carlos / platform Public

plans 2: census overlay and record-write entry

plan14-root-reads-plans-2-box-limits (PROPOSED-plans-2-box-limits), loaded
after securelisten-337; plans2WriteCensusInventory pins plans.PutMarker as
nonrecord.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude 3 days ago 114db563cb5c1d51f07c191095832d177a9ae5df parent 6621044

4 files changed, +49 −1

internal/provision/plan14_root_reads_test.go +13 −0
internal/provision/plan9_b8_census_test.go +1 −1
internal/provision/plans2_census_test.go +12 −0
internal/provision/testdata/plan14-root-reads-plans-2-box-limits.tsv +23 −0

CI cancelled — superseded by a newer push — run details

diff --git a/internal/provision/plan14_root_reads_test.go b/internal/provision/plan14_root_reads_test.go

index 495304a7c..457833a8f 100644

--- a/internal/provision/plan14_root_reads_test.go

+++ b/internal/provision/plan14_root_reads_test.go

@@ -1118,6 +1118,19 @@ func TestPlan14RootReadCensus(t *testing.T) {

t.Fatal(err)

}

seal = "33a8ff46dd9fcf85664c42c42eaf01585af6c92806cb7830fa8f30fd0950c430"

+ // Census overlay plans-2-box-limits (boxes read account limits behind the

+ // console's plans marker; the activator's idle hook), loaded last.

+ // PROPOSED-plans-2-box-limits, asked of the census owner on #280. The new

+ // agent units read routes and two bucket objects and only narrow idle

+ // windows. Frozen declarations are added, so the seal moves;

+ // securelisten-337's is checked first.

+ if errs := checkRootReadLegacy(inv, seal); len(errs) != 0 {

+ t.Fatal(errs)

+ }

+ if err = loadRootReadInventory(filepath.Join(root, "internal/provision/testdata/plan14-root-reads-plans-2-box-limits.tsv"), &inv, true); err != nil {

+ t.Fatal(err)

+ }

+ seal = "2f933cf2a1e44e4b6bb81b139390d14476598df44c5e3eb648014cf4ce8f6801"

errs := append(compareRootReads(got, inv), checkRootReadLegacy(inv, seal)...)

errs = append(errs, checkRootReadDeclarations(got, inv)...)

if len(errs) > 0 {

diff --git a/internal/provision/plan9_b8_census_test.go b/internal/provision/plan9_b8_census_test.go

index 3a7bd7aee..3694cedd5 100644

--- a/internal/provision/plan9_b8_census_test.go

+++ b/internal/provision/plan9_b8_census_test.go

@@ -366,7 +366,7 @@ func TestPlan9B8RecordWriteCensus(t *testing.T) {

if len(got) < 100 {

t.Fatalf("census found only %d units under %s; the walk is broken", len(got), root)

}

- inventory := movesOfflinePrecopyWriteCensusInventory()

+ inventory := plans2WriteCensusInventory()

problems := append(censusDiff(inventory, got), censusPolicy(inventory)...)

if len(problems) > 0 {

t.Fatalf("record-write census rejected %d site(s); update the explicit inventory only after reviewing the source:\n %s", len(problems), strings.Join(problems, "\n "))

diff --git a/internal/provision/plans2_census_test.go b/internal/provision/plans2_census_test.go

new file mode 100644

index 000000000..e110736f5

--- /dev/null

+++ b/internal/provision/plans2_census_test.go

@@ -0,0 +1,12 @@

+package provision

+// Record-write census entry for plans-2-box-limits, layered on

+// movesOfflinePrecopyWriteCensusInventory. Reviewed by the branch author; the

+// census owner rules on #280 (PROPOSED-plans-2-box-limits).

+// - plans.PutMarker writes control/plans.json, the deployment's plans

+// marker, never an instance or sidecar record: nonrecord.

+func plans2WriteCensusInventory() []censusEntry {

+ return append(append([]censusEntry(nil), movesOfflinePrecopyWriteCensusInventory()...),

+ censusEntry{"internal/plans/marker.go", "PutMarker", "nonrecord", "sel:Put", "28e544ee616f632d5ea97c3c29247d3afd37de80192413e00c69f6bf449a1eaf"},

+ )

diff --git a/internal/provision/testdata/plan14-root-reads-plans-2-box-limits.tsv b/internal/provision/testdata/plan14-root-reads-plans-2-box-limits.tsv

new file mode 100644

index 000000000..69cb19d97

--- /dev/null

+++ b/internal/provision/testdata/plan14-root-reads-plans-2-box-limits.tsv

@@ -0,0 +1,23 @@

+# Census overlay plans-2-box-limits (boxes read account limits, marker-gated; the activator's plans idle hook; the console's plans marker), loaded LAST, after securelisten-337. PROPOSED-plans-2-box-limits, asked of the census owner on #280.

+# New units plansPass and planIdleFor run in the box agent, read their own routes' accounts and two bucket objects, and only narrow idle windows (accepted legacy at telemetrySwitches' J1 root-route disposition). Changed legacy units serve, Service.sweepOnce and Store.SetAccountPlan are re-frozen; runAgent, fastConvergeLoop and type Service are re-pinned at their authority class. Frozen declarations are added, so the seal moves.

+@legacy 4a3f9123a40261f216c850a48eca32d98415bb3ddb8ebfa5b075f3490a5ee048 internal/host/plans_pass.go planIdleFor legacy accepted-legacy accepted-legacy;rev3=PROPOSED-plans-2-box-limits;basis=root-route; the agent's plans pass reads its own routes' accounts and two bucket objects (the plans marker, each account's limits record) into a cache; planIdleFor only narrows the activator's idle window. No root decision. whole:Route@97 eea0d90d956f443a16446d17ba76312f07a26a4f5421b33cbd9c0f385801e4cc

+@legacy 55cbbc6af84bef1c0f30e8ce2b923641a4596dda7a2e251d87179e9e23268464 internal/console/accountplans.go Store.SetAccountPlan legacy accepted-legacy accepted-legacy;rev3=PROPOSED-design-plans-and-caps;basis=root-input; console SQL on its own account_plans table, as its store siblings (J4). file:QueryRow@442 36db76c1951df91bff3f8f5960434235b87b1e526c4ff91ade2c8cb8f4b01e06

+@legacy 79c61e0f627f8a0cbfa7c839bdd0469d1ba07b1628ce9f0a2a4dc683c748892f cmd/console/main.go serve legacy accepted-legacy accepted-legacy;rev3=PROPOSED-scan-demand-revival;basis=Console service wires the optional callback signer and starts the claim-guarded queue worker. The same three data path literals move; it does not add a privileged reader. data-literal@4077,data-literal@5178,data-literal@5415 cd00e0a21af9c34596afafc4f13a423c32c29f5a73b5661538e01fca7abc215c

+@legacy b8b1ea768b17492f8f99849ae8628234dde71f63b49744289216faaa6d00f6d2 internal/activator/activator.go Service.sweepOnce legacy accepted-legacy accepted-legacy;rev3=PROPOSED-seed;basis=census-ruling-FS-R6; diagnostic throttling only; registry remains legacy registry:Hibernate@12328,registry:Hibernate@21499,registry:Hibernate@5124,registry:Hibernate@6794,registry:Hibernate@9319,registry:Host@21568,registry:Host@21626,registry:Host@21998,registry:Host@22091,registry:Host@22826,registry:Host@22908,registry:Host@23973,registry:Host@24152,registry:Host@24201,registry:NextDue@22781,registry:Status@21515,whole:Route@12330,whole:Route@14263,whole:Route@15973,whole:Route@16163,whole:Route@16456,whole:Route@16628,whole:Route@16775,whole:Route@20986,whole:Route@22495,whole:Route@22835,whole:Route@22842,whole:Route@23788,whole:Route@24185,whole:Route@5126,whole:Route@6796,whole:Route@7230,whole:Route@9321 fa0ced864fd598142b3f93ecd05a8f28ea85da83a0e8f9f056f37f1a6def42fb

+@legacy d2cade56a6bc0ca1548606b498dc790d64c56ef9c6e262311402694b035c4e84 internal/host/plans_pass.go plansPass legacy accepted-legacy accepted-legacy;rev3=PROPOSED-plans-2-box-limits;basis=root-route; the agent's plans pass reads its own routes' accounts and two bucket objects (the plans marker, each account's limits record) into a cache; planIdleFor only narrows the activator's idle window. No root decision. registry:Kind@730,whole:Route@716,whole:Route@799 bff074ac29590786b241088b74b85bd4955da411c5abfa5ae514e7b9e207215f

+cmd/console/main.go serve legacy accepted-legacy accepted-legacy;rev3=PROPOSED-scan-demand-revival;basis=Console service wires the optional callback signer and starts the claim-guarded queue worker. The same three data path literals move; it does not add a privileged reader. data-literal@4077,data-literal@5178,data-literal@5415 cd00e0a21af9c34596afafc4f13a423c32c29f5a73b5661538e01fca7abc215c

+internal/activator/activator.go Service.sweepOnce legacy accepted-legacy accepted-legacy;rev3=PROPOSED-seed;basis=census-ruling-FS-R6; diagnostic throttling only; registry remains legacy registry:Hibernate@12328,registry:Hibernate@21499,registry:Hibernate@5124,registry:Hibernate@6794,registry:Hibernate@9319,registry:Host@21568,registry:Host@21626,registry:Host@21998,registry:Host@22091,registry:Host@22826,registry:Host@22908,registry:Host@23973,registry:Host@24152,registry:Host@24201,registry:NextDue@22781,registry:Status@21515,whole:Route@12330,whole:Route@14263,whole:Route@15973,whole:Route@16163,whole:Route@16456,whole:Route@16628,whole:Route@16775,whole:Route@20986,whole:Route@22495,whole:Route@22835,whole:Route@22842,whole:Route@23788,whole:Route@24185,whole:Route@5126,whole:Route@6796,whole:Route@7230,whole:Route@9321 fa0ced864fd598142b3f93ecd05a8f28ea85da83a0e8f9f056f37f1a6def42fb

+internal/console/accountplans.go Store.SetAccountPlan legacy accepted-legacy accepted-legacy;rev3=PROPOSED-design-plans-and-caps;basis=root-input; console SQL on its own account_plans table, as its store siblings (J4). file:QueryRow@442 36db76c1951df91bff3f8f5960434235b87b1e526c4ff91ade2c8cb8f4b01e06

+internal/host/agent.go fastConvergeLoop authority B3 rev3=census-ruling-moves-offline;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body (census-ruling-carlos-run) with the offline keep view read before the first reconcile pass (refreshOfflineView); read sites unchanged, offsets moved; main's B3 authority retained whole:Route@8952,whole:Route@9515 ed8b3b75914b7cfaf62e694556f6cbcf0b85bbfb8a662b6da38cf1df6f94eafb

+internal/host/agent.go runAgent authority B,C,D,F rev3=census-ruling-seeded-instances;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body with wireSeedPlacement called in the activator start's Configure step, before armMovesPass, and the startup sweep's result stored for the import rollback in Recover; read sites unchanged, offsets moved; main's B,C,D,F authority retained PROPOSED E46: captured claim selection and root journal mutation; root RPC outside service host exclusion; SQL/route data never grants root authority. Executing identity: service controller; root for inventory/retirement callbacks.;rev3=PROPOSED-325;identity=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos);basis=passes the agent's log sink to armRunsPass; reads unchanged file:Exec@13802,file:Open@731,registry:App@10065,whole:Route@10057,whole:Route@23351 49319d24c62ebd37444d3e7d9a2e78f2dab25ff803eeb10bfa88d4a8ca7775fd

+internal/host/plans_pass.go planIdleFor legacy accepted-legacy accepted-legacy;rev3=PROPOSED-plans-2-box-limits;basis=root-route; the agent's plans pass reads its own routes' accounts and two bucket objects (the plans marker, each account's limits record) into a cache; planIdleFor only narrows the activator's idle window. No root decision. whole:Route@97 eea0d90d956f443a16446d17ba76312f07a26a4f5421b33cbd9c0f385801e4cc

+internal/host/plans_pass.go plansPass legacy accepted-legacy accepted-legacy;rev3=PROPOSED-plans-2-box-limits;basis=root-route; the agent's plans pass reads its own routes' accounts and two bucket objects (the plans marker, each account's limits record) into a cache; planIdleFor only narrows the activator's idle window. No root decision. registry:Kind@730,whole:Route@716,whole:Route@799 bff074ac29590786b241088b74b85bd4955da411c5abfa5ae514e7b9e207215f

+internal/activator/activator.go type Service authority B,C,D,F,J4 rev3=PROPOSED-seed; existing activator lifecycle and due-wake state plus owned seed exclusion and incarnation-keyed diagnostics; normal refusal and preparation ordering remain authoritative; PROPOSED-plans-2-box-limits adds the idleFor hook field, which only narrows idle windows 861dda6f11a641d800eadd5fbc368275ef7fe80e35e644dd01d4e0818c38f90e

+@coverage cmd/console 2806528d2f4a9d8394ed1f1ac8cea4723508ae2ad92589679beeeca577160de9

+@coverage internal/activator 18c8b9ef915ac60ccb296a1b4f8fce5ce1c02ee2643b361a0db0a3020d68395b

+@coverage internal/console 28f91f42431fcaf42f9012fa61bcc629a4b1e2639248185365712938f410f960

+@coverage internal/edge 62bb20932803aa2acdb45b2aab0db6540adc5a5a2f4dc954b1338c30fb73ce2b

+@coverage internal/host d6b108015efdef220eb57a90e14ad07869031d1d14bd2d03a9f70ddbd4052e04

+@coverage internal/hostenv 3981869abecec66e019134cc6485b14282920929032271bc2012c6d582acf1b5

+@coverage internal/hostops 7c833e33c02faa9c7a04000f708b9d9583ad0c1590ff9c8b51994f29450caf17

+@coverage internal/plans 7de3345c04504076ff5ac23f823f17d5901db261ba52db269c08d4b8d51b0f00