When native service inventory is complete

A successful host-channel connection is not an inventory. Stado accepts loaded unit observations only after the native reader identifies its manager, calling account and requested detail, and explicitly completes with the number of unit rows actually received. An empty completed inventory differs from an unsupported platform, an unreadable scope or a response that stopped part way through.

Reads and applicable platforms

stado service list --undeclared --json
stado doctor --json

service list --undeclared reads every managed host, keeps the results from hosts that answered, and fails if any host's inventory cannot be read. Its JSON rows are not proof the whole command succeeded: inspect its exit status and stderr. The fleet-shape doctor check records an inventory refusal as that host not measured, with the read's own cause; other hosts and registry-only checks remain available. Stado Desktop → Compute providers runs the same doctor command through the selected native API and keeps its command receipt on screen.

The full Linux read covers service files in Stado's system and calling-account installation directories. Each systemd property query must answer successfully; a failed manager read is not a row with guessed empty properties. This is not an enumeration of every distribution-provided systemd unit.

The full macOS read combines installed declarations with jobs held by the system, calling-account user and graphical domains. It requires readable native list/domain/metadata operations. Domain membership comes from the recognized complete root services table, not arbitrary metadata containing a label. A zero-PID registration is still held. A missing or unreadable containing domain, including a graphical domain unavailable to this account, does not establish an empty domain. Stado does not create a login or escalate privilege to make that read appear complete.

The macOS image-reconciliation read uses the same completion requirement but omits PATH versions, script-variable requirements and process-age diagnostics. It keeps the existing bulk reads instead of adding manager queries per label. Linux image reconciliation is not introduced by this inventory contract.

Interpreting a refusal

The error names the target and requested detail. When a program result exists, it retains program_exit and nonempty stderr, including a zero-exit program whose structured response refused the read. A native refusal retains the failed operation, its native_exit, the identity already observed, and its diagnostic output. Empty native output stays explicitly empty; it does not erase the operation or exit status. Before the identity header, identity is unobserved.

Malformed or repeated headers, unsupported native table layouts, malformed observation rows, scopes outside the observed manager/account, mismatched terminal counts, missing completion and recognized packets after completion refuse the inventory. Partial rows are not returned as a complete host answer. Use the named operation and native cause to investigate access or output-profile problems; changing the registry declaration does not prove the native read.

Release delivery also propagates an unreadable image inventory rather than treating it as no readers needing refresh. Installation failures remain visible through the ordinary CLI product status and Stado Desktop → Products receipt; an earlier installed placement does not prove its subsequent reader-convergence step succeeded.

What completion does not establish

The envelope proves the supported reader reached its end and that its unit rows were received and decoded. It does not make the separate native reads atomic, prove every filesystem path readable, turn unknown optional unit properties into measurements, or attest a running kernel image. Ownership, mutation authorization and post-change image verification keep their own checks. No unknown optional observation is upgraded to agreement by an inventory count.