[futurepaul]

Lat2 still serves the 6a923870 application generation. The merged security artifact selects bc5b7082, which would also replace Core, Chat, Hosted Device, Identity, Brain 0.8 with 0.9, and the dashboard. The kernel rollout is held on this host because the user explicitly chose to preserve the running applications.

Restore only lat2-app-source in flake.nix and flake.lock to the live 6a9238702912bde77ac240270e0f75581f9f2a07 revision. The lock node comes from deployed host revision 534416b0. The fixed 6.18.56 kernel and persistent guard from #1139 remain selected. The application release in #1138 stays a separate coordinated rollout and can advance this pin when it is ready.

Validation:

• Nix evaluation of the actual candidate matches all five running application executable store paths exactly, including Brain 0.8.
• The dashboard digest exactly matches the running image: sha256:edeb58da6ddac69b511cfecfd3808e4220af90a952e3fe131812b5979c8233ea.
• Kernel 6.18.56, MPTCP disabled, and all NixOS assertions pass. Every other lock node is unchanged.
• All 24 lat2 artifact contract tests pass. just source-structure-check passes, including its nine tests.
• Fresh canonical lat2 status confirms the existing mitigation remains green and the current application closure is unchanged.

Deployment still requires an artifact built from the exact merged-main revision, reviewed dry activation and application identity comparisons, and a controlled reboot retaining the guard and previous profile. Lat3, lat4, lat5 and lat7 are already on 6.18.56. Lat2 remains protected by the persistent packet filter while this correction is reviewed.

[alexlwn123]

Pass for this two-file pin correction, within the static and fixture coverage below. No actionable regression found at 6c776662335ad242be1825907dbb5dce20096b5c. Submitted as COMMENT; this is not deployment authorization.

• The flake URL and both lock revisions consistently select 6a9238702912bde77ac240270e0f75581f9f2a07. The complete lock node matches historical revision 534416b0; every other lock node is unchanged from the PR base. Independently recomputing the canonical NAR hash from the pinned Git archive gives sha256-6FsUKovUskn4huvlY+CxhL8PSNb0Nb+W7pbkPVTb2tc=, matching the lock, and the commit timestamp matches lastModified.
• Traced lat2's package source, application-revision reporting, and pinned dashboard module. The dashboard selects the stated edeb58da…3ea digest. Relative to 534416b0, package definitions, application service modules, and dependency locks remain identical; the host retains the added guard module. The PR leaves the 6.18.56 kernel selection, disabled MPTCP, and persistent guard wiring intact.
• All 42 local tests passed: 24 lat2 closure-artifact tests, 5 guard-script tests, and 13 TCP-security status tests. These use disposable fixtures/mocked commands, run with the available Python 3.12.14. git diff --check passed and the isolated checkout stayed clean.

Limits: Nix/direnv and just are unavailable; the prescribed development wrapper exited 127. No local Nix evaluation/build, packaged-runtime, kernel, reboot, or live application/store-path verification was performed. CI's Source structure and Nix service packages checks are green; other checks, including Nix static contracts, remain pending at review time. Live deployment identity remains an operator prerequisite, not something established by this review. No host access or production changes were made.