@microck/raft 0.4.0 → 0.6.0

package/README.md

@@ -30,13 +30,16 @@ npm install -g @microck/raft
 raft --version
 ```
 
+`raft self-update` upgrades the CLI later. Raft prints a one-line stderr notice
+when a new release exists; set `RAFT_NO_UPDATE_CHECK=1` to turn it off.
+
 Python wheels and source archives are also available in
 [releases](https://github.com/Microck/raft/releases). npm installation does not set
 up hosts or download workspace images.
 
 | requirement | minimum |
 | --- | --- |
-| host | dedicated ARM64 or AMD64 Ubuntu host, 2 CPUs, 8 GiB RAM, 80 GiB free disk |
+| host | dedicated ARM64 or AMD64 Ubuntu host, 2 CPUs, 8 GiB RAM, 80 GiB free disk, plus the pool size if you enable own box disks |
 | host access | SSH and passwordless sudo |
 | controller | Linux, Python 3.11.8+, SSH and SCP; npm or uv for installation |
 
@@ -61,12 +64,25 @@ raft stop "$box"
 `raft stop` and expiration keep persistent boxes on disk. `new --disposable`
 deletes a temporary box when it stops or expires. `raft resume` starts
 the box with a new lifetime. `raft destroy` deletes the box and its snapshots.
-disposable creation and retention cleanup require the current host worker;
-redeploy from the current checkout before using them.
-
-each host allows four saved boxes, including stopped ones. `raft limits` reports
-current allocations, free disk space and recommended running counts for each
-size. see [host capacity](docs/reference/capacity-limits.mdx).
+`raft policy lab --delete-stopped-after 48` makes the host delete boxes left
+stopped for 48 hours, and logs each deletion in its journal. disposable
+creation, prune and retention require the current host worker; redeploy from
+the current checkout before using them.
+
+size boxes for the job: `--cpu`, `--memory` and `--disk` take any whole number
+up to the host. on hosts deployed with `--disk-pool SIZE`, `--disk 20GiB` gives a
+box its own disk that it, and Docker inside it, cannot grow past; forks and
+templates of it are copy-on-write. raft does not cap how many boxes you keep.
+`raft capacity` prints an advisory estimate of what fits; it never blocks a box.
+see [box sizing and capacity](docs/reference/capacity.mdx).
+
+`raft config set` stores your defaults for `new`, such as location, TTL, size
+and `disposable true`; `new --persistent` keeps one box anyway. size defaults
+apply only to boxes from the image: `new --from` and `fork` keep the source's
+size. `raft policy lab --require purpose,owner` makes the host reject boxes whose
+note lacks those fields, with an error that names the missing flags. policies
+are guardrails for agents: anyone with sudo on the host can change them.
+see [defaults and host policies](docs/guides/config-policy.mdx).
 
 ## image and workspace control
 
@@ -131,8 +147,8 @@ records differences, sources and test coverage.
 | Create/list/inspect/delete | ✅ | ✅ | Single operator |
 | Persistent stop/resume | ✅ | ✅ | Shared host kernel |
 | TTL and lifetime extension | ✅ | ✅ | Persistent boxes retain disk; disposable boxes delete |
-| CPU/memory sizing and usage | ✅ | ✅ | 1 or 2 CPUs, 1, 2, 4 or 8 GiB RAM. Disk usage covers the shared pool |
-| Host capacity recommendations | ❌ | ✅ | Raft recommends running capacity and enforces four saved boxes. Boat reports plan limits |
+| CPU/memory sizing and usage | ✅ | ✅ | Any whole CPU count and GiB size up to the host. Usage covers the shared pool or the box's own disk |
+| Host capacity estimates | ❌ | ✅ | Advisory only; Raft has no box count limit. Boat reports plan limits |
 | Root terminal and command execution | ✅ | ✅ | Host SSH transport |
 | Background jobs, logs and cancellation | ✅ | ✅ | No process checkpoints |
 | File upload/download | ✅ | ✅ | Files and recursive trees; new directory destinations only |
@@ -144,17 +160,17 @@ records differences, sources and test coverage.
 | Desktop access | ✅ | ✅ | noVNC; see verification limits |
 | Reverse forwarding | ✅ | ❌ | Not implemented |
 | Public workspace hosting and browser-only streaming | ✅ | ❌ | Not implemented |
-| Resize on resume/fork | ✅ | ✅ | Optional CPU/RAM overrides within supported sizes |
-| CLI-wide JSON mode | ✅ | ❌ | Boat JSON/JSONL; Raft list/info/usage/limits plus prune JSONL |
+| Resize on resume/fork | ✅ | ✅ | Optional CPU/RAM overrides; disks keep their size |
+| CLI-wide JSON mode | ✅ | ❌ | Boat JSON/JSONL; Raft list/info/usage/capacity/config plus prune JSONL |
 | Snapshot file browsing/download | ✅ | ❌ | Whole-box backup only |
-| Strict per-box disk quotas | ✅ | ❌ | Shared 60 GiB Btrfs pool |
+| Strict per-box disk quotas | ✅ | ✅ | On hosts deployed with `--disk-pool`, `new --disk SIZE` gives a box its own fixed-size, copy-on-write disk; the default shared pool has none |
 | Separate-kernel VM isolation | ✅ | ❌ | Container runtime |
 | Named environments and managed secrets | ✅ | ❌ | Manual configuration |
 | Organizations and webhooks | ✅ | ❌ | Raft is single-operator; no event API |
 | Dashboard, remote API and SDK | ✅ | ❌ | CLI only |
 | Managed agent conversations | ✅ | ❌ | Not implemented |
-| Automatic deletion and retention | ✅ | ✅ | Disposable deletion; opt-in age-based prune with preview |
-| CLI self-update | ✅ | ❌ | Standard npm or Python package installation |
+| Automatic deletion and retention | ✅ | ✅ | Disposable deletion, optionally by default; per-host retention deletes boxes stopped for N hours; age-based prune with preview |
+| CLI self-update | ✅ | ✅ | Explicit `raft self-update` for npm and uv installs plus a daily stderr notice. Boat also updates itself after commands; Raft only notifies |
 
 ## verification and development
 

package/deploy/deploy.py

@@ -15,7 +15,7 @@ import sys
 
 ROOT = Path(__file__).resolve().parent.parent
 sys.path.insert(0, str(ROOT))
-from raft import configuration  # noqa: E402
+from raft import BOX_DISK_POOL, configuration, gib, gib_size  # noqa: E402
 
 RELEASES = "https://github.com/Microck/raft/releases/download/"
 # Matches the user agent install-incus.sh sends for its own downloads.
@@ -134,7 +134,86 @@ def import_archive(host, archive, architecture):
     return checked_image(host, fingerprint, architecture)
 
 
-def deploy(name, host):
+def free_disk(host):
+    return int(
+        remote(
+            host,
+            shlex.join(
+                [
+                    "python3",
+                    "-c",
+                    "import shutil; print(shutil.disk_usage('/var/lib/incus').free)",
+                ]
+            ),
+        )
+    )
+
+
+def box_disk_pool(host, pools, size):
+    """Create or verify the thin LVM pool that holds own box disks.
+
+    Own box disks are opt-in: without --disk-pool a host has no raft-disks pool,
+    which is a normal state, and --disk-pool on a later redeploy adds it. Thin
+    volumes make forks, templates and snapshots of own-disk boxes snapshots that
+    share blocks. Raft never overcommits the pool: every write path that adds a
+    thin volume checks that all virtual sizes still fit its data space (see
+    BOX_DISK_ACCOUNTING in raft.py), so the pool cannot fill.
+    """
+    pool = next((item for item in pools if item["name"] == BOX_DISK_POOL), None)
+    if pool is None:
+        if size is None:
+            return
+        # Same 20 GiB margin as the fresh-host check for the 60 GiB shared pool.
+        if free_disk(host) < (gib(size) + 20) * 1024**3:
+            raise RuntimeError(
+                f"Creating the {size} {BOX_DISK_POOL} pool needs {gib(size) + 20} GiB free disk; "
+                "pass a smaller --disk-pool or free host disk"
+            )
+        remote(
+            host,
+            f"sudo -n incus storage create {BOX_DISK_POOL} lvm size={size} lvm.use_thinpool=true",
+        )
+        pool = json.loads(remote(host, f"sudo -n incus query /1.0/storage-pools/{BOX_DISK_POOL}"))
+    config = pool["config"]
+    if pool["driver"] != "lvm" or config.get("lvm.use_thinpool") != "true":
+        raise RuntimeError(
+            f"{BOX_DISK_POOL} must be a thin LVM pool (lvm.use_thinpool=true); inspect it and "
+            "back up its boxes before explicit storage recovery"
+        )
+    if size is not None and config.get("size") != size:
+        raise RuntimeError(
+            f"{BOX_DISK_POOL} has size={config.get('size')}, not {size}. "
+            "Deployment does not resize existing storage; omit --disk-pool to keep it"
+        )
+    # The thin pool frees blocks that boxes discard, but must not pass discards on
+    # to its loop file: that would punch holes in the file, and a later write into
+    # a hole could find the host disk full and fail every own-disk box at once.
+    # Changing passdown to nopassdown is allowed while the pool is active.
+    thinpool = f"{config['lvm.vg_name']}/{config['lvm.thinpool_name']}"
+    discards = remote(host, f"sudo -n lvs --noheadings -o discards {thinpool}").strip()
+    if discards != "nopassdown":
+        remote(host, f"sudo -n lvchange --discards nopassdown {thinpool}")
+    # Incus creates the pool's loop file sparse. Allocating its full length makes
+    # the host disk hold the whole pool; fallocate only fills holes and never
+    # changes the file's length or data, so repeating it is a no-op. A pool an
+    # operator placed on a dedicated block device has no file to allocate.
+    remote(
+        host,
+        shlex.join(
+            [
+                "sudo",
+                "-n",
+                "sh",
+                "-c",
+                'test ! -f "$1" || fallocate -l "$(stat -c %s "$1")" "$1"',
+                "raft",
+                config["source"],
+            ]
+        ),
+    )
+
+
+def deploy(name, host, disk_pool=None):
     host_architecture(host)
     copy(host, ROOT / "deploy/install-incus.sh", "/tmp/raft-install-incus.sh")
     print(remote(host, "bash /tmp/raft-install-incus.sh </dev/null"), flush=True)
@@ -149,24 +228,29 @@ def deploy(name, host):
         if project.get("description") != "Raft managed workspaces":
             raise RuntimeError("Existing raft project needs ownership verification")
     else:
-        if pool is not None or network is not None:
-            raise RuntimeError(
-                "Raft resource names already exist without an owned project; review them explicitly"
-            )
-        available = int(
-            remote(
-                host,
-                shlex.join(
-                    [
-                        "python3",
-                        "-c",
-                        "import shutil; print(shutil.disk_usage('/var/lib/incus').free)",
-                    ]
+        leftovers = [
+            name
+            for name, found in [
+                ("storage pool raft-data", pool is not None),
+                ("network rfbr0", network is not None),
+                (
+                    f"storage pool {BOX_DISK_POOL}",
+                    any(item["name"] == BOX_DISK_POOL for item in pools),
                 ),
+            ]
+            if found
+        ]
+        if leftovers:
+            raise RuntimeError(
+                "Raft resource names already exist without an owned project: "
+                + ", ".join(leftovers)
+                + "; review them explicitly"
             )
-        )
-        if available < 80 * 1024**3:
-            raise RuntimeError("Fresh deployment needs at least 80 GiB free disk")
+        # 60 GiB shared pool, 20 GiB for images and the host, and the own-disk
+        # pool when --disk-pool enables it.
+        needed = 80 + (gib(disk_pool) if disk_pool else 0)
+        if free_disk(host) < needed * 1024**3:
+            raise RuntimeError(f"Fresh deployment needs at least {needed} GiB free disk")
         remote(
             host,
             "sudo -n incus project create raft -c features.images=true -c features.profiles=true </dev/null",
@@ -207,6 +291,7 @@ def deploy(name, host):
             "Raft pool must have configured size=60GiB; inspect raft-data and back up boxes "
             "before explicit storage recovery. Deployment does not resize existing storage."
         )
+    box_disk_pool(host, pools, disk_pool)
 
     devices = profile["devices"]
     if (
@@ -261,9 +346,17 @@ def main():
     parser = argparse.ArgumentParser(description=__doc__)
     configured = hosts()
     parser.add_argument("--location", choices=configured)
+    parser.add_argument(
+        "--disk-pool",
+        type=gib_size,
+        metavar="SIZE",
+        help=f"Enable own box disks: create the {BOX_DISK_POOL} pool with SIZE of host disk "
+        "if it is missing (default: leave own box disks as they are); an existing pool must "
+        "already have this size",
+    )
     args = parser.parse_args()
     for name in [args.location] if args.location else configured:
-        deploy(name, configured[name])
+        deploy(name, configured[name], args.disk_pool)
 
 
 if __name__ == "__main__":

package/deploy/install-incus.sh

@@ -15,6 +15,16 @@ if ! command -v incus >/dev/null; then
   sudo apt-get update -qq
   sudo env DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=l apt-get install -y --no-install-recommends incus btrfs-progs
 fi
+# raft-disks, the opt-in pool for own box disks, uses LVM thin provisioning.
+if ! command -v lvcreate >/dev/null; then
+  sudo apt-get update -qq
+  sudo env DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=l apt-get install -y --no-install-recommends lvm2
+fi
+# raft recover reads the backup index, which Incus writes as YAML.
+if ! python3 -c 'import yaml' 2>/dev/null; then
+  sudo apt-get update -qq
+  sudo env DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=l apt-get install -y --no-install-recommends python3-yaml
+fi
 if ! command -v nft >/dev/null; then
   sudo apt-get update -qq
   sudo env DEBIAN_FRONTEND=noninteractive NEEDRESTART_MODE=l apt-get install -y --no-install-recommends nftables

package/deploy/raft-expire.py

@@ -1,61 +1,139 @@
 #!/usr/bin/python3
-"""Enforce running deadlines and preview or delete explicitly selected old boxes."""
+"""Enforce running deadlines and stopped-box retention, and preview or delete
+explicitly selected old boxes."""
 
 import argparse
 import json
+import re
 import subprocess
+import sys
 import time
 
-PROTOCOL = 1
+# Checked by CHECK_WORKER in raft.py; bump both together. 2 added retention.
+PROTOCOL = 2
 
 PREFIX = ["incus", "--project", "raft"]
+# Stopped-box retention set by `raft policy LOCATION --delete-stopped-after
+# HOURS` on the Incus project, and when it was set. Mirrors RETENTION_KEY in
+# raft.py, whose delete_at() reports the same deadline this worker enforces.
+RETENTION_KEY = "user.raft.delete-stopped-after"
 
 
 def run(*argv):
     return subprocess.run([*PREFIX, *argv], check=True, capture_output=True, text=True).stdout
 
 
-def main():
-    cli = argparse.ArgumentParser(description=__doc__)
-    cli.add_argument("--prune-days", type=int)
-    cli.add_argument("--yes", action="store_true")
-    args = cli.parse_args()
-    if args.prune_days is not None and args.prune_days < 1:
-        cli.error("Retention must be at least one day")
-    if args.yes and args.prune_days is None:
-        cli.error("--yes requires --prune-days")
-    now = int(time.time())
-    # The service, gc and prune all hold the same lifecycle lock. Never select
-    # unrelated Incus instances or use creation time as a guessed stop time.
-    for box in json.loads(run("list", "--fast", "--format", "json")):
-        config = box["config"]
-        if config.get("user.raft") != "true":
-            continue
-        name = box["name"]
-        if args.prune_days is not None:
-            stopped_at = config.get("user.raft.stopped-at")
-            if box["status"] != "Stopped" or not stopped_at:
-                continue
-            if int(stopped_at) > now - args.prune_days * 86400:
-                continue
-            if args.yes:
-                run("delete", name)
-            print(json.dumps({"box": name, "action": "deleted" if args.yes else "would-delete"}))
+def retention():
+    """Return the project's (hours, since) retention policy, or None when it is unset."""
+    projects = json.loads(run("project", "list", "--format", "json"))
+    config = next(item for item in projects if item["name"] == "raft")["config"]
+    hours = config.get(RETENTION_KEY, "")
+    since = config.get(RETENTION_KEY + ".since", "")
+    if not hours:
+        return None
+    # Raft writes whole numbers; anything else came from a native Incus edit.
+    if not re.fullmatch(r"[1-9][0-9]*", hours) or not re.fullmatch(r"[0-9]+", since):
+        raise ValueError(
+            f"Invalid retention {RETENTION_KEY}={hours!r} .since={since!r}; deleted no stopped "
+            "boxes. Fix it with raft policy LOCATION --delete-stopped-after HOURS or never"
+        )
+    return int(hours), int(since)
+
+
+def prune(boxes, days, apply, now):
+    """Preview or delete stopped boxes whose recorded stop is older than days."""
+    for box in boxes:
+        stopped_at = box["config"].get("user.raft.stopped-at")
+        if box["status"] != "Stopped" or not stopped_at:
             continue
-        deadline = config.get("user.raft.expires")
-        if not deadline or int(deadline) > now:
+        if int(stopped_at) > now - days * 86400:
             continue
+        if apply:
+            run("delete", box["name"])
+        print(json.dumps({"box": box["name"], "action": "deleted" if apply else "would-delete"}))
+
+
+def enforce(box, policy, now):
+    """Apply the running deadline, then the stopped-box retention, to one box."""
+    config = box["config"]
+    name = box["name"]
+    deadline = config.get("user.raft.expires")
+    if deadline and int(deadline) <= now:
         if box["status"] not in ["Running", "Stopped"]:
             raise RuntimeError(f"Unexpected state for expired box {name}")
         if config.get("user.raft.disposable") == "true":
             run("delete", name, "--force")
             print(f"Deleted expired disposable box {name}", flush=True)
-            continue
+            return
         if box["status"] == "Running":
             run("stop", name, "--timeout", "30")
         run("config", "set", name, f"user.raft.stopped-at={now}")
         run("config", "unset", name, "user.raft.expires")
         print(f"Stopped expired box {name}; disk retained", flush=True)
+        return
+    # Retention never touches a running box. A native incus start keeps the old
+    # stop time, so clear it here and the next stop starts a fresh clock. A start
+    # and stop between two worker runs still goes unnoticed.
+    if box["status"] != "Stopped":
+        if box["status"] == "Running" and config.get("user.raft.stopped-at"):
+            run("config", "unset", name, "user.raft.stopped-at")
+        return
+    stopped_at = config.get("user.raft.stopped-at")
+    if not stopped_at:
+        # Raft records the stop time on stop and expiry. A box stopped any other
+        # way (a guest poweroff, a native incus stop, a recovered backup or a
+        # failed start) starts its retention clock now. Its real stop time is
+        # unknown, and guessing an earlier one could delete it early.
+        run("config", "set", name, f"user.raft.stopped-at={now}")
+        print(f"Recorded stop time of box {name}, stopped outside Raft", flush=True)
+        return
+    if policy is None:
+        return
+    hours, since = policy
+    # The clock starts at the later of the stop and the policy change, so a new or
+    # shorter policy never deletes a box sooner than its hours after the change.
+    if max(int(stopped_at), since) + hours * 3600 > now:
+        return
+    run("delete", name)
+    stopped = time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime(int(stopped_at)))
+    message = f"Deleted box {name}, stopped since {stopped}, under the {hours}-hour retention"
+    # Retention deletes data without a command, so every deletion goes to the host
+    # journal beside the policy change that caused it (journalctl -t raft), whether
+    # the timer or raft gc ran the worker.
+    subprocess.run(["logger", "-t", "raft", message], check=True)
+    print(message, flush=True)
+
+
+def main():
+    cli = argparse.ArgumentParser(description=__doc__)
+    cli.add_argument("--prune-days", type=int)
+    cli.add_argument("--yes", action="store_true")
+    args = cli.parse_args()
+    if args.prune_days is not None and args.prune_days < 1:
+        cli.error("Retention must be at least one day")
+    if args.yes and args.prune_days is None:
+        cli.error("--yes requires --prune-days")
+    now = int(time.time())
+    # The service, gc and prune all hold the same lifecycle lock. Never select
+    # unrelated Incus instances or use creation time as a guessed stop time.
+    boxes = [
+        box
+        for box in json.loads(run("list", "--fast", "--format", "json"))
+        if box["config"].get("user.raft") == "true"
+    ]
+    if args.prune_days is not None:
+        prune(boxes, args.prune_days, args.yes, now)
+        return
+    # An invalid policy must not stop deadline enforcement: apply deadlines, skip
+    # retention, and fail afterwards so the service run reports the problem.
+    try:
+        policy, problem = retention(), None
+    except ValueError as error:
+        policy, problem = None, str(error)
+    for box in boxes:
+        enforce(box, policy, now)
+    if problem:
+        sys.exit(problem)
 
 
 if __name__ == "__main__":

package/deploy/verify-controls.py

@@ -9,7 +9,7 @@ import time
 import uuid
 
 sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
-from raft import ADMISSION, address, incus, inventory, parse_handle, transaction  # noqa: E402
+from raft import address, incus, inventory, parse_handle, transaction  # noqa: E402
 import importlib.util  # noqa: E402
 
 spec = importlib.util.spec_from_file_location(
@@ -32,61 +32,21 @@ def wait_address(box):
     raise RuntimeError("Resumed workspace has no managed IPv4 address after 30 seconds")
 
 
-def verify_admission(location, directory):
-    fixtures = []
-    saved = len(inventory(location))
-    if saved >= 4:
-        raise RuntimeError("Admission test needs at least one free slot on its target")
-    try:
-        for _ in range(4 - saved):
-            box = live.raft(
-                "new", "--location", location, "--memory", "1GiB", "--ttl", "600"
-            ).stdout.strip()
-            fixtures.append(box)
-            live.wait_running(box)
-            live.raft("stop", box)
-        rejected = live.raft("new", "--location", location, check=False)
-        if rejected.returncode == 0:
-            fixtures.append(rejected.stdout.strip())
-        assert rejected.returncode != 0 and "already holds four boxes" in rejected.stderr
-        rejected = live.raft("fork", fixtures[0], "--ttl", "600", check=False)
-        if rejected.returncode == 0:
-            fixtures.append(rejected.stdout.strip())
-        assert rejected.returncode != 0 and "already holds four boxes" in rejected.stderr
-        with tempfile.TemporaryDirectory(dir=directory, prefix="raft-admission-") as work:
-            # Admission must reject before native archive parsing, without creating a box.
-            archive = Path(work) / "rejected.tar.gz"
-            archive.write_bytes(b"not-an-incus-archive")
-            rejected = live.raft("recover", str(archive), "--location", location, check=False)
-            if rejected.returncode == 0:
-                fixtures.append(rejected.stdout.strip())
-            assert rejected.returncode != 0 and "already holds four boxes" in rejected.stderr
-        assert len(inventory(location)) == 4
-        report = json.loads(live.raft("limits", "--location", location, "--json").stdout)
-        assert report["savedBoxes"] == 4 and report["savedSlots"] == 0
-        assert all(size["newBoxes"] == 0 for size in report["recommendations"])
-        print(
-            f"{location}: stopped boxes count toward admission; new/fork/recover reject a fifth box",
-            flush=True,
-        )
-    finally:
-        for box in reversed(fixtures):
-            live.raft("destroy", box)
-
-
 def verify(source, target, directory, development_image=False):
     fixtures = []
     name = "rf-" + uuid.uuid4().hex[:16]
     box = source + ":" + name
     try:
         if development_image:
-            box = live.raft("new", "--location", source, "--ttl", "1800").stdout.strip()
+            box = live.raft(
+                "new", "--location", source, "--ttl", "1800", "--cpu", "1", "--disk", "shared"
+            ).stdout.strip()
             fixtures.append(box)
             live.wait_running(box)
         else:
             transaction(
                 source,
-                ADMISSION + 'incus --project raft launch images:debian/13 "$1" '
+                'incus --project raft launch images:debian/13 "$1" '
                 "-c user.raft=true -c limits.cpu=1 -c limits.memory=1GiB; "
                 'incus --project raft config set "$1" user.raft.expires="$(( $(date +%s) + 600 ))"',
                 name,
@@ -172,9 +132,36 @@ def verify(source, target, directory, development_image=False):
             print(f"{source}: archive completed ({size} bytes)", flush=True)
             assert live.raft("backup", box, str(archive), check=False).returncode != 0
             assert archive.stat().st_size == size
-            restored = live.raft("recover", str(archive), "--location", target).stdout.strip()
-            fixtures.append(restored)
+            # The archived box has no note, so a target policy rejects it after import
+            # and deletes the imported copy in the same locked transaction.
+            live.raft("policy", target, "--require", "purpose,owner")
+            try:
+                saved = len(inventory(target))
+                rejected = live.raft("recover", str(archive), "--location", target, check=False)
+                if rejected.returncode == 0:
+                    fixtures.append(rejected.stdout.strip())
+                assert rejected.returncode == 1, rejected
+                assert "requires box note fields purpose, owner" in rejected.stderr, rejected
+                assert len(inventory(target)) == saved, "Rejected recovery kept a box"
+                restored = live.raft(
+                    "recover",
+                    str(archive),
+                    "--location",
+                    target,
+                    "--purpose",
+                    "Recovery verification",
+                    "--owner",
+                    "verify-controls",
+                ).stdout.strip()
+                fixtures.append(restored)
+            finally:
+                live.raft("policy", target, "--require", "none")
             print(f"{target}: recovered stopped workspace", flush=True)
+            note = json.loads(live.raft("info", restored).stdout)["config"]["user.raft.note"]
+            assert json.loads(note) == {
+                "purpose": "Recovery verification",
+                "owner": "verify-controls",
+            }
             metadata = json.loads(live.raft("info", restored).stdout)
             assert metadata["status"] == "Stopped"
             assert not metadata["config"].get("user.raft.expires")
@@ -237,5 +224,4 @@ if __name__ == "__main__":
         help="Export the complete configured development image rather than a small fixture",
     )
     args = parser.parse_args()
-    verify_admission(args.target, args.directory)
     verify(args.source, args.target, args.directory, args.development_image)