amadan

carlos / platform Public

provision: census rows for Task 8 (PROPOSED-self-serve-moves-2): the open record, the return request and report, their readers, five accepted-legacy units, two re-pins

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
claude 1b85241d0ef959ce671acf540c46427887d34e0d parent 9d6c192
4 files changed, +72 −10
  • docs/superpowers/notes/census-proposal-self-serve-moves-2.md +4 −0
  • internal/provision/plan14_root_reads_test.go +7 −2
  • internal/provision/self_serve_moves2_census_test.go +42 −0
  • internal/provision/testdata/plan14-root-reads-self-serve-moves-2.tsv +19 −8
diff --git a/docs/superpowers/notes/census-proposal-self-serve-moves-2.md b/docs/superpowers/notes/census-proposal-self-serve-moves-2.md
index e212e8a29..4fc2c875a 100644
--- a/docs/superpowers/notes/census-proposal-self-serve-moves-2.md
+++ b/docs/superpowers/notes/census-proposal-self-serve-moves-2.md
@@ -33,3 +33,7 @@ Task 5 fix round 2 adds no root read and moves no seal. `reserveBoxes` now accep
Task 7 (the job from requested to ready, and its reconciliation) adds no root read, class or task. In the root-read overlay nine accepted-legacy units are added under `rev3=PROPOSED-self-serve-moves-2`, each with a reviewed one-line basis, and frozen, so the seal moves: `newRequestNonce` (crypto/rand for a request's nonce, the receipt the job's record write carries), `targetDataPaths` (the `/data` literal of the fact set the job requires of a target's ready report; it reads no file), `selfServePhaseDeadline` (its matched `Open` is `est.Open`, the estimate's open term, a duration) and six console SQLite statements of the journal running as `carlos-console` (`AbortSelfServe`, `AdvanceSelfServeToStep`, `ConsumeSelfServeMaintenance`, `ExpireSelfServeRequest`, `VoidExpiredSelfServeRequest` and `issueSelfServeRequest`). `AdvanceSelfServe` and `IssueSelfServeRequest` remain declared with no direct read (their statements moved into `AdvanceSelfServeToStep` and `issueSelfServeRequest`, which they call; both changed: the advance also stamps `staging_started_at` entering staging and `next_maintenance_at` entering ready in the same statement, and `IssueSelfServeRequestWithDeadline` sets the round's step deadline with the request), so their Task 4 rows are removed under a proposed H3 disposition, as Task 10a removed `statusTick`'s. The internal/console envelope is re-pinned in place. The job reads the record only through `observeRecord` and `fenceRecord`, judged under the context's judge (`TestNoUnjudgedRecordReads` stays green). In the record-write inventory `Server.selfServeRun` is added as a record-writer (`key:SetRecordMoveAt`): every transition the job writes (the queue, queued-to-staging, the restages and maintenance rounds, the precheck, the estimate, the abort, the queued abort and the abort's finish) is one `SetRecordMoveAt` bound to the incarnation and record_seq persisted with the request, under the lease's write context. Paul's ruling is still outstanding.
Task 7 fix round 1 adds no root read, class or task. `offlineClaimEvidence` and `participantIdentityFor` are re-pinned in place with their bases extended: their unreadable refusals are now built with `offlineRefusal.transient` set (the job waits a transient refusal out rather than aborting), and every door's answer, status and sentence is unchanged; their read sites are unchanged and their offsets moved, so the seal moves. The internal/console envelope is re-pinned in place. The two Task 7 removals' bases are corrected: `AdvanceSelfServeToStep` also stamps `staging_started_at` and `next_maintenance_at` (a changed behaviour of `AdvanceSelfServe`), and `issueSelfServeRequest` gains the variant that sets the round's step deadline. The record-write inventory is unchanged. Paul's ruling is still outstanding.
+
+Task 8 (the cut, the abort, the finaliser, paging and the operator return) adds no root read, class or task, and no record write: every transition of the cut (the start, the seal, the flip, the open, both finishing gates, the finish and the abort after the start) is `selfServeRun`'s one bound `SetRecordMoveAt`, unchanged. In the root-read overlay five accepted-legacy units are added under `rev3=PROPOSED-self-serve-moves-2`, each frozen with a one-line basis: `firstDataPath` (the data directory a return-ready report names, a literal), `Server.probeTarget` (the health probe's random value from crypto/rand; the probe is an HTTPS request to the target box), `Store.SetSelfServeStep` (one journal UPDATE), `BoxHandle.RenderHeldConfig` (the end-to-end bridge's config-sync stand-in, tests only) and `movesWorker.returnLeftovers` (the box lists its own park and nested directories by name for a completed forward). `Store.AdvanceSelfServeToStep` and `Store.FinishSelfServeMove` are re-pinned in place with their bases extended (a finished row is never advanced; the outcome sets phase done, clears the open record owed and waits for an unconfirmed request to be resolved). The `internal/console`, `internal/host`, `internal/moves` and `internal/provision` envelopes are re-pinned in place, and the seal moves to `0e8b1e1c…`. In the record-write inventory the new write shapes are: the open record (`offlineOpenRecord`, foreign-recordkey: `OpenRecordKey` matches the census's record-key suffix and the `Put` is direct, create-only, of `control/offline-moves/<host>/<id>/open.json`, never an instance record), the operator return's request (`handleAPIInstanceOfflineReturn`, nonrecord, create-only under `<forward id>/return/`) and the box's return-ready report (`answerReturn`, nonrecord, create-only under `<forward id>/reports/`). Three key-sites read without writing: `readOfflineEvidence` (it skips the open record and the return keys), `readOpenRecord` and the box's `scanReturns` (the return listing, a root read of the deployment bucket's `control/offline-moves/` prefixes by an agent that lists them by name). `registerCLIRoutes` is re-pinned as a key-site for the return door's route. `TestNoUnjudgedRecordReads` stays green: the job's new record reads are `observeRecord` (the orphan reservation scan) and `selfServeRecordOf` over it; the box's return step reads the instance record with `provision.GetRecord`, as its other offline steps do.
+
+Also on Task 8's branch: `targetDataPaths` names the raw nested directory through `internal/layout`'s `RawInstanceDir` (the same path; `TestRawInstancesDirectoryIsNamedOnlyHere` failed on CI at `c9822492`), re-pinned in place with its frozen declaration, which moved the seal once before Task 8's own rows.
diff --git a/internal/provision/plan14_root_reads_test.go b/internal/provision/plan14_root_reads_test.go
index 06ad5df50..94b729630 100644
--- a/internal/provision/plan14_root_reads_test.go
+++ b/internal/provision/plan14_root_reads_test.go
@@ -1340,8 +1340,13 @@ func TestPlan14RootReadCensus(t *testing.T) {
// transient), which moves it again. A fix on Task 8's branch re-pins
// targetDataPaths in place (the raw nested directory named through
// internal/layout's RawInstanceDir, TestRawInstancesDirectoryIsNamedOnlyHere),
- // which moves it again.
- seal = "a93ef0c9850cb7b9485ba01c108d2d2bbb0a83e66961b8b0e689d34ed5b182cb"
+ // which moves it again. Task 8 (the cut, abort, finaliser, paging and
+ // the operator return) adds five accepted-legacy units (the return
+ // mode's data directory, the health probe's random value, the substep
+ // statement, the bridge's config render and the box's leftovers
+ // listing) and re-pins AdvanceSelfServeToStep and FinishSelfServeMove
+ // in place, which moves it once more.
+ seal = "0e8b1e1cbef8bf940ce76010f09e0a646c635221d57d7bde856153932016c60a"
errs := append(compareRootReads(got, inv), checkRootReadLegacy(inv, seal)...)
errs = append(errs, checkRootReadDeclarations(got, inv)...)
if len(errs) > 0 {
diff --git a/internal/provision/self_serve_moves2_census_test.go b/internal/provision/self_serve_moves2_census_test.go
index e54f4ef5c..16875cbfe 100644
--- a/internal/provision/self_serve_moves2_census_test.go
+++ b/internal/provision/self_serve_moves2_census_test.go
@@ -127,6 +127,38 @@ package provision
// guard). The job's fence goes through fenceRecord (lifetimes_create.go,
// unchanged), and the reservations through reserveBoxes and
// releaseBoxes (unchanged).
+//
+// Task 8 (the cut, abort, finaliser, paging and the operator return): no
+// record write is added or made raw; every transition of the cut (start,
+// seal, flip, open, both finishing gates, the finish, the abort) is
+// selfServeRun's one bound write, unchanged. Six units are added, one
+// re-pinned.
+// - apiinstancemove_offline.go:Server.offlineOpenRecord is added,
+// foreign-recordkey (key:OpenRecordKey,sel:Put; OpenRecordKey matches
+// the census's record-key suffix, and the Put is direct): the open
+// record,
+// control/offline-moves/<host>/<id>/open.json, written create-only
+// (Put with no ETag) before the open by the operator open door and the
+// job alike, then read back on a conflict; never an instance record.
+// - apiinstancemove_offline.go:Server.readOfflineEvidence is added, a
+// key-site (key:OpenRecordKey): it skips the open record (and the
+// return keys) when it lists a move's reports; it writes nothing.
+// - offlinereturn.go:Server.handleAPIInstanceOfflineReturn is added,
+// nonrecord (sel:Put): the operator return's request,
+// control/offline-moves/<host>/<forward id>/return/<requested_at
+// nanos>-<console id>-<8 hex>.json, create-only; never a record.
+// - offlinereturn.go:Server.readOpenRecord is added, a key-site
+// (key:OpenRecordKey): it reads the forward's open record.
+// - movesoffline_return.go:movesWorker.answerReturn is added, nonrecord
+// (sel:Put): the box's return-ready report,
+// control/offline-moves/<host>/<forward id>/reports/return-ready-<box
+// id>-<request key>.json, create-only (a conflict is the request
+// answered); never a record.
+// - movesoffline_return.go:movesWorker.scanReturns is added, a key-site
+// (key:OpenRecordKey): it reads the forward moves' open records.
+// - authcli.go:Server.registerCLIRoutes stays a key-site and is
+// re-pinned: it registers the return door beside the other offline
+// doors.
func plan14SelfServeMoves2WriteCensusInventory() []censusEntry {
removed := []struct{ file, unit string }{
{"internal/console/apiinstancemove.go", "Server.handleAPIInstanceMoveRequest"},
@@ -140,6 +172,7 @@ func plan14SelfServeMoves2WriteCensusInventory() []censusEntry {
{"internal/host/movesoffline_seal.go", "movesWorker.offlineKeepStop"},
{"internal/host/movesoffline_seal.go", "movesWorker.offlineTakeSeal"},
{"internal/lease/mirror.go", "MirrorPrefixKeep"},
+ {"internal/console/authcli.go", "Server.registerCLIRoutes"},
}
added := []censusEntry{
{"internal/console/apiinstancemove.go", "Server.handleAPIInstanceMoveRequest", "record-writer", "key:SetRecordMove,lit:instances", "6be4b2d5ed59e3e42c47589039daba2cdb4081db45e0258d8889ef8477290591"},
@@ -170,6 +203,15 @@ func plan14SelfServeMoves2WriteCensusInventory() []censusEntry {
{"internal/host/e2e_bridge.go", "const sealPrefix", "reference", "lit:instances", "c78134a7cd1306c1655db52559840e9e94956991b4a83d27521801fa85ad566c"},
// Task 7: the job's one record write, every transition through it.
{"internal/console/selfserve_apply.go", "Server.selfServeRun", "record-writer", "key:SetRecordMoveAt", "748c29c143e8bba836a9ba5fcf11db3170b12e54450ae6931449900f663dc2bb"},
+ // Task 8: the open record, the operator return's request and
+ // report, their readers, and the return door's route.
+ {"internal/console/apiinstancemove_offline.go", "Server.offlineOpenRecord", "foreign-recordkey", "key:OpenRecordKey,sel:Put", "8a192083d237fbf7489ac900f03da62c854dfc521ccaa31d5cc8fc7d73b2d5d7"},
+ {"internal/console/apiinstancemove_offline.go", "Server.readOfflineEvidence", "key-site", "key:OpenRecordKey", "09b3dd97c2e4fb9828d04e09a451a4380b1a9dc321640f6d57f18a217547af12"},
+ {"internal/console/offlinereturn.go", "Server.handleAPIInstanceOfflineReturn", "nonrecord", "sel:Put", "166c1282a02472a2105220bfbf553ded1a59717a78939ed20c3a86c48ba41c1e"},
+ {"internal/console/offlinereturn.go", "Server.readOpenRecord", "key-site", "key:OpenRecordKey", "809cf07d965d8bd136a1d463e5df3c435c086598359432630fa9d5fea6cd8950"},
+ {"internal/host/movesoffline_return.go", "movesWorker.answerReturn", "nonrecord", "sel:Put", "40b7135d8f91e7606c3b9c20d80a00e364b34e7547273ed88f192249fa19a0d8"},
+ {"internal/host/movesoffline_return.go", "movesWorker.scanReturns", "key-site", "key:OpenRecordKey", "59ccfef1e3cb9f7abb5d4f6e553ccb23bc83ebf1d2a41533247b16ac50ce6ad9"},
+ {"internal/console/authcli.go", "Server.registerCLIRoutes", "key-site", "lit:instances,lit:sidecars", "0af692569c69daef180738395057594bd8413fdf6d9e1c4cc91f0a924ab3ef7b"},
}
entries := plan14SelfServeMoves1WriteCensusInventory()
for _, r := range removed {
diff --git a/internal/provision/testdata/plan14-root-reads-self-serve-moves-2.tsv b/internal/provision/testdata/plan14-root-reads-self-serve-moves-2.tsv
index 4cbc91bc0..bcb2fbe71 100644
--- a/internal/provision/testdata/plan14-root-reads-self-serve-moves-2.tsv
+++ b/internal/provision/testdata/plan14-root-reads-self-serve-moves-2.tsv
@@ -21,10 +21,10 @@ internal/console/templates/settings.html external legacy accepted-legacy accepte
# Task 2 (the queued state, the receipts, the caller's stamps, the bound write and the open record), rev3=PROPOSED-self-serve-moves-2: no root read, class or task is added. offlineBegin (the shared body of OfflineStart, OfflineStage and now OfflineQueue) is re-pinned in place with a reviewed basis and takes a new frozen fingerprint, which moves the seal; its one site moved. The other new transitions, ProposeStamp, Receipt, SetRecordMoveAt and moves.OpenRecordKey read no file. Envelopes re-pinned: internal/console (the operator doors propose their stamps, the queued state in the verb and the view, the abort door's OfflineAbortAt; Task 1's row replaced in place), internal/moves (OpenRecord, OpenRecordKey) and internal/provision (the record fields, the transitions, the bound write). The new record fields need no @fields row: the census's field rule covers internal/registry structs only.
@legacy 94b21acdfb6eb3f8ee0a3dd937605e18edd852766f1091d7d664e4bc566f4ad2 internal/provision/offline_move.go offlineBegin legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=root-input (J4, as OfflineStart); the console (cmd/console serve under console.service, user carlos-console): self-serve moves 1 Task 7's body (OfflineStart's, the state a parameter; a direct start advances move_seq and stamps move.seq, refusing ErrLifetimeExhausted at MaxInt64 before any write), and it now also creates the self-serve move in offline-queued for OfflineQueue (queued_at, staged_at and precheck_at at the caller's stamp, move.seq set to the record's move_seq, no advance) and records return_of; a stage and a queue hold nothing; its one site is still rec.ActiveRun.Open(), a method on the record's run state (RunState.Open), not a file read; self-serve moves 2 Task 2 file:Open@208 0a9b432ddf2f39a977c0651e377258b35c1d05635e9979583eeac6253d6c0ec8
internal/provision/offline_move.go offlineBegin legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=root-input (J4, as OfflineStart); the console (cmd/console serve under console.service, user carlos-console): self-serve moves 1 Task 7's body (OfflineStart's, the state a parameter; a direct start advances move_seq and stamps move.seq, refusing ErrLifetimeExhausted at MaxInt64 before any write), and it now also creates the self-serve move in offline-queued for OfflineQueue (queued_at, staged_at and precheck_at at the caller's stamp, move.seq set to the record's move_seq, no advance) and records return_of; a stage and a queue hold nothing; its one site is still rec.ActiveRun.Open(), a method on the record's run state (RunState.Open), not a file read; self-serve moves 2 Task 2 file:Open@208 0a9b432ddf2f39a977c0651e377258b35c1d05635e9979583eeac6253d6c0ec8
-@coverage internal/provision 42588b9f64803b41c4463efb31e69fda0fc66573efd5d6a2d6e709682eeca385
+@coverage internal/provision d018e5699137db933be2142f7526d0d1d10b08170525886bd9c424cde5578b55
# Task 3 (per-box reservations with a legacy projection and a sentinel, the fenced reclaim and the operator doors' bound admission), rev3=PROPOSED-self-serve-moves-2: no root read, class or task is added and no accepted-legacy unit is re-pinned, so the seal does not move. The new units (moves.ParseOfflineActive, moves.OfflineActiveBody, the console's offlinereserve.go, the doors' offlineApplyBound and offlineAdvanceBound) read no file: their reads are the bucket's control/offline-moves/active.json and the instance record through the judged readers and fenceRecord. Envelopes re-pinned in place (Task 2's rows replaced): internal/console (offlinereserve.go, the start and stage doors, the Server's two evidence fields) and internal/moves (the reservation table in offline.go).
-@coverage internal/console 1faf074150c207d1ee81ae9e8f18fa73a72ae944f7a47f48f69c6fb9c957df29
-@coverage internal/moves 6a68b01ef865d9356bb19971f4cd4a61f7694769b63cee1d8234f615d5e9c8ba
+@coverage internal/console e71517c2d451201566c305ed32f1366262b62c6db794350303e2a37c5b3ed441
+@coverage internal/moves 5206525d3a710f5e9c2cb2b320a14e7f3243d7702fa875eaf1bb7364cf8829cb
# Task 4 (the journal, the events table, the console lease and the pass skeleton), rev3=PROPOSED-self-serve-moves-2: no root read, class or task is added. The console SQLite journal (selfserve_store.go) adds twenty-two units, each frozen accepted-legacy with a reviewed basis (console SQL as carlos-console, no bucket or root action), and the lease's console name adds one crypto/rand read (Server.selfServeConsoleID); serve (in place: the paging arm takes the store, the pass is started), NewServer (the row evidence and the recovery-mode scan) and Store.migrate (migrateSelfServe) are re-pinned. The seal moves. The lease and the pass read control/offline-moves/console.json and active.json from the bucket, not a file. Envelopes re-pinned in place: cmd/console, internal/console and internal/provision (WithWriteGuard in WriteRecord).
@legacy a8dd51a494ab3cd2ad371ded2850b6d78492569729527ea82cd8dd0f2b418a78 internal/console/selfserve_lease.go Server.selfServeConsoleID legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: reads crypto/rand once per process for the random console name the self-serve moves lease carries; randomness grants no root authority file:Read@110 3303b18ec5c77ccaf662064801f94276bfe947c31378cc1ecb8c4fe509d5d4d1
internal/console/selfserve_lease.go Server.selfServeConsoleID legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: reads crypto/rand once per process for the random console name the self-serve moves lease carries; randomness grants no root authority file:Read@110 3303b18ec5c77ccaf662064801f94276bfe947c31378cc1ecb8c4fe509d5d4d1
@@ -39,8 +39,8 @@ internal/console/selfserve_store.go Store.AdmitSelfServeMove legacy accepted-leg
internal/console/selfserve_store.go Store.ConfirmSelfServeRequest legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: marks a self-serve request confirmed, predicated on its nonce and unconsumed, unvoided, unconfirmed flags; no bucket or root action file:Exec@221 811edad437cdf69f10bd91c33daa7330bfdf92934ef10c9b7e61ba01b62e4f94
@legacy 95da6de389a580fa5c0802c37d9409f171f34d1b756765ffa962087687aa679b internal/console/selfserve_store.go Store.ConsumeSelfServeRequest legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: consumes a confirmed self-serve request with the next substep and deadline, predicated on its nonce; no bucket or root action file:Exec@122 56964152a1adc56490a602c9649b40affee2e11b86ee48200721e9e24ca95229
internal/console/selfserve_store.go Store.ConsumeSelfServeRequest legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: consumes a confirmed self-serve request with the next substep and deadline, predicated on its nonce; no bucket or root action file:Exec@122 56964152a1adc56490a602c9649b40affee2e11b86ee48200721e9e24ca95229
-@legacy 30032f05c9b16baf962ad740663f1bb176db19df4e0a597d9a91a62a1b6c43c0 internal/console/selfserve_store.go Store.FinishSelfServeMove legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: records a self-serve row's outcome, consumes its confirmed request and inserts the terminal event in one SQLite transaction, only while the row has no outcome; no bucket or root action file:Exec@290,file:QueryRow@743 c1a5cc032c23ac2ebfe7fccebdd88a8912c2063f59fffe5369081186d817d0a6
-internal/console/selfserve_store.go Store.FinishSelfServeMove legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: records a self-serve row's outcome, consumes its confirmed request and inserts the terminal event in one SQLite transaction, only while the row has no outcome; no bucket or root action file:Exec@290,file:QueryRow@743 c1a5cc032c23ac2ebfe7fccebdd88a8912c2063f59fffe5369081186d817d0a6
+@legacy 2af004d044f348306bcea936da03941d474ba305eb23a04687947890ad7e8d15 internal/console/selfserve_store.go Store.FinishSelfServeMove legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: records a self-serve row's outcome, consumes its confirmed request and inserts the terminal event in one SQLite transaction, only while the row has no outcome; no bucket or root action; self-serve moves 2 Task 8: the statement also sets phase done and clears open_record_pending, and refuses a row whose request is unconfirmed file:Exec@290,file:QueryRow@922 b8171ea50d77204a37e862edb065384ed466b9ed1191a3b17bf1b536d84ce550
+internal/console/selfserve_store.go Store.FinishSelfServeMove legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: records a self-serve row's outcome, consumes its confirmed request and inserts the terminal event in one SQLite transaction, only while the row has no outcome; no bucket or root action; self-serve moves 2 Task 8: the statement also sets phase done and clears open_record_pending, and refuses a row whose request is unconfirmed file:Exec@290,file:QueryRow@922 b8171ea50d77204a37e862edb065384ed466b9ed1191a3b17bf1b536d84ce550
@legacy 888bde94f97959ae38336fc48530f9dd76532faea049743f1f57bee01550a20a internal/console/selfserve_store.go Store.HostHasIssuedRequest legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: counts a host's self-serve rows with an issued request still in flight, for the reservation reclaim rule; no bucket or root action file:QueryRow@96 a0fef5ee78031bafdbebd06f2268011a2f2d4f700c01617d04da596ce40c8c89
internal/console/selfserve_store.go Store.HostHasIssuedRequest legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: counts a host's self-serve rows with an issued request still in flight, for the reservation reclaim rule; no bucket or root action file:QueryRow@96 a0fef5ee78031bafdbebd06f2268011a2f2d4f700c01617d04da596ce40c8c89
@legacy 09a6b77755e93a3002743007c6689309f6c40cd5308c15da53cfbc7dae6e2c7e internal/console/selfserve_store.go Store.IssueSelfServeRequest legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: persists one request on a self-serve row, predicated on its phase, no outcome and no unconsumed request; no bucket or root action file:Exec@541 39cee79531f56be7080e0e8a030d7913a19554034b19118050d7a55ecb249e86
@@ -124,7 +124,7 @@ internal/host/movespass.go armOffline legacy accepted-legacy accepted-legacy;rev
internal/host/probes.go stagePathActive legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=root-input (J4, as configPathActive): systemctl is-active carlos-stage.path for the precheck's and the ready report's stage-path fact; self-serve moves 2 Task 6 file:Command@42 f7cbe0e2ba971d201f8fc7111eb4cebac9c9bae14cc826366c06b9e8bd3eecb8
@legacy 6febdffd5ed3a46ca7c8296e2bf12d8249561e26ab6479eb672f40a96b13f0f4 internal/status/snapshot.go CollectBox legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=root-route; self-serve moves 2 Task 6: carries Probes.BoxID, Lanes and Hosts into the private BoxMetrics only (never the public feed); read sites unchanged, offsets moved registry:Alias@4465,registry:CertExpiresAt@3160,registry:CertExpiresAt@3396,registry:CertExpiresAt@4580,registry:DBPath@2495,registry:DBPath@2553,registry:DNSCheckedAt@3365,registry:DNSCheckedAt@4549,registry:DNSStatus@3139,registry:DNSStatus@3334,registry:DNSStatus@4519,registry:Hibernate@3853,registry:Host@2295,registry:Host@2437,registry:Host@2666,registry:Host@3280,registry:Host@3315,registry:Host@4500,registry:Kind@2473,registry:Kind@3807,registry:Platform@2152,registry:ServingVersion@2324,registry:ServingVersion@2447,registry:Socket@3988,registry:Version@2186,registry:Version@2305,whole:Route@1581,whole:RouteAlias@4362 e874e3166d22d437b4d4daf2b1dc8b2d56bc853076cc132b9b2c1d30f9a2b1be
internal/status/snapshot.go CollectBox legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=root-route; self-serve moves 2 Task 6: carries Probes.BoxID, Lanes and Hosts into the private BoxMetrics only (never the public feed); read sites unchanged, offsets moved registry:Alias@4465,registry:CertExpiresAt@3160,registry:CertExpiresAt@3396,registry:CertExpiresAt@4580,registry:DBPath@2495,registry:DBPath@2553,registry:DNSCheckedAt@3365,registry:DNSCheckedAt@4549,registry:DNSStatus@3139,registry:DNSStatus@3334,registry:DNSStatus@4519,registry:Hibernate@3853,registry:Host@2295,registry:Host@2437,registry:Host@2666,registry:Host@3280,registry:Host@3315,registry:Host@4500,registry:Kind@2473,registry:Kind@3807,registry:Platform@2152,registry:ServingVersion@2324,registry:ServingVersion@2447,registry:Socket@3988,registry:Version@2186,registry:Version@2305,whole:Route@1581,whole:RouteAlias@4362 e874e3166d22d437b4d4daf2b1dc8b2d56bc853076cc132b9b2c1d30f9a2b1be
-@coverage internal/host dcbce8442d06fb58a01b7d82a99c0798ca16789504cbb6f043c4ed1ab5e19f67
+@coverage internal/host c5aa167f6a692d75fb65726e2f0fa2dfa30267004a9406518f9854434f0993c0
@coverage internal/lease 7e2a4a3652f964aaf1ee32356d2538a292c66ee0aaf9e622cf087b644aeaaa61
@coverage internal/status 6bf65bf3b04fdc150e2ec35d2d0d67046cf37b7c60a9dcde1c2204b75bcf8d2b
# Task 6 fix round 1 (the import cycle internal/park's tests saw), rev3=PROPOSED-self-serve-moves-2: PlacementMatches moves into internal/regionname (park.PlacementMatches delegates to it, unchanged in behaviour) so internal/moves no longer imports internal/park; no root read is added or moved. Envelopes: internal/moves in place, internal/park and internal/regionname added.
@@ -178,8 +178,8 @@ internal/console/selfserve_checks.go targetDataPaths legacy accepted-legacy acce
internal/console/selfserve_job.go selfServePhaseDeadline legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: computes a phase's step deadline from the row's estimate terms (the matched Open is est.Open, the open term, a duration); reads no file file:Open@709 defa48814bd678c1ededf52d12176d2ddddc8a9096f91f1fb94153a6f76146f6
@legacy 9f0761052e7df8711c17427d8d66fde2ae6a36592d59c11ce95963e774202cdf internal/console/selfserve_store.go Store.AbortSelfServe legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: records the job's own abort decision on one open self-serve row (abort_requested_at, outcome_reason, reason), predicated on no outcome and no abort yet; no bucket or root action file:Exec@207 165d536f9be74472c8f01e9a50b7a97d793c8f5731db091695202fe8eeaa8aeb
internal/console/selfserve_store.go Store.AbortSelfServe legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: records the job's own abort decision on one open self-serve row (abort_requested_at, outcome_reason, reason), predicated on no outcome and no abort yet; no bucket or root action file:Exec@207 165d536f9be74472c8f01e9a50b7a97d793c8f5731db091695202fe8eeaa8aeb
-@legacy 283c769d76ae9ae8396c0bfbfbf9063020cdac72da0e06234d628e9cb8aaa5ba internal/console/selfserve_store.go Store.AdvanceSelfServeToStep legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: AdvanceSelfServe's UPDATE and phase event with the substep a parameter (reconciliation's entry, the cut handoff's adopted or issue) and staging_started_at and next_maintenance_at in the same statement, in one SQLite transaction; no bucket or root action file:Exec@344 b039fe9a8cc177de8d4f6acbc588911de2c9af4f5697da08274a9df690206f79
-internal/console/selfserve_store.go Store.AdvanceSelfServeToStep legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: AdvanceSelfServe's UPDATE and phase event with the substep a parameter (reconciliation's entry, the cut handoff's adopted or issue) and staging_started_at and next_maintenance_at in the same statement, in one SQLite transaction; no bucket or root action file:Exec@344 b039fe9a8cc177de8d4f6acbc588911de2c9af4f5697da08274a9df690206f79
+@legacy a94ae18585d7d25c1e71868e1eef0ff3c88eaccac7bc6cd5130ad504c557236a internal/console/selfserve_store.go Store.AdvanceSelfServeToStep legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: AdvanceSelfServe's UPDATE and phase event with the substep a parameter (reconciliation's entry, the cut handoff's adopted or issue) and staging_started_at and next_maintenance_at in the same statement, in one SQLite transaction; no bucket or root action; self-serve moves 2 Task 8: the statement also requires outcome = '' (a finished row is never advanced) file:Exec@344 33ed2690b454b0406194b5cf27f677ebe0381e3e6d55fd27db8203f5904905d7
+internal/console/selfserve_store.go Store.AdvanceSelfServeToStep legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: AdvanceSelfServe's UPDATE and phase event with the substep a parameter (reconciliation's entry, the cut handoff's adopted or issue) and staging_started_at and next_maintenance_at in the same statement, in one SQLite transaction; no bucket or root action; self-serve moves 2 Task 8: the statement also requires outcome = '' (a finished row is never advanced) file:Exec@344 33ed2690b454b0406194b5cf27f677ebe0381e3e6d55fd27db8203f5904905d7
@legacy 9a71ef08171b8178280d1b13431a58e24c4f5a3a76e7fc752fad223c94e8bdd1 internal/console/selfserve_store.go Store.ConsumeSelfServeMaintenance legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: consumes one confirmed maintenance request back to idle, predicated on its nonce, its confirmation, no consumption and no cut; no bucket or root action file:Exec@119 0617bcf4892edf006203e3395fc30e5efc01d8c5654e63daf47c852dc3cb07c7
internal/console/selfserve_store.go Store.ConsumeSelfServeMaintenance legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: consumes one confirmed maintenance request back to idle, predicated on its nonce, its confirmation, no consumption and no cut; no bucket or root action file:Exec@119 0617bcf4892edf006203e3395fc30e5efc01d8c5654e63daf47c852dc3cb07c7
@legacy f3c0942345fb8194f311733b4eb48773240fbf054b7d7ae5ae2d01dc4fa0d90e internal/console/selfserve_store.go Store.ExpireSelfServeRequest legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: decides one self-serve request's expiry, predicated on its nonce, the deadline and the cut state the worker read, unconsumed and unexpired; no bucket or root action file:Exec@126 49d1e55948e9b1e8060997cd2bf530cce028d0c3da96e10cdcc1e68048786498
@@ -192,3 +192,14 @@ internal/console/selfserve_store.go Store.issueSelfServeRequest legacy accepted-
@removed internal/console/selfserve_store.go Store.IssueSelfServeRequest H3 census-ruling-PROPOSED-self-serve-moves-2;rev3=PROPOSED-self-serve-moves-2;basis=remains declared but has no direct read; its statement moved to issueSelfServeRequest, classified below, which IssueSelfServeRequest calls (its UPDATE as before) and IssueSelfServeRequestWithDeadline calls with the round's step deadline set in the same statement; proposed removal only
# Task 7 fix round 1, rev3=PROPOSED-self-serve-moves-2: offlineClaimEvidence and participantIdentityFor are re-pinned in place (their unreadable refusals are built transient, a typed field of offlineRefusal; the doors' answers are unchanged), read sites unchanged, offsets moved; the internal/console envelope is re-pinned in place. The two Task 7 removals' bases now say how the moved statements changed.
# Task 8 also fixed, rev3=PROPOSED-self-serve-moves-2: targetDataPaths names the raw nested directory through internal/layout (layout.RawInstanceDir, the same path), so internal/layout's TestRawInstancesDirectoryIsNamedOnlyHere holds; the row and its frozen declaration are re-pinned in place, the internal/console envelope is re-pinned in place.
+# Task 8 (the cut, abort, finaliser, paging and the operator return), rev3=PROPOSED-self-serve-moves-2: five accepted-legacy units are added (firstDataPath, probeTarget, Store.SetSelfServeStep, BoxHandle.RenderHeldConfig, movesWorker.returnLeftovers); Store.AdvanceSelfServeToStep and Store.FinishSelfServeMove are re-pinned in place (their predicates gain outcome = and the unconfirmed-request refusal); the internal/console, internal/host, internal/moves and internal/provision envelopes are re-pinned in place.
+@legacy 68ece6567d9b4e8561ae648e1ae0c2673877dc557f56815b43a622e30b0345de internal/console/offlinereturn.go firstDataPath legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: names the data directory a return-ready report uses (/data when the report names none), as targetDataPaths does; reads no file and grants nothing data-literal@155 283e6272ea6a25cb27321e2f957af217a046117bb14dc7cc570bb61384ebec89
+internal/console/offlinereturn.go firstDataPath legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: names the data directory a return-ready report uses (/data when the report names none), as targetDataPaths does; reads no file and grants nothing data-literal@155 283e6272ea6a25cb27321e2f957af217a046117bb14dc7cc570bb61384ebec89
+@legacy b2f5e445abe5845965e43d57fe80a2ec831110e0e75df40c0c821c6075b8ad4c internal/console/selfserve_health.go Server.probeTarget legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: the health probe value is 8 bytes of crypto/rand; the probe itself is an HTTPS request to the target box, no file file:Read@854 c82f3acca5ed6b8e369fdba6a126f9567d688b7d661f5edfde3f2940cb4fc251
+internal/console/selfserve_health.go Server.probeTarget legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: the health probe value is 8 bytes of crypto/rand; the probe itself is an HTTPS request to the target box, no file file:Read@854 c82f3acca5ed6b8e369fdba6a126f9567d688b7d661f5edfde3f2940cb4fc251
+@legacy cc48b4d8d3079cb6c12be592421b5e0bfd5478fbf0a6349582d02465c2337f51 internal/console/selfserve_store.go Store.SetSelfServeStep legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: one predicated UPDATE of the console SQLite journal (a row moved between substeps after an operator transition); no root input file:Exec@111 5511b422b5f6fd6f8a8d99926a527a19169a320bdefa5f1e45fa7a82b67f7c63
+internal/console/selfserve_store.go Store.SetSelfServeStep legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: one predicated UPDATE of the console SQLite journal (a row moved between substeps after an operator transition); no root input file:Exec@111 5511b422b5f6fd6f8a8d99926a527a19169a320bdefa5f1e45fa7a82b67f7c63
+@legacy caf925ce7aa45d5792244a8744132b465ef7cc8dd9ca88d2998ba5d11089d550 internal/host/e2e_bridge.go BoxHandle.RenderHeldConfig legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=tests only (the end-to-end bridge, called by internal/e2e/selfserve alone): config sync stand-in reading the fixture box registry row registry:HoldOp@162,whole:Route@149,whole:Route@281 be2a0c09f44ff809ac7f98e9ca7985c0907b1942a385a897ef7405953ec2a54f
+internal/host/e2e_bridge.go BoxHandle.RenderHeldConfig legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=tests only (the end-to-end bridge, called by internal/e2e/selfserve alone): config sync stand-in reading the fixture box registry row registry:HoldOp@162,whole:Route@149,whole:Route@281 be2a0c09f44ff809ac7f98e9ca7985c0907b1942a385a897ef7405953ec2a54f
+@legacy fec756f3338175c3a0eb2bc7980a7ec0da09e5231becbe0f422f1b249850e24d internal/host/movesoffline_return.go movesWorker.returnLeftovers legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=carlos-edge agent, J4 root-input: lists the box own park directory and nested instance directories for the host of a completed forward move to report them as a return leftovers; reads names only, grants nothing file:ReadDir@1059,file:ReadDir@515,file:ReadDir@733 97ce4913cc0334c78fed12cb52948bc41de60d613df1849566c4f3882b1ac507
+internal/host/movesoffline_return.go movesWorker.returnLeftovers legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=carlos-edge agent, J4 root-input: lists the box own park directory and nested instance directories for the host of a completed forward move to report them as a return leftovers; reads names only, grants nothing file:ReadDir@1059,file:ReadDir@515,file:ReadDir@733 97ce4913cc0334c78fed12cb52948bc41de60d613df1849566c4f3882b1ac507