[randomparity]

System-wide operations can currently change held partitions through their managed system. This change makes six tools—system modify, power on/off, system-profile activation, profile restore and firmware update—and their three existing CLI mirrors refuse with system_held whenever the selected system has a local hold. Holders release every hold first; caller identity, a hold token and ownership override cannot waive the rule.

A registry marker flows through the existing call context and managed-system resolver into the existing hold-store reader. Handoff coverage and consumer documentation reflect the six checked tools. ADR 0343 records the operator-approved refusal policy and supersedes only ADR 0327 Decision 5 for this set. No schema migration, command, public token parameter or dependency is added.

Validation: 104 focused tests and 467 bounded integration tests passed. A controlled resolver-check bypass failed at the mocked mutation boundary, then exact source was restored. The final candidate passed just verify (one full local run, 1,319.100 seconds) and pinned uv run --no-sync prek run --all-files (114.862 seconds). CI will be checked separately before handoff. No live HMC run was performed.

The two combined-design phases, both scope audits, whole-branch review and static security pass approved without findings. Simplification made no changes. The original 230–360-line estimate understated the required composed-call/selector tests; the measured 408-line implementation received a corrected 390–440 estimate and fresh review/audit under the unchanged scope.

This is resolver-time admission: a hold placed after admission does not cancel an in-flight operation. Rename-only modifications and validate-only profile calls are deliberately blocked while held. ADR 0193's library, other-host, GUI and raw-command exclusions remain; resource-only and new-partition creation tools outside the six-tool inventory remain outside this extension.

Provenance: issue #1887 and its frozen WORK:SCOPE, including the operator's explicit “Refuse while any system hold exists” decision. Implemented through the invoked campaign/quest workflow.

Closes #1887

Review exit payloads

• Accepted failure-model limit: refusal occurs at managed-system UUID resolution. A hold placed after admission does not cancel an in-flight HMC operation; operators coordinate those operations.
• Accepted policy consequence: rename-only system changes and validate-only system-profile calls are conservatively refused while any system hold remains, including for its placing agent. Holders release all system holds first; no token or override bypass exists.
• Governing ADR 0193 suppression: independent library, other-host, GUI and raw HMC writers remain outside this host front-end fence. Both the branch and static security reviews retained this boundary.
• Authorized bounded surface: resource-only and new-partition creation tools outside the exact six-tool inventory remain outside this extension, with broader protection owned by the operator.
• Estimate history: the original 230–360-line implementation estimate understated the required composed-entry and selector test matrix. The measured 408-line implementation led to a corrected 390–440 estimate, a fresh combined-design review and a second scope audit under the unchanged charter. No tests were cut to meet the estimate.
• No review findings, rejected findings, owned deferrals, follow-up candidates or unresolved notes remain. Two design review phases, one branch review and one static security pass completed; both scope audits approved. Simplification made no changes.

[randomparity]

verdict: approve
exit: none
findings: 0
iterations: 1
security: approve
delivered-head-sha: 66c9aba

Forge whole-branch review

forge review: not required (Cast directly executed one coupled task with contract evidence and assembled-branch integration)

Review exit payloads

• Accepted failure-model limit: refusal occurs at managed-system UUID resolution. A hold placed after admission does not cancel an in-flight HMC operation; operators coordinate those operations.
• Accepted policy consequence: rename-only system changes and validate-only system-profile calls are conservatively refused while any system hold remains, including for its placing agent. Holders release all system holds first; no token or override bypass exists.
• Governing ADR 0193 suppression: independent library, other-host, GUI and raw HMC writers remain outside this host front-end fence. Both the branch and static security reviews retained this boundary.
• Authorized bounded surface: resource-only and new-partition creation tools outside the exact six-tool inventory remain outside this extension, with broader protection owned by the operator.
• Estimate history: the original 230–360-line implementation estimate understated the required composed-entry and selector test matrix. The measured 408-line implementation led to a corrected 390–440 estimate, a fresh combined-design review and a second scope audit under the unchanged charter. No tests were cut to meet the estimate.
• No review findings, rejected findings, owned deferrals, follow-up candidates or unresolved notes remain. Two design review phases, one branch review and one static security pass completed; both scope audits approved. Simplification made no changes.