← Branches
design-self-serve-offline-moves
Commits
-
e8087b49c
domains: an unknown label keeps its alias only after the name's precedence checks pass (final review 2, N1)
claude agent, operated by paul@keymail.dev
-
a232dc79c
console: a create cleans up a corrupt or stale body under its own live slot, quarantine first (final review 2, R1)
claude agent, operated by paul@keymail.dev
-
4a82a5f70
console: hostname locks are refcounted and the lifetime log throttle prunes old keys (final review F7)
claude agent, operated by paul@keymail.dev
-
c289fe846
host: the no-change release witness arms a fresh releaser, so a stray marker write shows (final review F6)
claude agent, operated by paul@keymail.dev
-
d16b3c227
console: the migration pass slows down on attempts, not candidates (final review F5)
claude agent, operated by paul@keymail.dev
-
fc499519a
docs: the lifetimes cutover forbids an older box after the marker and names the roll window (final review F4)
claude agent, operated by paul@keymail.dev
-
0316ce6a9
domains: the catch-all label counts are judged, so a stale body neither shares a label nor reserves one (final review F3)
claude agent, operated by paul@keymail.dev
-
2e9efe252
console: a create retires another owner's live slot only when no record exists under its key (final review F2)
claude agent, operated by paul@keymail.dev
-
29b896f93
console: the cutover door runs the box floor unless a validated marker was read (final review F1)
claude agent, operated by paul@keymail.dev
-
73722b837
ci: the cutover's two output fences declare text, and the closed-door walk counts the lifetimes cutover door (64)
claude agent, operated by paul@keymail.dev
-
7e6a0845d
census: self-serve moves 1 Task 9 fix round 1 records the create door's committed answer and names the @fields row kind
claude agent, operated by paul@keymail.dev
-
e00e1d6c7
lifetimes witnesses: the synthetic (1, 9) is explained, and the interleave observes the slot retired when the tombstone's delete is issued
claude agent, operated by paul@keymail.dev
-
806f03cd5
console: a delayed create whose replay already committed answers success, not pending
claude agent, operated by paul@keymail.dev
-
abb8d4a21
census: self-serve moves 1 Task 9 closes the plan's proposal
claude agent, operated by paul@keymail.dev
-
44438709d
console: lifetimes end to end across a landed create's recoveries, a late legacy create and a replayed create interleaved with a move and a retirement
claude agent, operated by paul@keymail.dev
-
8e38e78b4
host: lifetimes end to end across a forward move, an abort, a reconstructed row and a recreated host
claude agent, operated by paul@keymail.dev
-
d86371e81
census: self-serve moves 1 Task 8 re-pins the edges file writer and loop and pins the edge envelope
claude agent, operated by paul@keymail.dev
-
f1e13d9ee
host: the real writer's publication under every claim state folds through the real edge fold as the mixed-history statement says
claude agent, operated by paul@keymail.dev
-
9d054e4ec
host: the lifetimes writer publishes (incarnation, serving_seq) and target_host
claude agent, operated by paul@keymail.dev
-
3571b2648
edge: the home map orders unstamped entries by (incarnation, serving_seq), pair-less entries counting as (0, 0)
claude agent, operated by paul@keymail.dev
-
026b14ff8
census: Task 7 fix round 1 re-pins the offline releases and names RouteFor's root-caller rows
claude agent, operated by paul@keymail.dev
-
0b1c18461
host: the E2E drives armOffline's own releaser against a held row
claude agent, operated by paul@keymail.dev
-
edde2800f
host: a claims-on box releases the offline open and revert through today's ReleaseHold
claude agent, operated by paul@keymail.dev
-
13a36714f
census: self-serve moves 1 Task 7 re-pins the pair's registry plumbing, reconcile and the offline releases
claude agent, operated by paul@keymail.dev
-
7a3122fea
provision: ReconcileConfig.DeleteIfHold's comment names retireHeldPredecessor
claude agent, operated by paul@keymail.dev
-
8cb5e8c52
host: the two-box offline move through a lifetime carries the pair on every row it holds and opens
claude agent, operated by paul@keymail.dev
-
23927cc27
host: the offline open and revert release with the observed record's pair; claims-off holds write theirs
claude agent, operated by paul@keymail.dev
-
7eb497f9b
provision: reconcile installs a lifetime on a row with its hold in one write and never moves another lifetime's row
claude agent, operated by paul@keymail.dev
-
2c824282f
registry: rows carry the lifetime pair; the hold, release and install setters write it with the status
claude agent, operated by paul@keymail.dev
-
f50d05655
provision: the offline hold, open, abort and finish advance move_seq and stamp move.seq
claude agent, operated by paul@keymail.dev
-
80f5487fe
census: self-serve moves 1 Task 6c re-pins the console units whose record reads are now judged wrappers
claude agent, operated by paul@keymail.dev
-
9028fe349
console: TestNoUnjudgedRecordReads audits console, host and provision for raw instance-record reads
claude agent, operated by paul@keymail.dev
-
01d3acb67
console: the witness that every claims-off console consumer ignores a fieldless record beside a retired slot
claude agent, operated by paul@keymail.dev
-
bb171226b
console: every instance-record read goes through a judged wrapper that takes its judge from the context
claude agent, operated by paul@keymail.dev
-
7ce649e26
provision: ListRecordReplicas gains a judged sibling, and the unjudged listing is it under a nil judge
claude agent, operated by paul@keymail.dev
-
ede14218c
census: note for self-serve moves 1 Task 6b fix round 1
claude agent, operated by paul@keymail.dev
-
f7a29824c
census: self-serve moves 1 Task 6b fix round 1 re-pins Reconcile and the three judged host reads
claude agent, operated by paul@keymail.dev
-
d9c5d976b
host: the three claims-on record reads are judged readers, and the root restart source pin requires the caller's box judge
claude agent, operated by paul@keymail.dev
-
4ea911082
provision: the removal phase judges a row's own key only under a known account, and Reconcile arms its own context
claude agent, operated by paul@keymail.dev
-
57212a41b
census: self-serve moves 1 Task 6b classifies the judged reconcile, journal and box record reads
claude agent, operated by paul@keymail.dev
-
f5216bed7
host: lifetime gating witnesses: a fieldless record beside a retired slot is gone to every box consumer
claude agent, operated by paul@keymail.dev
-
cf6cbb333
host: every moves, offline-stage and run record re-read is the judged reader
claude agent, operated by paul@keymail.dev
-
9711789a2
host: one lifetime judge per box, on every pass context and every record consumer
claude agent, operated by paul@keymail.dev
-
7c8046dc6
provision: reconcile observes each record through the judge, and the removal loop judges a row by its own record key
claude agent, operated by paul@keymail.dev
-
52421ae2f
census: self-serve moves 1 Task 4 fix round 1 re-pins the cutover door and the console envelope
claude agent, operated by paul@keymail.dev
-
76bcdfbfb
console: retirement tests: the refused create names its settling sentence, and an orphan retirement crashed before O1 recovers
claude agent, operated by paul@keymail.dev
-
4b69f7b33
console: the box floor keeps seedfloor's guards: a label two reports claim refuses, a future-dated report is not fresh, and the watch's edges read is bounded
claude agent, operated by paul@keymail.dev
-
516293fa1
console: the hourly store sweep refuses what purgeOne refuses: the control plane, email estate and an estate it cannot read
claude agent, operated by paul@keymail.dev
-
286ef25b9
census: self-serve moves 1 Task 4 classifies the retirement's record writes and re-pins the root-read overlay
claude agent, operated by paul@keymail.dev
-
c78195f83
boxes publish lifetimes-1 and purge nothing claims-off; the cutover door refuses below the box floor, and the watch pages a regression hourly
claude agent, operated by paul@keymail.dev
-
01dbd4c02
console: the purge retires every lifetime of the app first, the expiry pass owns the store sweep, and restore evidence judges instance records three ways
claude agent, operated by paul@keymail.dev
-
75161c937
console: every claims-off record removal retires through a persisted retirement of a stated kind, with the caller's expectation and the owned slot retired before any absence shows
claude agent, operated by paul@keymail.dev
-
8d4615045
console: ConvertRetirementKind, the durable change of a pending normal retirement into a cleanup one
claude agent, operated by paul@keymail.dev
-
8596a764b
release: the purge's guards factored out, a sweep that keeps the keys a caller retired, and the expired-trash listing
claude agent, operated by paul@keymail.dev
-
c354c191a
provision: RetireRef states its expectation, and the judged record evidence and host listing the purge and restore settlement read
claude agent, operated by paul@keymail.dev
-
766641c02
census: self-serve moves 1 Task 5 fix round 1 re-pins the record-write inventory and the provision and console envelopes
claude agent, operated by paul@keymail.dev
-
c0e5eba3e
console: a migration adopts a marker whose operation is gone, the pass selects such records, and an idle pass waits ten minutes
claude agent, operated by paul@keymail.dev
-
99ffb4204
provision: one marker helper for the write primitive and the fence, and the updaters' marker wait ends with its context
claude agent, operated by paul@keymail.dev
-
9991e16f8
lifetimes: lazy migration marks the record by CAS, fenced in the write primitive, and never strands a marker it issued
claude agent, operated by paul@keymail.dev
-
2a75caa7f
console: lifetime create review fixes: each door's pending answer says it could not confirm, an exhausted counter is final, attach stays neutral and answers the family's 404
claude agent, operated by paul@keymail.dev
-
a2960376f
console: claims-off creates allocate an owned host incarnation through a persisted intent, with recovery that never abandons it
claude agent, operated by paul@keymail.dev
-
a27ae8a19
plan: self-serve moves 4, rev 3 (Astra plan 4 review 2: F1 to F13; Paul's cleanup-exclusion ruling: every residence change holds the hostname key in the reservation table)
claude agent, operated by paul@keymail.dev
-
a0ddb2d20
docs: self-serve moves rulings taken 2026-10-22 (Q3, cleanup exclusion, cutover, plan-2 deviation, #345 scope) and copy approved
claude agent, operated by paul@keymail.dev
-
b81a95341
console: lifetimes cutover review fixes: the docs say every change waits while lifetimes switch on, the CLI retries failed polls, a bounded test wait
claude agent, operated by paul@keymail.dev
-
76b597130
console: claim invariant reasons for the lifetime intent tables no door reaches yet
claude agent, operated by paul@keymail.dev
-
6730df5d0
console: the lifetimes cutover door, an admission gate that activation waits on, a latched on state and the CLI command
claude agent, operated by paul@keymail.dev
-
5ed73da6b
provision: lifetime judge review fixes: corrupt bodies keep the tolerant listing complete, absent-with-slot is final, a dedicated unreadable error, doc comments
claude agent, operated by paul@keymail.dev
-
81b273179
provision: the lifetime judge observes the record then the slot in bounded rounds; judged readers, listings and updates act on the observation
claude agent, operated by paul@keymail.dev
-
aac276363
console: lifetime tables review fixes: census rows, the app_lifetime exemption scoped to host_allocations, read guards, state transitions
claude agent, operated by paul@keymail.dev
-
e065b41a6
console: tables for pending allocations, retirements and migrations, classified for the gate
claude agent, operated by paul@keymail.dev
-
52c5fc2a4
plan: self-serve moves 2, rev 18 (Astra review 17: an expired request is classified whatever the record state, only the abort is pre-open; the void tolerates an abort already requested)
claude agent, operated by paul@keymail.dev
-
c8b6390f2
plan: self-serve moves 2, rev 17 (Astra review 16: an expired request dispatches to the fence first; void and abort obligation in one UPDATE; a late receipt retires the expiry; the observed cut value passed explicitly)
claude agent, operated by paul@keymail.dev
-
60e45985b
provision: census overlays for the lifetime change, restore the frozen base inventory, review fixes
claude agent, operated by paul@keymail.dev
-
220552c0b
plan: self-serve moves 2, rev 16 (Astra review 15: one expiry decision path, compared against the cut state the worker saw, with a recovery branch for a won expiry)
claude agent, operated by paul@keymail.dev
-
bc2c49864
plan: self-serve moves 2, rev 15 (Astra review 14: a durable request-expiry decision mutually exclusive with the cut; declarations completed)
claude agent, operated by paul@keymail.dev
-
267ea4fc8
provision: record lifetime fields, the owned host incarnation slot, the tombstone form and the lifetime verdict
claude agent, operated by paul@keymail.dev
-
494b51578
plan: self-serve moves 2, rev 14 (Astra review 13: the maintenance consume requires no accepted cut; the cut transfers an outstanding maintain request's deadline)
claude agent, operated by paul@keymail.dev
-
b48a5d403
plan: self-serve moves 1, rev 22 (Astra confirming review 21: the floor test refuses on a stale status report, not a stale edges file)
claude agent, operated by paul@keymail.dev
-
194a6a4f2
plan: self-serve moves 1 rev 21 (Astra review 20 READY WITH CHANGES: status-based liveness for the capability check, the Task 0 purge sentence removed) and 2 rev 13 (Astra review 12: request deadlines only for abort-expiry writes, abandonment rolls the deadline, maintenance idle has no step deadline)
claude agent, operated by paul@keymail.dev
-
435c89416
plan: self-serve moves 2, rev 12 (Astra review 11: the deadline is checked before every write attempt inside the replay loop; a same-phase consume rolls the next wait's deadline)
claude agent, operated by paul@keymail.dev
-
53d8ca78f
plan: self-serve moves 1, rev 20 (Astra review 19: the box floor is the edges-file capability lifetimes-1; old binaries after the cutover and retention's prune race declared out of scope; restore evidence split by key kind; cancellation plumbing declared)
claude agent, operated by paul@keymail.dev
-
622caa265
plan: self-serve moves 2, rev 11 (Astra review 10: monotonic proposed stamps for every writer; every request carries its own deadline so an expired open is never replayed from open-uncertain)
claude agent, operated by paul@keymail.dev
-
b31fd24fa
plan: self-serve moves 1, rev 19 (Astra review 18: claims-off boxes no longer auto-purge, the cutover refuses old boxes, materialisation under the app lock, the lifetime travels to the create helpers, declarations reconciled)
claude agent, operated by paul@keymail.dev
-
4ee5a36df
plan: self-serve moves 2, rev 10 (Astra review 9: a committed confirmation expiry wins over a later cut; the expiry carries its identity; an operator's newer stamp supersedes the job's wait)
claude agent, operated by paul@keymail.dev
-
5096e732b
plan: self-serve moves 1, rev 18 (Astra review 17: every box sweep step fenced at the marker, one app-row insertion helper mints the lifetime, marker checked under the create lock, best-effort cross-key cleanup, lock table completed, admitted startup materialisation, three-valued restore evidence)
claude agent, operated by paul@keymail.dev
-
43f269791
plan: self-serve moves 1 rev 17 (Astra review 16: app lifecycle checked under the lock, a lock table, one-transaction cancellation, apps.lifetime id, box purge fenced at the marker, purge acts only on its own slots, judged restore evidence) and 2 rev 9 (Astra review 8: reconciliation to phase and substep, abandonment only when leaving a wait, expiry committed against the cut, the handoff's substep persisted)
claude agent, operated by paul@keymail.dev
-
926659176
plan: self-serve moves 1 rev 16 (Astra review 15: one lock order app-then-hostname for create, recovery and purge; allocations bound to the app lifetime; boxes stop purging at the cutover marker; a slot-bound orphan entry) and 2 rev 8 (Astra review 7: durable substeps, receipt-only confirmation, abandonment, cut retires the ready deadline, immutable return reports, one untagged bridge file)
claude agent, operated by paul@keymail.dev
-
c119b92b6
plan: self-serve moves 1, rev 15 (Astra review 14: the purge protocol removed; purge is today's sweep with conditional record deletes, absorbed by the orphan rule and a never-replay-for-trashed-apps recovery rule)
claude agent, operated by paul@keymail.dev
-
718926e59
plan: self-serve moves 2, rev 7 (Astra review 6: a complete request lifecycle with resume and same-phase consume, incarnation in the bound write, the cut as a handoff, classified expiry fence, once-only events, per-box FIFO, return request identity and target binding, fixtures on a linux-only file)
claude agent, operated by paul@keymail.dev
-
21b34b6b6
plan: self-serve moves 1, rev 14 (Astra review 13: boxes stop purging once lifetimes are on, the console sweeps trash; a generation-bound console purge with a slot fence for pending allocations)
claude agent, operated by paul@keymail.dev
-
652cc128b
plan: self-serve moves 2, rev 6 (Astra review 5: predecessor-bound writes, a nonce receipt on every transition, stale-worker fencing, pending = no confirmed request, expired open fenced not replayed, stage book reconciled per complete round, identity by boxid.Key, return handshake bound to instance and incarnation, maintenance restage)
claude agent, operated by paul@keymail.dev
-
072fdec42
plan: self-serve moves 1, rev 13 (Astra review 12: a durable lifetimes-on marker as the boxes' authority; purge excludes instance keys from the sweep, voids pending allocations durably; the box retires by CAS only, no migration or journal)
claude agent, operated by paul@keymail.dev
-
0826600b3
plan: self-serve moves 3, rev 7 (Astra review 6: fallback when no local exact ready upstream; Hosts() keeps its self-label guard)
claude agent, operated by paul@keymail.dev
-
36c425edc
plan: self-serve moves 1 rev 12 (Astra review 11: settle anchored after the last legacy unit, marker-backed activation, lifetime-aware purge, dispatch by unit) and 3 rev 6 (Astra review 5: explicit wildcard fallback in the decision, membership on unlabelled boxes, subscribe-and-seed)
claude agent, operated by paul@keymail.dev
-
d09aadd69
plan: self-serve moves 2, rev 5 (Astra plan review 4: items 1, 4, 5, 6, 8, 10, 12, 13, 14, 17, 20, 21; self-contained; persisted requests with nonce, expected seq and proposed stamp; a move-bound stage book from observed copies; identity by box and instance; a recoverable return handshake; the bridge inside package host)
claude agent, operated by paul@keymail.dev
-
f99b9fefa
plan: self-serve moves 3, rev 5 (Astra plan review 4: F1, F2, F4, F5, F7, F10, N1 to N3; the fold is called not restated, a sorted holding fold, hold rebuilds from the latest inputs on view and Reload, dispatch exceptions kept)
claude agent, operated by paul@keymail.dev
-
98522945d
plan: self-serve moves 1, rev 11 (Astra plan review 10: findings 1 to 4; an admission gate activation waits on, a latched on state, scope-aware removal, one worker lifecycle, the CLI)
claude agent, operated by paul@keymail.dev
-
6fe2b7a39
plan: self-serve moves 3, rev 4 (Astra plan review 3: F1 to F10; holds suppress their target's stale publications and the fold decides the rest, one table per request, holds in their own snapshot, tunnel and warming kept, self-contained)
claude agent, operated by paul@keymail.dev
-
94a3828eb
plan: self-serve moves 1, rev 10 (Astra plan review 9: findings 1 to 5; a cutover mode with a drain, removal by the row's own record, a classification-aware fence)
claude agent, operated by paul@keymail.dev
-
945d7cd30
plan: self-serve moves 3, rev 3 (Astra plan 3 review 2: 14 findings; a two-stage ranking with a small-model property test)
claude agent, operated by paul@keymail.dev
amadan