amadan
Paul ruled 2026-10-24, taking every recommendation: (1) census rows accepted as proposed, the DeleteIfMatch writer included; (2) copy MV-O193..O258 and the move-capable wording approved, with the MV-O204 note widened to a box that reported without an instance id and the MV-O195 note corrected; (3) the two parked items (TryLock sweep fairness and DirStore paging; unbounded console construction on a wedged SQLite) are not fixed before the merge and become follow-up discussions; (4) rollout facts noted. Being applied on self-serve-moves-2 after plan 1's ruling commits are merged in; then CI and the inert merge.
Plan 2 (self-serve moves: door, token, reservations, reports, job) is built and Astra-READY: rulings owed open
On branch self-serve-moves-2
Plan 2 is built on self-serve-moves-2 (stacked on plan 1's e8087b49), every task review-clean, and Astra's whole-branch review reached READY at 3cae3381 after five rounds (17 findings and two new P2s fixed across four fix rounds; the ledger and the reports under .superpowers/sdd/2026-10-22-self-serve-moves-2-door-token-job/ on DOCS-T1 hold the detail). Everything is inert behind CARLOSSELFSERVE_MOVES=offline and plan 1's lifetimes cutover. What needs you:
- Census: PROPOSED-self-serve-moves-2 rows (plan14-root-reads-self-serve-moves-2.tsv and plan14SelfServeMoves2WriteCensusInventory; note docs/superpowers/notes/census-proposal-self-serve-moves-2.md). One writer, the console's return-index entry delete (DeleteIfMatch), is recorded PROPOSED in the inventory comment because the census scans Put-style writes only.
- Copy: rows MV-O193..O258 in docs/superpowers/plans/2026-10-06-moves-phase1-copy.md (O243..O258 and the "move-capable" token wording pending), plus two notes: MV-O204 "the box has not reported recently" is also said to a box that reported without an instance id yet; MV-O195's note ("not yet shown by a door") is stale, the view shows the reason now.
- Two review items parked with reasons rather than fixed: the hourly return-index sweep takes the shared mutex with TryLock (no fairness; a busy console could skip hours) and DirStore's page listing walks the whole dev store; and the console's construction stays unbounded if an abandoned SQLite read keeps the single pooled connection (the same class as every contextless startup call before this plan; the new scan's bound covers the bucket, which was the finding). Say if either should be fixed before the merge.
- Rollout facts now in the design doc: source boxes need CARLOSSELFSERVEMOVES=offline for pre-admission per-host facts, and operator returns now need them too; any active.json reservation at console start puts a claims-off console in recovery mode (the instance-token mutation doors then answer as self-serve doors until the obligations clear); return requests written before targetbox_id existed are answered by no box and must be reissued.
- CI: see #359. Twelve runs died by SIGTERM with both split packages' shards running together; the gate now runs them in waves (b4f4cfb8). The merge gate needs a green run on the tip.
Merge: inert, with you present, after plan 1's merge (plan 2 is stacked on it). Plan 3 (holding page, alias rule, probe mode) is READY at rev 7 and is next; I am starting its build on a stacked branch.