[acamarata]

The D-0609 rollup still contained local edge cases that could select legacy rollback from an empty state record, lose image rollback information, misclassify init services, or skip valid configuration. This change addresses those cases with regression coverage.

This PR remains draft because full deploy-suite verification did not complete locally. The targeted regressions and all other local checks below passed; the termination of the long suite remains unattributed.

Changes are split by concern: lock token invalidation and terminal detection; deploy-state and image-inspection validation; effective Compose init labels; nginx placeholder handling; Hasura metadata fidelity and directory identity; and CI dependency/vendor scanning. Behavior is documented in .github/docs/maintenance-safety.md.

Row	Verification and disposition
D-0419	BLOCKED: the generic predicate accepts plugin paths, but PruneMarked still requires the generated marker (remote_sync.go:204), while plugins_overlay.go and artifacts.go stage raw, unmarked plugin fragments. The row is explicitly assigned to P7-DEPL-24 in the planning debt-triage table and P7-DEPL-15/remote-apply work in its address-when field. No changes under the requested P7 exclusion.
D-0582	BLOCKED: drive-letter key paths and Windows local operands remain unsupported; the wiki correction is explicitly assigned to P7-DEPL-29 in hq/plan/p7/epics/DEPL/tickets.yaml (docs/tasks). The requested P7 scope exclusion prevents this row's implementation. Spaced-home pin-file quoting is already fixed by 59cd5857 (#807).
D-0696	BLOCKED: the colliding nself-... alias remains in ssh_hostkeys.go; the row explicitly relates to P7-DEPL-29 and assigns alias cleanup to P7-SHIP/host-key ticket work.
D-0609	FIXED: remaining local defects addressed. Spaced-home quoting was already fixed by 59cd5857 (#807), and the fronted TLS gate by b740f87f (#901) / 5a4eded5 (#959); those paths were left unchanged. No outstanding P7 ticket specifically owns the remaining fixes.
D-0687	BLOCKED: init cleanup still lacks a Compose project filter; related: [P7-PLUG-60] places it outside this task's permitted scope.
D-0784	BLOCKED: fixed-size pages and missing download signatures remain; related: [P7-ADOPT-16] places the importer/fixture work outside this task's permitted scope.

Validation against fresh origin/main at 4628857c (Go 1.27.2, CGO disabled, vendor mode; temporary outputs in task scratch):

• PASS: go test -mod=vendor -count=1 for whole internal/database (38.777s), internal/oplock (1.303s), internal/reconcile (60.371s), and internal/build (119.961s); final targeted deploy-state and image-inspection regressions.
• PASS: go vet -mod=vendor and go build -mod=vendor for all five touched packages.
• PASS: make build BINARY="$TMPDIR/nself", make fmt-check, and git diff --check.
• PASS: bash scripts/ci/affected-pkgs_test.sh (14 cases and positive control), bash scripts/ci/vendor-sync-check_test.sh, and shell syntax checks. The affected-package fixture itself passes go test ./....
• Regression checks fail against origin/main source overlays/script copies and pass after the fixes (lock/token/tty, state, image inspection, snippet handling, init overrides, Hasura round trip/default/identity, data readers/deleted embeds, spaced vendor paths).
• INCOMPLETE: the initial full deploy run hit the default ten-minute timeout during TestDeployRollbackRestoresFront. That test passes against clean origin/main source in 105.173s. CGO_ENABLED=0 go test -mod=vendor ./internal/deploy -count=1 -timeout=20m on ac66b53b then ended with exit 137 before its timeout, without diagnostic output. The cause is unknown; no claim is made that the aggregate termination is a baseline defect. No further heavy retries were attempted.
• PASS: GOTOOLCHAIN=go1.26.10 golangci-lint run --modules-download-mode=vendor ./internal/oplock ./internal/deploy ./internal/reconcile ./internal/build ./internal/database (zero issues, using the already-cached toolchain). The installed linter cannot decode Go 1.27.2 standard-library export data; that error also reproduces against clean origin/main.
• PASS on final 07785645: go test -mod=vendor ./internal/deploy -run 'TestSaveImageTags' -count=1, deploy vet/build, pinned-toolchain lint, formatting, and whitespace checks. This final classifier follow-up handles Docker's normalized missing-image names while refusing empty or multiline diagnostics.

No hq changes, production connections, deployments, version changes, tags, or releases.

GitHub CI remains queued. Task scratch files have been removed.