carlos / platform Public

An app's platform apex is its own — whichever arrives first. Fixes discussion 153.

<app>.<sqid>.<AppsDomain> belongs to that app. If anything else holds a route there, the domains pass defers to it for ever, so the app never gets its own URL — and carlos email events push would post its recipients' addresses to whoever holds it.

Closed at every door

1. Instances create refuses a sibling's apex while the sibling is live or trashed (one query, Store.AppNameState); a purge frees the label. After writing the record it re-reads the label and takes the record back if the name arrived in between.
2. App create (CLI and browser), rename, move ask apex.go's apexHolder: a route at the host that is not the name's own (its app is not the name, or it serves another account, or it names no app at all), or an instance record there under any other app, live or trashed. It fails closed and returns who holds it, so each door words one refusal with advice that fits. Rename re-checks the new name's apex after committing; move's check has a deadline.

Existing squats

Reported, not repaired: at boot the console logs every route at an app's apex (live or trashed) that is not that app's own, by the same test.

Tests

Instances door with a trashed/restored/purged sibling; create over a sibling's record, a bare route, an app-less route, another account's route, and a trashed sibling's record; re-create after purge; rename and move refused before their cards; the startup report. Each checked to fail with its check removed. The two post-write race re-checks have no test (no seam between check and write). Docs: carlos apps and carlos instances say what is refused.