postEsimLpacRepair
upstream:backend/src/main.rs:690-691
upstream:backend/src/handlers.rs:419-453
fixture:not-eligible-readonly-capture
getEsimEuicc GET /api/esim/euicc workmode-esim /instances/:id/esim
esim/euicc		 read-panel planned: Frozen-scope read is modeled but real capture was explicitly denied; runtime support is probed per instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.)		 R0; none
direct		 query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link.		 REAL_READ_DEFERRED denied-readonly-candidate; n=0; categories=none; query-bearing endpoint omitted registry:getEsimEuicc
upstream:backend/src/main.rs:694-695
upstream:backend/src/handlers.rs:485-521
fixture:denied-readonly-candidate
getEsimProfiles GET /api/esim/profiles workmode-esim /instances/:id/esim
esim/profiles		 table planned: Frozen-scope read is modeled but real capture was explicitly denied; runtime support is probed per instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:Y (Successful collection may contain no rows.)
partial:Y (Independent response sections may succeed or fail.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.)		 R0; none
direct		 query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link.		 REAL_READ_DEFERRED denied-readonly-candidate; n=0; categories=none; query-bearing endpoint omitted registry:getEsimProfiles
upstream:backend/src/main.rs:698-699
upstream:backend/src/handlers.rs:524-598
fixture:denied-readonly-candidate
postEsimProfiles POST /api/esim/profiles workmode-esim /instances/:id/esim
esim/profiles		 form planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R1; none
direct		 command-current-state/write-revision/version-probe/verify-write/route-result
Refresh current state when available and bind the actor decision to its revision.
Refresh current state or require an explicit recorded revision-bound override.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Writes require outcome verification before actor-initiated retry.
Structured result returns to the owning route with a redacted audit link.		 REAL_WRITE_LATER not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postEsimProfiles
upstream:backend/src/main.rs:698-700
upstream:backend/src/handlers.rs:803-1071
fixture:not-eligible-readonly-capture
postEsimProfilesIccidEnable POST /api/esim/profiles/{iccid}/enable workmode-esim /instances/:id/esim
esim/profiles		 action planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R1; none
direct		 command-current-state/write-revision/version-probe/verify-write/route-result
Refresh current state when available and bind the actor decision to its revision.
Refresh current state or require an explicit recorded revision-bound override.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Writes require outcome verification before actor-initiated retry.
Structured result returns to the owning route with a redacted audit link.		 REAL_WRITE_LATER not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postEsimProfilesIccidEnable
upstream:backend/src/main.rs:704-705
upstream:backend/src/handlers.rs:601-726
fixture:not-eligible-readonly-capture
postEsimProfilesIccidRename POST /api/esim/profiles/{iccid}/rename workmode-esim /instances/:id/esim
esim/profiles		 form planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R1; none
direct		 command-current-state/write-revision/version-probe/verify-write/route-result
Refresh current state when available and bind the actor decision to its revision.
Refresh current state or require an explicit recorded revision-bound override.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Writes require outcome verification before actor-initiated retry.
Structured result returns to the owning route with a redacted audit link.		 REAL_WRITE_LATER not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postEsimProfilesIccidRename
upstream:backend/src/main.rs:708-709
upstream:backend/src/handlers.rs:729-750
fixture:not-eligible-readonly-capture
deleteEsimProfilesIccid DELETE /api/esim/profiles/{iccid} workmode-esim /instances/:id/esim
esim/profiles		 job-action planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R3; strong
preparation-job		 job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit.		 SIMULATED_HIGH_RISK not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:deleteEsimProfilesIccid
upstream:backend/src/main.rs:712-713
upstream:backend/src/handlers.rs:753-780
fixture:not-eligible-readonly-capture
getCalls GET /api/calls calls /instances/:id/calls
calls/live		 table planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:Y (Successful collection may contain no rows.)
partial:Y (Independent response sections may succeed or fail.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.)		 R0; none
direct		 query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link.		 REAL_READ captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures registry:getCalls
upstream:backend/src/main.rs:717-718
upstream:backend/src/handlers.rs:2634-2655
upstream:bruno-api/get_calls.bru:8
fixture:captured-readonly
postCallDial POST /api/call/dial calls /instances/:id/calls
calls/live		 form planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R1; none
direct		 command-current-state/write-revision/version-probe/verify-write/route-result
Refresh current state when available and bind the actor decision to its revision.
Refresh current state or require an explicit recorded revision-bound override.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Writes require outcome verification before actor-initiated retry.
Structured result returns to the owning route with a redacted audit link.		 REAL_WRITE_LATER not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postCallDial
upstream:backend/src/main.rs:721-722
upstream:backend/src/handlers.rs:2657-2689
upstream:bruno-api/post_call_dial.bru:8
fixture:not-eligible-readonly-capture
postCallHangup POST /api/call/hangup calls /instances/:id/calls
calls/live		 form planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R1; none
direct		 command-current-state/write-revision/version-probe/verify-write/route-result
Refresh current state when available and bind the actor decision to its revision.
Refresh current state or require an explicit recorded revision-bound override.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Writes require outcome verification before actor-initiated retry.
Structured result returns to the owning route with a redacted audit link.		 REAL_WRITE_LATER not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postCallHangup
upstream:backend/src/main.rs:725-726
upstream:backend/src/handlers.rs:2691-2725
upstream:bruno-api/post_call_hangup.bru:8
fixture:not-eligible-readonly-capture
postCallHangupAll POST /api/call/hangup-all calls /instances/:id/calls
calls/live		 action planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R1; none
direct		 command-current-state/write-revision/version-probe/verify-write/route-result
Refresh current state when available and bind the actor decision to its revision.
Refresh current state or require an explicit recorded revision-bound override.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Writes require outcome verification before actor-initiated retry.
Structured result returns to the owning route with a redacted audit link.		 REAL_WRITE_LATER not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postCallHangupAll
upstream:backend/src/main.rs:729-730
upstream:backend/src/handlers.rs:2727-2760
upstream:bruno-api/post_call_hangup_all.bru:8
fixture:not-eligible-readonly-capture
postCallAnswer POST /api/call/answer calls /instances/:id/calls
calls/live		 form planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R1; none
direct		 command-current-state/write-revision/version-probe/verify-write/route-result
Refresh current state when available and bind the actor decision to its revision.
Refresh current state or require an explicit recorded revision-bound override.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Writes require outcome verification before actor-initiated retry.
Structured result returns to the owning route with a redacted audit link.		 REAL_WRITE_LATER not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postCallAnswer
upstream:backend/src/main.rs:733-734
upstream:backend/src/handlers.rs:2762-2789
upstream:bruno-api/post_call_answer.bru:8
fixture:not-eligible-readonly-capture
getCallVolume GET /api/call/volume calls /instances/:id/calls
calls/volume		 read-panel planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.)		 R0; none
direct		 query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link.		 REAL_READ captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures registry:getCallVolume
upstream:backend/src/main.rs:737-738
upstream:backend/src/handlers.rs:2899-2906
upstream:bruno-api/get_call_volume.bru:8
fixture:captured-readonly
postCallVolume POST /api/call/volume calls /instances/:id/calls
calls/volume		 form planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R1; none
direct		 command-current-state/write-revision/version-probe/verify-write/route-result
Refresh current state when available and bind the actor decision to its revision.
Refresh current state or require an explicit recorded revision-bound override.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Writes require outcome verification before actor-initiated retry.
Structured result returns to the owning route with a redacted audit link.		 REAL_WRITE_LATER not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postCallVolume
upstream:backend/src/main.rs:737-739
upstream:backend/src/handlers.rs:2908-2922
upstream:bruno-api/set_call_volume.bru:8
fixture:not-eligible-readonly-capture
getCallForwarding GET /api/call/forwarding calls /instances/:id/calls
calls/forwarding		 read-panel planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.)		 R0; none
direct		 query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link.		 REAL_READ captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures registry:getCallForwarding
upstream:backend/src/main.rs:743-744
upstream:backend/src/handlers.rs:2924-2931
upstream:bruno-api/get_call_forwarding.bru:8
fixture:captured-readonly
postCallForwarding POST /api/call/forwarding calls /instances/:id/calls
calls/forwarding		 form planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R1; none
direct		 command-current-state/write-revision/version-probe/verify-write/route-result
Refresh current state when available and bind the actor decision to its revision.
Refresh current state or require an explicit recorded revision-bound override.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Writes require outcome verification before actor-initiated retry.
Structured result returns to the owning route with a redacted audit link.		 REAL_WRITE_LATER not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postCallForwarding
upstream:backend/src/main.rs:743-745
upstream:backend/src/handlers.rs:2933-2943
upstream:bruno-api/set_call_forwarding.bru:8
fixture:not-eligible-readonly-capture
getCallSettings GET /api/call/settings calls /instances/:id/calls
calls/settings		 read-panel planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.)		 R0; none
direct		 query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link.		 REAL_READ captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures registry:getCallSettings
upstream:backend/src/main.rs:749-750
upstream:backend/src/handlers.rs:2852-2866
upstream:bruno-api/get_call_settings.bru:8
fixture:captured-readonly
postCallSettings POST /api/call/settings calls /instances/:id/calls
calls/settings		 job-action planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R2; explicit
preparation-job		 job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit.		 SIMULATED_HIGH_RISK not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postCallSettings
upstream:backend/src/main.rs:749-751
upstream:backend/src/handlers.rs:2868-2897
upstream:bruno-api/set_call_settings.bru:8
fixture:not-eligible-readonly-capture
getCallHistory GET /api/call/history calls /instances/:id/calls
calls/history		 table planned: Frozen-scope read is modeled but real capture was explicitly denied; runtime support is probed per instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:Y (Successful collection may contain no rows.)
partial:Y (Independent response sections may succeed or fail.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.)		 R0; none
direct		 query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link.		 REAL_READ_DEFERRED denied-readonly-candidate; n=0; categories=none; query limit is not encoded in Registry path contract registry:getCallHistory
upstream:backend/src/main.rs:755-756
upstream:backend/src/handlers.rs:2791-2813
fixture:denied-readonly-candidate
deleteCallHistoryId DELETE /api/call/history/{id} calls /instances/:id/calls
calls/history		 job-action planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R3; strong
preparation-job		 job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit.		 SIMULATED_HIGH_RISK not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:deleteCallHistoryId
upstream:backend/src/main.rs:759-760
upstream:backend/src/handlers.rs:2815-2832
upstream:bruno-api/delete_call_history.bru:8
fixture:not-eligible-readonly-capture
postCallHistoryClear POST /api/call/history/clear calls /instances/:id/calls
calls/history		 job-action planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R3; strong
preparation-job		 job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit.		 SIMULATED_HIGH_RISK not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postCallHistoryClear
upstream:backend/src/main.rs:763-764
upstream:backend/src/handlers.rs:2834-2850
upstream:bruno-api/clear_call_history.bru:8
fixture:not-eligible-readonly-capture
getImsStatus GET /api/ims/status calls /instances/:id/calls
calls/ims-voicemail		 read-panel planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.)		 R0; none
direct		 query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link.		 REAL_READ captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures registry:getImsStatus
upstream:backend/src/main.rs:767-768
upstream:backend/src/handlers.rs:2945-2952
upstream:bruno-api/get_ims_status.bru:8
fixture:captured-readonly
getVoicemailStatus GET /api/voicemail/status calls /instances/:id/calls
calls/ims-voicemail		 read-panel planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.)		 R0; none
direct		 query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link.		 REAL_READ captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures registry:getVoicemailStatus
upstream:backend/src/main.rs:771-772
upstream:backend/src/handlers.rs:2954-2961
upstream:bruno-api/get_voicemail_status.bru:8
fixture:captured-readonly
postSmsSend POST /api/sms/send messages /instances/:id/messages
messages/compose		 job-action planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R2; explicit
preparation-job		 job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit.		 SIMULATED_HIGH_RISK not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postSmsSend
upstream:backend/src/main.rs:776-777
upstream:backend/src/handlers.rs:2373-2404
upstream:bruno-api/post_sms_send.bru:8
fixture:not-eligible-readonly-capture
getSmsList GET /api/sms/list messages /instances/:id/messages
messages/list		 table planned: Frozen-scope read is modeled but real capture was explicitly denied; runtime support is probed per instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:Y (Successful collection may contain no rows.)
partial:Y (Independent response sections may succeed or fail.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.)		 R0; none
direct		 query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link.		 REAL_READ_DEFERRED denied-readonly-candidate; n=0; categories=none; message list can expose body; intentionally not collected registry:getSmsList
upstream:backend/src/main.rs:780-781
upstream:backend/src/handlers.rs:2407-2434
fixture:denied-readonly-candidate
getSmsConversation GET /api/sms/conversation messages /instances/:id/messages
messages/conversation		 table planned: Frozen-scope read is modeled but real capture was explicitly denied; runtime support is probed per instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:Y (Successful collection may contain no rows.)
partial:Y (Independent response sections may succeed or fail.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.)		 R0; none
direct		 query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link.		 REAL_READ_DEFERRED denied-readonly-candidate; n=0; categories=none; requires correspondent query and exposes message bodies registry:getSmsConversation
upstream:backend/src/main.rs:784-785
upstream:backend/src/handlers.rs:2437-2458
fixture:denied-readonly-candidate
getSmsStats GET /api/sms/stats messages /instances/:id/messages
messages/stats		 read-panel planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.)		 R0; none
direct		 query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link.		 REAL_READ captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures registry:getSmsStats
upstream:backend/src/main.rs:788-789
upstream:backend/src/handlers.rs:2461-2477
upstream:bruno-api/get_sms_stats.bru:8
fixture:captured-readonly
postSmsBatchDelete POST /api/sms/batch-delete messages /instances/:id/messages
messages/destructive		 job-action planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:Y (Job items may independently succeed, fail, or be skipped.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R3; strong
preparation-job		 job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit.		 SIMULATED_HIGH_RISK not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postSmsBatchDelete
upstream:backend/src/main.rs:792-793
upstream:backend/src/handlers.rs:2551-2578
fixture:not-eligible-readonly-capture
deleteSmsConversationPhoneNumber DELETE /api/sms/conversation/{phone_number} messages /instances/:id/messages
messages/destructive		 job-action planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R3; strong
preparation-job		 job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit.		 SIMULATED_HIGH_RISK not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:deleteSmsConversationPhoneNumber
upstream:backend/src/main.rs:796-797
upstream:backend/src/handlers.rs:2528-2548
fixture:not-eligible-readonly-capture
deleteSmsMessageId DELETE /api/sms/message/{id} messages /instances/:id/messages
messages/destructive		 job-action planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R3; strong
preparation-job		 job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit.		 SIMULATED_HIGH_RISK not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:deleteSmsMessageId
upstream:backend/src/main.rs:800-801
upstream:backend/src/handlers.rs:2508-2525
fixture:not-eligible-readonly-capture
postSmsClear POST /api/sms/clear messages /instances/:id/messages
messages/destructive		 job-action planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R3; strong
preparation-job		 job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit.		 SIMULATED_HIGH_RISK not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postSmsClear
upstream:backend/src/main.rs:804-805
upstream:backend/src/handlers.rs:2480-2505
upstream:bruno-api/post_sms_clear.bru:8
fixture:not-eligible-readonly-capture
getStats GET /api/stats device-system /instances/:id/overview
overview/stats		 read-panel planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Detail resource has no collection-empty rendering.)
partial:Y (Independent response sections may succeed or fail.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.)		 R0; none
direct		 command-current-state/read-retain/version-probe/safe-read/route-result
Refresh current state when available and bind the actor decision to its revision.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link.		 REAL_READ captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures registry:getStats
upstream:backend/src/main.rs:808-808
upstream:backend/src/handlers.rs:3272-3288
upstream:bruno-api/get_stats.bru:8
fixture:captured-readonly
getStatsCpu GET /api/stats/cpu device-system /instances/:id/overview
overview/stats		 read-panel planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Detail resource has no collection-empty rendering.)
partial:Y (Independent response sections may succeed or fail.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.)		 R0; none
direct		 command-current-state/read-retain/version-probe/safe-read/route-result
Refresh current state when available and bind the actor decision to its revision.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link.		 REAL_READ captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures registry:getStatsCpu
upstream:backend/src/main.rs:809-809
upstream:backend/src/handlers.rs:3291-3302
upstream:bruno-api/get_cpu_info.bru:8
fixture:captured-readonly
getConnectivity GET /api/connectivity device-system /instances/:id/overview
overview/auth-health		 read-panel planned: Frozen-scope read is modeled but real capture was explicitly denied; runtime support is probed per instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Detail resource has no collection-empty rendering.)
partial:Y (Independent response sections may succeed or fail.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.)		 R0; none
direct		 command-current-state/read-retain/version-probe/safe-read/route-result
Refresh current state when available and bind the actor decision to its revision.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link.		 REAL_READ_DEFERRED denied-readonly-candidate; n=0; categories=none; handler performs active connectivity ping registry:getConnectivity
upstream:backend/src/main.rs:811-812
upstream:backend/src/handlers.rs:3305-3322
fixture:denied-readonly-candidate
postSystemReboot POST /api/system/reboot device-system /instances/:id/overview
overview/system-actions		 job-action planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R3; strong
preparation-job		 job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit.		 SIMULATED_HIGH_RISK not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postSystemReboot
upstream:backend/src/main.rs:815-816
upstream:backend/src/handlers.rs:3381-3406
upstream:bruno-api/post_system_reboot.bru:8
fixture:not-eligible-readonly-capture
postServiceRestart POST /api/service/restart device-system /instances/:id/overview
overview/system-actions		 job-action planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R3; strong
preparation-job		 job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit.		 SIMULATED_HIGH_RISK not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postServiceRestart
upstream:backend/src/main.rs:819-820
upstream:backend/src/handlers.rs:3578-3601
fixture:not-eligible-readonly-capture
getNotificationsConfig GET /api/notifications/config notifications /instances/:id/notifications
notifications/config		 read-panel planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.)		 R0; none
direct		 query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link.		 REAL_READ captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures registry:getNotificationsConfig
upstream:backend/src/main.rs:824-825
upstream:backend/src/handlers.rs:3641-3652
upstream:bruno-api/get_notification_config.bru:8
fixture:captured-readonly
postNotificationsConfig POST /api/notifications/config notifications /instances/:id/notifications
notifications/config		 job-action planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R2; explicit
preparation-job		 job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit.		 SIMULATED_HIGH_RISK not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postNotificationsConfig
upstream:backend/src/main.rs:824-826
upstream:backend/src/handlers.rs:3655-3672
upstream:bruno-api/set_notification_config.bru:8
fixture:not-eligible-readonly-capture
postNotificationsTestChannel POST /api/notifications/test/{channel} notifications /instances/:id/notifications
notifications/config		 job-action planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R2; explicit
preparation-job		 job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit.		 SIMULATED_HIGH_RISK not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postNotificationsTestChannel
upstream:backend/src/main.rs:830-831
upstream:backend/src/handlers.rs:3675-3704
fixture:not-eligible-readonly-capture
getNotificationsLogs GET /api/notifications/logs notifications /instances/:id/notifications
notifications/logs		 table planned: Frozen-scope read is modeled but real capture was explicitly denied; runtime support is probed per instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:Y (Successful collection may contain no rows.)
partial:Y (Independent response sections may succeed or fail.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.)		 R0; none
direct		 query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link.		 REAL_READ_DEFERRED denied-readonly-candidate; n=0; categories=none; query limit is not encoded in Registry path contract registry:getNotificationsLogs
upstream:backend/src/main.rs:835-836
upstream:backend/src/handlers.rs:3709-3734
fixture:denied-readonly-candidate
postNotificationsLogsClear POST /api/notifications/logs/clear notifications /instances/:id/notifications
notifications/logs		 job-action planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R3; strong
preparation-job		 job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit.		 SIMULATED_HIGH_RISK not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postNotificationsLogsClear
upstream:backend/src/main.rs:839-840
upstream:backend/src/handlers.rs:3737-3760
fixture:not-eligible-readonly-capture
getNotificationsQueue GET /api/notifications/queue notifications /instances/:id/notifications
notifications/queue		 table planned: Frozen-scope read is modeled but real capture was explicitly denied; runtime support is probed per instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:Y (Successful collection may contain no rows.)
partial:Y (Independent response sections may succeed or fail.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.)		 R0; none
direct		 query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link.		 REAL_READ_DEFERRED denied-readonly-candidate; n=0; categories=none; query limit is not encoded in Registry path contract registry:getNotificationsQueue
upstream:backend/src/main.rs:843-844
upstream:backend/src/notification_queue.rs:24-41
fixture:denied-readonly-candidate
postNotificationsQueueRetryAll POST /api/notifications/queue/retry-all notifications /instances/:id/notifications
notifications/queue		 job-action planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:Y (Job items may independently succeed, fail, or be skipped.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R2; explicit
preparation-job		 job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit.		 SIMULATED_HIGH_RISK not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postNotificationsQueueRetryAll
upstream:backend/src/main.rs:847-848
upstream:backend/src/notification_queue.rs:84-100
fixture:not-eligible-readonly-capture
postNotificationsQueueClear POST /api/notifications/queue/clear notifications /instances/:id/notifications
notifications/queue		 job-action planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:Y (Job items may independently succeed, fail, or be skipped.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R3; strong
preparation-job		 job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit.		 SIMULATED_HIGH_RISK not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postNotificationsQueueClear
upstream:backend/src/main.rs:851-852
upstream:backend/src/notification_queue.rs:103-119
fixture:not-eligible-readonly-capture
deleteNotificationsQueueId DELETE /api/notifications/queue/{id} notifications /instances/:id/notifications
notifications/queue		 job-action planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R3; strong
preparation-job		 job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit.		 SIMULATED_HIGH_RISK not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:deleteNotificationsQueueId
upstream:backend/src/main.rs:855-856
upstream:backend/src/notification_queue.rs:64-81
fixture:not-eligible-readonly-capture
postNotificationsQueueIdRetry POST /api/notifications/queue/{id}/retry notifications /instances/:id/notifications
notifications/queue		 job-action planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R2; explicit
preparation-job		 job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit.		 SIMULATED_HIGH_RISK not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postNotificationsQueueIdRetry
upstream:backend/src/main.rs:859-860
upstream:backend/src/notification_queue.rs:44-61
fixture:not-eligible-readonly-capture
getAutomationConfig GET /api/automation/config automation /instances/:id/automation
automation/config		 read-panel planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.)		 R0; none
direct		 query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link.		 REAL_READ captured-readonly; n=2; categories=unsupported; collector-selected fully-bound GET R0; two redacted real captures registry:getAutomationConfig
upstream:backend/src/main.rs:864-865
upstream:backend/src/handlers.rs:3968-3979
fixture:captured-readonly
postAutomationConfig POST /api/automation/config automation /instances/:id/automation
automation/config		 job-action planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R2; explicit
preparation-job		 job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit.		 SIMULATED_HIGH_RISK not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postAutomationConfig
upstream:backend/src/main.rs:864-866
upstream:backend/src/handlers.rs:3982-3999
fixture:not-eligible-readonly-capture
getAutomationLogs GET /api/automation/logs automation /instances/:id/automation
automation/logs		 table planned: Frozen-scope read is modeled but real capture was explicitly denied; runtime support is probed per instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:Y (Successful collection may contain no rows.)
partial:Y (Independent response sections may succeed or fail.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.)		 R0; none
direct		 query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link.		 REAL_READ_DEFERRED denied-readonly-candidate; n=0; categories=none; query limit is not encoded in Registry path contract registry:getAutomationLogs
upstream:backend/src/main.rs:870-871
upstream:backend/src/handlers.rs:4002-4027
fixture:denied-readonly-candidate
postAutomationLogsClear POST /api/automation/logs/clear automation /instances/:id/automation
automation/logs		 job-action planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R3; strong
preparation-job		 job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit.		 SIMULATED_HIGH_RISK not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postAutomationLogsClear
upstream:backend/src/main.rs:874-875
upstream:backend/src/handlers.rs:4030-4053
fixture:not-eligible-readonly-capture
postAutomationTestTaskId POST /api/automation/test/{task_id} automation /instances/:id/automation
automation/task-test		 job-action planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R2; explicit
preparation-job		 job-fresh-preflight/high-risk-block/version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit.		 SIMULATED_HIGH_RISK not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postAutomationTestTaskId
upstream:backend/src/main.rs:878-879
upstream:backend/src/handlers.rs:4056-4146
fixture:not-eligible-readonly-capture
getOtaStatus GET /api/ota/status ota /instances/:id/ota
ota/status		 read-panel planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.)		 R0; none
direct		 query-capability/read-retain/version-probe/safe-read/route-result
Registered instance, authorized actor, and runtime capability decision are required.
Retain last success as stale and permit an explicit safe refresh.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Safe reads may retry within deadline and retain stale success.
Structured result returns to the owning route with a redacted audit link.		 REAL_READ captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures registry:getOtaStatus
upstream:backend/src/main.rs:882-883
upstream:backend/src/handlers.rs:3763-3769
upstream:bruno-api/get_ota_status.bru:8
fixture:captured-readonly
postOtaUpload POST /api/ota/upload ota /instances/:id/ota
ota/upload		 dedicated-upload-flow planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R3; strong
preparation-job		 job-fresh-preflight/high-risk-block/ota-version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
OTA 404/405/501 is frozen-version evidence; preserve release/status probe context and never infer global support.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit.		 SIMULATED_HIGH_RISK not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postOtaUpload
upstream:backend/src/main.rs:886-887
upstream:backend/src/handlers.rs:3772-3792
fixture:not-eligible-readonly-capture
postOtaLatestRelease POST /api/ota/latest-release ota /instances/:id/ota
ota/release		 form planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R1; none
direct		 command-current-state/write-revision/version-probe/verify-write/route-result
Refresh current state when available and bind the actor decision to its revision.
Refresh current state or require an explicit recorded revision-bound override.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Writes require outcome verification before actor-initiated retry.
Structured result returns to the owning route with a redacted audit link.		 REAL_WRITE_LATER not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postOtaLatestRelease
upstream:backend/src/main.rs:892-893
upstream:backend/src/handlers.rs:3795-3825
fixture:not-eligible-readonly-capture
postOtaOnlinePrepare POST /api/ota/online-prepare ota /instances/:id/ota
ota/release		 job-action planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R2; explicit
preparation-job		 job-fresh-preflight/high-risk-block/ota-version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
OTA 404/405/501 is frozen-version evidence; preserve release/status probe context and never infer global support.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit.		 SIMULATED_HIGH_RISK not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postOtaOnlinePrepare
upstream:backend/src/main.rs:896-897
upstream:backend/src/handlers.rs:3828-3889
fixture:not-eligible-readonly-capture
postOtaApply POST /api/ota/apply ota /instances/:id/ota
ota/apply		 job-action planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R3; strong
preparation-job		 job-fresh-preflight/high-risk-block/ota-version-probe/new-job-lineage/job-result
Required fresh preflight; inability to refresh blocks execution.
Fresh preflight is mandatory; stale, expired, or unknown state blocks execution.
OTA 404/405/501 is frozen-version evidence; preserve release/status probe context and never infer global support.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
/jobs/:jobId contains per-item result, attempt lineage, and redacted audit.		 SIMULATED_HIGH_RISK not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postOtaApply
upstream:backend/src/main.rs:900-901
upstream:backend/src/handlers.rs:3892-3911
upstream:bruno-api/post_ota_apply_restart.bru:8
upstream:bruno-api/post_ota_apply.bru:8
fixture:not-eligible-readonly-capture
postOtaCancel POST /api/ota/cancel ota /instances/:id/ota
ota/status		 action planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R1; none
direct		 command-current-state/write-revision/version-probe/verify-write/route-result
Refresh current state when available and bind the actor decision to its revision.
Refresh current state or require an explicit recorded revision-bound override.
404/405/501 is capability evidence for this frozen version, not permanent product unsupported; retain probe evidence.
Writes require outcome verification before actor-initiated retry.
Structured result returns to the owning route with a redacted audit link.		 REAL_WRITE_LATER not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postOtaCancel
upstream:backend/src/main.rs:904-905
upstream:backend/src/handlers.rs:3914-3931
upstream:bruno-api/post_ota_cancel.bru:8
fixture:not-eligible-readonly-capture
postAuthPassword POST /api/auth/password instances-auth /settings/instances/:id
settings/auth-settings		 dedicated-auth-flow planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R3; strong
dedicated-flow		 auth-dedicated/auth-no-replay/auth-version-probe/new-job-lineage/auth-result
Dedicated auth endpoint, actor/session/instance rate limits, and fresh preflight of authentication state are required.
Credential state is never inferred from stale data; require actor-initiated auth flow and no replay.
Auth 404/405/501 is version evidence; do not downgrade to a generic proxy or expose credentials.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
Dedicated auth jobs return through /jobs/:jobId; session flows return a credential metadata-only audit result and link.		 SIMULATED_HIGH_RISK not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postAuthPassword
upstream:backend/src/main.rs:908-909
upstream:backend/src/auth.rs:491-553
upstream:backend/src/auth.rs:43-43
fixture:not-eligible-readonly-capture
getAuthSettings GET /api/auth/settings instances-auth /settings/instances/:id
settings/auth-settings		 detail planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.)		 R0; none
direct		 query-capability/auth-no-replay/auth-version-probe/auth-actor-only/auth-result
Registered instance, authorized actor, and runtime capability decision are required.
Credential state is never inferred from stale data; require actor-initiated auth flow and no replay.
Auth 404/405/501 is version evidence; do not downgrade to a generic proxy or expose credentials.
No automatic replay; require an actor-initiated dedicated flow.
Dedicated auth jobs return through /jobs/:jobId; session flows return a credential metadata-only audit result and link.		 REAL_READ captured-readonly; n=2; categories=success,unsupported; collector-selected fully-bound GET R0; two redacted real captures registry:getAuthSettings
upstream:backend/src/main.rs:912-913
upstream:backend/src/auth.rs:555-570
upstream:backend/src/auth.rs:43-43
fixture:captured-readonly
postAuthSettings POST /api/auth/settings instances-auth /settings/instances/:id
settings/auth-settings		 dedicated-auth-flow planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R2; explicit
dedicated-flow		 auth-dedicated/auth-no-replay/auth-version-probe/new-job-lineage/auth-result
Dedicated auth endpoint, actor/session/instance rate limits, and fresh preflight of authentication state are required.
Credential state is never inferred from stale data; require actor-initiated auth flow and no replay.
Auth 404/405/501 is version evidence; do not downgrade to a generic proxy or expose credentials.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
Dedicated auth jobs return through /jobs/:jobId; session flows return a credential metadata-only audit result and link.		 SIMULATED_HIGH_RISK not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postAuthSettings
upstream:backend/src/main.rs:912-914
upstream:backend/src/auth.rs:572-640
upstream:backend/src/auth.rs:43-43
fixture:not-eligible-readonly-capture
getHealth GET /api/health instances-auth /instances/new
settings/auth-entry		 detail planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.)		 R0; none
direct		 query-capability/auth-no-replay/auth-version-probe/auth-actor-only/auth-result
Registered instance, authorized actor, and runtime capability decision are required.
Credential state is never inferred from stale data; require actor-initiated auth flow and no replay.
Auth 404/405/501 is version evidence; do not downgrade to a generic proxy or expose credentials.
No automatic replay; require an actor-initiated dedicated flow.
Dedicated auth jobs return through /jobs/:jobId; session flows return a credential metadata-only audit result and link.		 REAL_READ captured-readonly; n=2; categories=success; collector-selected fully-bound GET R0; two redacted real captures registry:getHealth
upstream:backend/src/main.rs:923-923
upstream:backend/src/handlers.rs:65-75
upstream:bruno-api/get_health.bru:8
upstream:backend/src/auth.rs:43-43
fixture:captured-readonly
getAuthStatus GET /api/auth/status instances-auth /instances/new
settings/auth-entry		 detail planned: Frozen-scope read has two redacted captured responses; runtime support is still decided per registered instance.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Detail resource has no collection-empty rendering.)
partial:N (Atomic detail read has no meaningful partial rendering.)
policy-forbidden:N (Safe read has no write-confirmation policy; support remains orthogonal.)
unknown-result:N (Read failure is an error/freshness state, not unknown write outcome.)
owner-switch:Y (Owner switch discards responses with a mismatched instance key.)		 R0; none
direct		 query-capability/auth-no-replay/auth-version-probe/auth-actor-only/auth-result
Registered instance, authorized actor, and runtime capability decision are required.
Credential state is never inferred from stale data; require actor-initiated auth flow and no replay.
Auth 404/405/501 is version evidence; do not downgrade to a generic proxy or expose credentials.
No automatic replay; require an actor-initiated dedicated flow.
Dedicated auth jobs return through /jobs/:jobId; session flows return a credential metadata-only audit result and link.		 REAL_READ captured-readonly; n=2; categories=success,unsupported; collector-selected fully-bound GET R0; two redacted real captures registry:getAuthStatus
upstream:backend/src/main.rs:925-926
upstream:backend/src/auth.rs:345-364
upstream:backend/src/auth.rs:43-43
fixture:captured-readonly
postAuthSetup POST /api/auth/setup instances-auth /instances/new
settings/auth-entry		 dedicated-auth-flow planned: Frozen-scope high-risk operation is planned with simulation-only acceptance until controlled safety authorization exists.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R3; strong
dedicated-flow		 auth-dedicated/auth-no-replay/auth-version-probe/new-job-lineage/auth-result
Dedicated auth endpoint, actor/session/instance rate limits, and fresh preflight of authentication state are required.
Credential state is never inferred from stale data; require actor-initiated auth flow and no replay.
Auth 404/405/501 is version evidence; do not downgrade to a generic proxy or expose credentials.
Retry creates a new Job lineage (retryOfJobId/rootJobId); never replay successful items.
Dedicated auth jobs return through /jobs/:jobId; session flows return a credential metadata-only audit result and link.		 SIMULATED_HIGH_RISK not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postAuthSetup
upstream:backend/src/main.rs:929-930
upstream:backend/src/auth.rs:366-427
upstream:backend/src/auth.rs:43-43
fixture:not-eligible-readonly-capture
postAuthLogin POST /api/auth/login instances-auth /instances/new
settings/auth-entry		 dedicated-auth-flow planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R1; none
dedicated-flow		 auth-dedicated/auth-no-replay/auth-version-probe/auth-actor-only/auth-result
Dedicated auth endpoint, actor/session/instance rate limits, and fresh preflight of authentication state are required.
Credential state is never inferred from stale data; require actor-initiated auth flow and no replay.
Auth 404/405/501 is version evidence; do not downgrade to a generic proxy or expose credentials.
No automatic replay; require an actor-initiated dedicated flow.
Dedicated auth jobs return through /jobs/:jobId; session flows return a credential metadata-only audit result and link.		 REAL_WRITE_LATER not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postAuthLogin
upstream:backend/src/main.rs:933-934
upstream:backend/src/auth.rs:429-489
upstream:backend/src/auth.rs:43-43
fixture:not-eligible-readonly-capture
postAuthLogout POST /api/auth/logout instances-auth /settings/instances/:id
settings/auth-settings		 dedicated-auth-flow planned: Frozen-scope reversible command is contract-planned for a later controlled real-write acceptance phase.
Persist the audited commit plus runtime capability probes; 404/405/501 is version-scoped evidence and never a permanent global verdict.		 empty:N (Command result is not a collection-empty state.)
partial:N (Single-target command has no meaningful partial result.)
policy-forbidden:Y (Write can be blocked by capability, authorization, risk, or preflight policy.)
unknown-result:Y (Disconnect or timeout requires outcome verification before retry.)
owner-switch:Y (Owner switch preserves execution lineage but discards mismatched route responses.)		 R1; none
dedicated-flow		 auth-dedicated/auth-no-replay/auth-version-probe/auth-actor-only/auth-result
Dedicated auth endpoint, actor/session/instance rate limits, and fresh preflight of authentication state are required.
Credential state is never inferred from stale data; require actor-initiated auth flow and no replay.
Auth 404/405/501 is version evidence; do not downgrade to a generic proxy or expose credentials.
No automatic replay; require an actor-initiated dedicated flow.
Dedicated auth jobs return through /jobs/:jobId; session flows return a credential metadata-only audit result and link.		 REAL_WRITE_LATER not-eligible-readonly-capture; n=0; categories=none; not a collector-eligible fully-bound GET R0 operation registry:postAuthLogout
upstream:backend/src/main.rs:937-938
upstream:backend/src/auth.rs:642-655
upstream:backend/src/auth.rs:43-43
fixture:not-eligible-readonly-capture
Reference in New Issue View Git Blame Copy Permalink