carlos / platform Public

provision: census overlays for the change index (root reads and record writes), proposed on #280; spec §4.4 records the bucket-confirmed removals (#336)

Root-read census: overlay plan14-root-reads-s3-change-index.tsv, loaded
after console-brand-name. Re-pins 17 changed units at their class, adds 17
new units at their siblings' class, retires four frozen units that now
read nothing (DirStore.Put, PutFrom, DeleteIfMatch, telemetrySwitches) by
H3 removals, and re-pins 12 envelopes. Rows carry
rev3=PROPOSED-s3-change-index; the ruling, census-ruling-s3-change-index,
is owed by the census owner on #280.

Record-write census: s3ChangeIndexWriteCensusInventory over
plans2WriteCensusInventory. Re-pins Reconcile, ReconcileSidecars and the
four concrete store Put/PutFrom at unchanged class and kinds; adds
snapStore.Put/PutFrom (record-transport), uncachedStore.Put (nonrecord)
and six record view readers (key-site).

reconcile.go's comment now cites §4.4 for the removal rule.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude 2 days ago 26b9e850d0b80abb7de27a7f6076d3d8890a05d8 parent e9025d7

6 files changed, +200 −2

docs/superpowers/specs/2026-10-21-s3-change-index-design.md +14 −0
internal/provision/plan14_root_reads_test.go +21 −0
internal/provision/plan9_b8_census_test.go +1 −1
internal/provision/reconcile.go +1 −1
internal/provision/s3_change_index_census_test.go +77 −0
internal/provision/testdata/plan14-root-reads-s3-change-index.tsv +86 −0

diff --git a/docs/superpowers/specs/2026-10-21-s3-change-index-design.md b/docs/superpowers/specs/2026-10-21-s3-change-index-design.md

index 5e4682fec..78430f753 100644

--- a/docs/superpowers/specs/2026-10-21-s3-change-index-design.md

+++ b/docs/superpowers/specs/2026-10-21-s3-change-index-design.md

@@ -295,6 +295,20 @@ those writers (box run/seed/move writes, direct-bucket CLI writes) rely on

the 5-minute floor; with the index they converge in seconds, and only

failures and old binaries wait for the backstop.

+**Removals are confirmed in the bucket.** The same writers mean absence in

+a snapshot is not the bucket's word: a record written without its bump is

+missing from a Complete snapshot until the next rebuild. So a removal that

+a snapshot proves by absence is confirmed against the live bucket before a

+row goes. That covers "record gone" in `Reconcile` and in

+`ReconcileSidecars`, and the trash-marker removal in `Reconcile`, which

+checks that the marker the snapshot holds is still in the bucket

+(`confirmRecordGone`, `confirmSidecarGone` and `confirmTrashed` in

+`internal/provision/recordview_store.go`). A record that is there and in

+the pass's scope keeps the row, and so does a live read that fails: the

+row stays until a pass can read the bucket cleanly. Over any store that is

+not a snapshot the checks answer at once without a read, because there the

+walk's absence already is the bucket's.

### 4.5 What triggers a pass, and what it reads

- `fastTick` keeps reading `control/serial` every 2s as today and also

diff --git a/internal/provision/plan14_root_reads_test.go b/internal/provision/plan14_root_reads_test.go

index 715d31d63..bd1912ba9 100644

--- a/internal/provision/plan14_root_reads_test.go

+++ b/internal/provision/plan14_root_reads_test.go

@@ -1323,6 +1323,27 @@ func TestPlan14RootReadCensus(t *testing.T) {

t.Fatal(err)

}

seal = "78e18e222a8178bbe16b638c5e3811b8f64c4c2664ffd6649eb4273e72fae24e"

+ // Census overlay s3-change-index (amadan #336: the deployment stores bump

+ // control/changes.json after each mutation; readers armed by

+ // CARLOS_CHANGE_INDEX=read read records through a record view snapshot,

+ // gate unchanged reads up to the backstop's age and run scoped passes),

+ // loaded last, after console-brand-name. Proposed; rows carry

+ // rev3=PROPOSED-s3-change-index and the ruling,

+ // census-ruling-s3-change-index, is asked of the census owner on #280.

+ // The units run in the agent (user carlos) or the console, or are store

+ // methods shared as their siblings; root's carlos adopt reaches only

+ // PassFilter's pointer gate, which it never arms. Four frozen units that

+ // now read nothing (DirStore.Put, PutFrom and DeleteIfMatch, whose bodies

+ // moved into raw methods, and telemetrySwitches) are retired by H3

+ // removals. Frozen declarations are added, so the seal moves;

+ // console-brand-name's is checked first.

+ if errs := checkRootReadLegacy(inv, seal); len(errs) != 0 {

+ t.Fatal(errs)

+ }

+ if err = loadRootReadInventory(filepath.Join(root, "internal/provision/testdata/plan14-root-reads-s3-change-index.tsv"), &inv, true); err != nil {

+ t.Fatal(err)

+ }

+ seal = "7d4b63ec0135ff227f49251b6c35a88d59026073518d89a3c81be255eacdc14f"

errs := append(compareRootReads(got, inv), checkRootReadLegacy(inv, seal)...)

errs = append(errs, checkRootReadDeclarations(got, inv)...)

if len(errs) > 0 {

diff --git a/internal/provision/plan9_b8_census_test.go b/internal/provision/plan9_b8_census_test.go

index 3694cedd5..b4dfb3985 100644

--- a/internal/provision/plan9_b8_census_test.go

+++ b/internal/provision/plan9_b8_census_test.go

@@ -366,7 +366,7 @@ func TestPlan9B8RecordWriteCensus(t *testing.T) {

if len(got) < 100 {

t.Fatalf("census found only %d units under %s; the walk is broken", len(got), root)

}

- inventory := plans2WriteCensusInventory()

+ inventory := s3ChangeIndexWriteCensusInventory()

problems := append(censusDiff(inventory, got), censusPolicy(inventory)...)

if len(problems) > 0 {

t.Fatalf("record-write census rejected %d site(s); update the explicit inventory only after reviewing the source:\n %s", len(problems), strings.Join(problems, "\n "))

diff --git a/internal/provision/reconcile.go b/internal/provision/reconcile.go

index ffe26b2bb..a2f08183c 100644

--- a/internal/provision/reconcile.go

+++ b/internal/provision/reconcile.go

@@ -1554,7 +1554,7 @@ func Reconcile(ctx context.Context, s release.Store, reg *registry.Registry, cfg

}

// Over a record view snapshot, the absence (or the marker) is

// confirmed in the bucket first: a write that missed its bump

- // is not in the snapshot (S3 change-index design §3.4).

+ // is not in the snapshot (S3 change-index design §4.4).

if why == "record gone" && !confirmRecordGone(ctx, s, rt, func(r Record) bool {

return cfg.inScope(r.Region, r.Pool, everywhereClass(r))

}) {

diff --git a/internal/provision/s3_change_index_census_test.go b/internal/provision/s3_change_index_census_test.go

new file mode 100644

index 000000000..cc5f4b263

--- /dev/null

+++ b/internal/provision/s3_change_index_census_test.go

@@ -0,0 +1,77 @@

+package provision

+// s3ChangeIndexWriteCensusInventory is the record-write inventory for the S3

+// change index (amadan #336; docs/superpowers/specs/2026-10-21-s3-change-index-design.md),

+// layered on plans2WriteCensusInventory. Reviewed by the branch author;

+// PROPOSED, the census owner rules on #280 (census-ruling-s3-change-index).

+//

+// Re-pinned, class and kinds unchanged:

+// - DirStore.Put, DirStore.PutFrom, S3Store.Put, S3Store.PutFrom: each is

+// now its old body moved unchanged into an unexported raw method (putRaw,

+// putFromRaw), then, after a successful write and only on a store opened

+// with the change index (EnableChangeIndex, NewDeploymentS3Store), a bump

+// of control/changes.json (bumpAfterMutation). Still record-transport:

+// they write whatever key the caller names, record keys included.

+// - Reconcile and ReconcileSidecars: a removal that a record view snapshot

+// proves by absence (record gone, or the app's trash marker) is confirmed

+// in the bucket first (confirmRecordGone, confirmSidecarGone,

+// confirmTrashed); a confirmation can only keep a row. No record write is

+// added; they stay key-site.

+//

+// New:

+// - snapStore.Put, snapStore.PutFrom: the record view snapshot store

+// forwards every write, record writes from WriteRecord included, to the

+// live store unchanged, and remembers the key so later reads of it go to

+// the bucket: record-transport, like prefixStore.Put.

+// - uncachedStore.Put: refuses and writes nothing (it backs walkComplete's

+// read-only walk over the cache): nonrecord, like versionStore.Put.

+// - RecordView.readApp, RecordView.readScope, RecordView.walk,

+// walkComplete, ViewSnapshot.list, ViewSnapshot.lookup: the record view's

+// reads. They name the instances/ and sidecars/ families (and the sidecar

+// manifest key) to list, fetch and answer them from the snapshot, and

+// write nothing: key-site.

+//

+// Not listed, and not a record write in this census's sense: the bump

+// itself. bumpAfterMutation and bumpChangeIndex rewrite only

+// control/changes.json (release.ChangeIndexKey), through the store's raw

+// put handed in as a function value, so the scanner sees neither, nor the

+// raw methods (putRaw, putFromRaw, deleteRaw, deleteIfMatchRaw), whose names

+// are not Put-family names. Every call of a raw put is in its own store's

+// Put, PutFrom or bump.

+func s3ChangeIndexWriteCensusInventory() []censusEntry {

+ entries := append([]censusEntry(nil), plans2WriteCensusInventory()...)

+ repins := []censusEntry{

+ {"internal/provision/reconcile.go", "Reconcile", "key-site", "key:ParseRecordKey,key:RecordKey,lit:instances", "a7d6072c888cfcf87a8eb3b4c076495ca22201e2eb2ed49e9fbc92dd20868852"},

+ {"internal/provision/sidecar_reconcile.go", "ReconcileSidecars", "key-site", "key:ParseSidecarKey,key:SidecarRecordKey,lit:sidecars", "da6e3c45950cb9ebb61d49a080fcb700a3a0bf373354269f503e52abe71cb72d"},

+ {"internal/release/store.go", "DirStore.Put", "record-transport", "def:Put", "63c5ff8af0fd64d30502735306287c489a659863ef3fc8b3f0df48f31c25134e"},

+ {"internal/release/store.go", "DirStore.PutFrom", "record-transport", "def:PutFrom", "f3f61446f41f15692d7e164b1a1637a8ff213359da3eebd60f574f585b31eb6a"},

+ {"internal/release/store.go", "S3Store.Put", "record-transport", "def:Put", "cd2fbd84994508f0f920210d6b0b4375a2d0ea1369ef0b73160fc2e0b2de66e9"},

+ {"internal/release/store.go", "S3Store.PutFrom", "record-transport", "def:PutFrom", "743c0dd30f0b1ea209a518382ab89d175d6e7fa15f0812f1f90e4fe6fd63b621"},

+ }

+ for _, r := range repins {

+ found := false

+ for i, e := range entries {

+ if e.File == r.File && e.Unit == r.Unit {

+ if e.Class != r.Class || e.Kinds != r.Kinds {

+ panic("s3-change-index re-pin changes the class or kinds of " + e.File + ":" + e.Unit)

+ }

+ entries[i], found = r, true

+ break

+ }

+ if !found {

+ panic("s3-change-index re-pin of an unlisted unit " + r.File + ":" + r.Unit)

+ }

+ return append(entries,

+ censusEntry{"internal/provision/recordview_store.go", "snapStore.Put", "record-transport", "def:Put,sel:Put", "3d2e124f1aba407198c881bb86357065bcfd93bec30d913e4a37b503ed131917"},

+ censusEntry{"internal/provision/recordview_store.go", "snapStore.PutFrom", "record-transport", "def:PutFrom,sel:PutObjectFrom", "469205cdc7b7b3882750731fadf0dfa8822393b8c1c134e4ee2e25c7df08f453"},

+ censusEntry{"internal/provision/recordview_store.go", "uncachedStore.Put", "nonrecord", "def:Put", "6b84938254d188d730158b529b89cbd040222c1509d5170bcac984bd4e50a2f6"},

+ censusEntry{"internal/provision/recordview.go", "RecordView.readApp", "key-site", "key:SidecarManifestKey", "09b0c8c11e7c42ed8a31fcc7a6f324b4f4b9a97fef463c5c032797ac6f4547d2"},

+ censusEntry{"internal/provision/recordview.go", "RecordView.readScope", "key-site", "lit:instances,lit:sidecars", "2820835bc309da9cd98a749106bde435fe6597a1b6b39472adf63908f9b55b7f"},

+ censusEntry{"internal/provision/recordview.go", "RecordView.walk", "key-site", "lit:instances,lit:sidecars", "ea585c4f5b40c1be6eb0b25d56b1041f8143e2176ca75c9636a959dc988c7184"},

+ censusEntry{"internal/provision/recordview.go", "walkComplete", "key-site", "lit:instances,lit:sidecars", "2edf70da2e873f69e5186845e19a32d0cec495e038d49bd889409a39ef431735"},

+ censusEntry{"internal/provision/recordview_store.go", "ViewSnapshot.list", "key-site", "lit:instances,lit:sidecars", "66443ba9b310eff8b59b7340fcc9ceee99e487b37029dce1ca82ea11858e23a5"},

+ censusEntry{"internal/provision/recordview_store.go", "ViewSnapshot.lookup", "key-site", "lit:instances,lit:sidecars", "25bea5560b69cdde76d3e8affd47ad915d75107cf5a7df6221efc89205191ea2"},

+ )

diff --git a/internal/provision/testdata/plan14-root-reads-s3-change-index.tsv b/internal/provision/testdata/plan14-root-reads-s3-change-index.tsv

new file mode 100644

index 000000000..a2b4054d0

--- /dev/null

+++ b/internal/provision/testdata/plan14-root-reads-s3-change-index.tsv

@@ -0,0 +1,86 @@

+# Census overlay s3-change-index (amadan #336: the S3 change index; docs/superpowers/specs/2026-10-21-s3-change-index-design.md), loaded LAST, after console-brand-name. Proposed: new and re-pinned rows carry rev3=PROPOSED-s3-change-index and the H3 removals census-ruling-s3-change-index; the ruling is asked of the census owner on #280.

+# What changed. The deployment stores bump control/changes.json after each successful mutation (Put, PutFrom, Delete, DeleteIfMatch split into a raw body plus the bump). Readers armed by CARLOS_CHANGE_INDEX=read (unset is exactly today's behaviour) read records through a record view snapshot, skip unchanged generation, canary pointer and telemetry reads behind a gate whose maximum age is the 30 minute backstop, and run a scoped pass over the apps whose scope moved. A removal over a snapshot is confirmed in the live bucket first and a failed confirmation keeps the row.

+# Who runs it. The new and changed units run in the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos), the console (cmd/console serve, user carlos-console), or are store methods every deployment-store opener shares, as their siblings. Root's carlos adopt reaches only PassFilter, type passConfig and passConfig.gatePointers, with the gate nil (unchanged pass). runSystemClaims (operator CLI, uid 0) now opens the deployment store with the change index, so its writes bump control/changes.json; the bump reads and rewrites that one object and decides nothing else.

+# Re-pins keep each unit's class and append this branch's basis. New units take their siblings' class. Frozen declarations are added, so the seal moves; console-brand-name's is checked first.

+@legacy 8aed1441fabaa3bb95898b31bfd1d0e00dfc93ef0e608612c83c80e5b166d32c cmd/console/main.go serve legacy accepted-legacy accepted-legacy;rev3=PROPOSED-scan-demand-revival;basis=Console service wires the optional callback signer and starts the claim-guarded queue worker. The same three data path literals move; it does not add a privileged reader.;rev3=PROPOSED-email-signin;identity=the console (cmd/console serve under console.service, user carlos-console);basis=passes CARLOS_CONSOLE_NAME to NewServer as Config.ConsoleName, the name the console's emails use; the same three /data literals at the same offsets; no read added;rev3=PROPOSED-s3-change-index;identity=the console (cmd/console serve under console.service, user carlos-console);basis=arms the record view when CARLOS_CHANGE_INDEX=read (armChangeIndex) for the run and seed sweeps and starts its backstop loop; the same three /data literals at the same offsets; no read added data-literal@4077,data-literal@5178,data-literal@5415 32740c27448264baa40a1c8062fa847b992d02ca21b6117fa2e55dfaf10febdc

+cmd/console/main.go serve legacy accepted-legacy accepted-legacy;rev3=PROPOSED-scan-demand-revival;basis=Console service wires the optional callback signer and starts the claim-guarded queue worker. The same three data path literals move; it does not add a privileged reader.;rev3=PROPOSED-email-signin;identity=the console (cmd/console serve under console.service, user carlos-console);basis=passes CARLOS_CONSOLE_NAME to NewServer as Config.ConsoleName, the name the console's emails use; the same three /data literals at the same offsets; no read added;rev3=PROPOSED-s3-change-index;identity=the console (cmd/console serve under console.service, user carlos-console);basis=arms the record view when CARLOS_CHANGE_INDEX=read (armChangeIndex) for the run and seed sweeps and starts its backstop loop; the same three /data literals at the same offsets; no read added data-literal@4077,data-literal@5178,data-literal@5415 32740c27448264baa40a1c8062fa847b992d02ca21b6117fa2e55dfaf10febdc

+@legacy 7712d77765ffa0623a9f481c5634de12a3825d4b0ae188d01f4e183c633b9929 internal/appconfig/syncexec.go SyncExecWithCallbacks legacy accepted-legacy accepted-legacy;rev3=census-ruling-moves-offline-fixes;basis=route-and-input (J1,J4, main's disposition); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos), through syncExecSerialized: main's body, with a nested row whose write found no instance directory named and skipped (errInstanceDirAbsent, WhenInstanceDirAbsent) instead of failing the pass, and each in-scope host reported done or not done (WithHostOutcome) once the pass has gone through every route; no new read site;rev3=PROPOSED-s3-change-index;identity=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos);basis=the scoped pass's route filter (WithRouteFilter, syncOptions.kept) is checked in its three route loops, so a route the filter leaves out is out of scope before anything is read for it; three whole-Route sites added, each passing rt to kept; no bucket or file read added file:Stat@28647,registry:App@10371,registry:App@10586,registry:App@16132,registry:App@28532,registry:Environment@10379,registry:Environment@10594,registry:Environment@16140,registry:Environment@28540,registry:Host@1031,registry:Host@1066,registry:Host@1495,registry:Host@15640,registry:Host@15967,registry:Host@16065,registry:Host@16897,registry:Host@17248,registry:Host@18183,registry:Host@18724,registry:Host@21651,registry:Host@21868,registry:Host@22426,registry:Host@22616,registry:Host@22625,registry:Host@22644,registry:Host@25545,registry:Host@26162,registry:Host@26214,registry:Host@26370,registry:Host@29041,registry:Host@866,registry:Host@937,whole:Route@10141,whole:Route@10199,whole:Route@10264,whole:Route@10325,whole:Route@10366,whole:Route@10483,whole:Route@10517,whole:Route@10581,whole:Route@1447,whole:Route@1476,whole:Route@15552,whole:Route@15602,whole:Route@16127,whole:Route@25141,whole:Route@25555,whole:Route@26259,whole:Route@28416,whole:Route@28449,whole:Route@28464,whole:Route@28527,whole:Route@28628,whole:Route@29278,whole:Route@29351,whole:Route@693,whole:Route@721,whole:Route@750,whole:Route@776,whole:Route@811 41bbc2b0ed3fe93b4bd8376ce86e7fb82fa9276a85c3cf4edfa46d8c9d45fd7e

+internal/appconfig/syncexec.go SyncExecWithCallbacks legacy accepted-legacy accepted-legacy;rev3=census-ruling-moves-offline-fixes;basis=route-and-input (J1,J4, main's disposition); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos), through syncExecSerialized: main's body, with a nested row whose write found no instance directory named and skipped (errInstanceDirAbsent, WhenInstanceDirAbsent) instead of failing the pass, and each in-scope host reported done or not done (WithHostOutcome) once the pass has gone through every route; no new read site;rev3=PROPOSED-s3-change-index;identity=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos);basis=the scoped pass's route filter (WithRouteFilter, syncOptions.kept) is checked in its three route loops, so a route the filter leaves out is out of scope before anything is read for it; three whole-Route sites added, each passing rt to kept; no bucket or file read added file:Stat@28647,registry:App@10371,registry:App@10586,registry:App@16132,registry:App@28532,registry:Environment@10379,registry:Environment@10594,registry:Environment@16140,registry:Environment@28540,registry:Host@1031,registry:Host@1066,registry:Host@1495,registry:Host@15640,registry:Host@15967,registry:Host@16065,registry:Host@16897,registry:Host@17248,registry:Host@18183,registry:Host@18724,registry:Host@21651,registry:Host@21868,registry:Host@22426,registry:Host@22616,registry:Host@22625,registry:Host@22644,registry:Host@25545,registry:Host@26162,registry:Host@26214,registry:Host@26370,registry:Host@29041,registry:Host@866,registry:Host@937,whole:Route@10141,whole:Route@10199,whole:Route@10264,whole:Route@10325,whole:Route@10366,whole:Route@10483,whole:Route@10517,whole:Route@10581,whole:Route@1447,whole:Route@1476,whole:Route@15552,whole:Route@15602,whole:Route@16127,whole:Route@25141,whole:Route@25555,whole:Route@26259,whole:Route@28416,whole:Route@28449,whole:Route@28464,whole:Route@28527,whole:Route@28628,whole:Route@29278,whole:Route@29351,whole:Route@693,whole:Route@721,whole:Route@750,whole:Route@776,whole:Route@811 41bbc2b0ed3fe93b4bd8376ce86e7fb82fa9276a85c3cf4edfa46d8c9d45fd7e

+@legacy 147e791b4b64eb6112c4de13802081973d19d1428ed090e75f180d1bf93cb94a internal/console/runsweep.go Server.runSweepPass legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the console (cmd/console serve under console.service, user carlos-console): the console's run sweep: expires queued runs and ends lost ones by CAS on the record;rev3=PROPOSED-s3-change-index;identity=the console (cmd/console serve under console.service, user carlos-console);basis=armed, reads the records through the record view (recordWalkStore) and lists runs/ for orphans only for apps with a run-start audit row in the last 48 hours (orphanCandidates, Store.AppsWithActionSince), with a full orphan sweep at start and every 24 hours; every write and the runs/ listing stay on the bucket; read site unchanged, offset moved file:Open@1438 466d9bb74c5f5fa33d968c3862dfd5c9662b63b7659844ff43d55bb8d937ecc1

+internal/console/runsweep.go Server.runSweepPass legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the console (cmd/console serve under console.service, user carlos-console): the console's run sweep: expires queued runs and ends lost ones by CAS on the record;rev3=PROPOSED-s3-change-index;identity=the console (cmd/console serve under console.service, user carlos-console);basis=armed, reads the records through the record view (recordWalkStore) and lists runs/ for orphans only for apps with a run-start audit row in the last 48 hours (orphanCandidates, Store.AppsWithActionSince), with a full orphan sweep at start and every 24 hours; every write and the runs/ listing stay on the bucket; read site unchanged, offset moved file:Open@1438 466d9bb74c5f5fa33d968c3862dfd5c9662b63b7659844ff43d55bb8d937ecc1

+@legacy d63b9da377834935321f22b7af726257ebbc1b6e6204afc6e85205850ffcc257 internal/host/agent.go configGenLoop legacy accepted-legacy accepted-legacy;rev3=census-ruling-moves-offline-fixes;basis=root-route (J1, main's disposition); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's loop, its tick's body moved into configGenTick; the registry listing stays here;rev3=PROPOSED-s3-change-index;identity=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos);basis=builds the generation cache's change gate (newChangeGate) after the agent armed the index; read site unchanged, offset moved whole:Route@1362 c5d039380bf66781652a6e75df4d4614d192e68c939ceef7c8875b383b0dcaeb

+internal/host/agent.go configGenLoop legacy accepted-legacy accepted-legacy;rev3=census-ruling-moves-offline-fixes;basis=root-route (J1, main's disposition); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's loop, its tick's body moved into configGenTick; the registry listing stays here;rev3=PROPOSED-s3-change-index;identity=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos);basis=builds the generation cache's change gate (newChangeGate) after the agent armed the index; read site unchanged, offset moved whole:Route@1362 c5d039380bf66781652a6e75df4d4614d192e68c939ceef7c8875b383b0dcaeb

+@legacy 25d21235ae57b8378e8cc2ec24abf8fc04adfb91be3e61cfd846679fddb7a28e internal/host/agent.go fastTick legacy accepted-legacy accepted-legacy;rev3=J1;basis=root-route;rev3=PROPOSED-s3-change-index;identity=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos);basis=observes the change index before any pass (observeIndex), runs the backstop's requested full pass and a scoped pass for moved app scopes (indexTick), and arms the canary pointer gate on the sweep (canaryPointerGate); read site unchanged, offset moved registry:Host@4381 83841634974cc5058a882a0fb642c84983c54e4c46a9e31bd619307549797864

+internal/host/agent.go fastTick legacy accepted-legacy accepted-legacy;rev3=J1;basis=root-route;rev3=PROPOSED-s3-change-index;identity=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos);basis=observes the change index before any pass (observeIndex), runs the backstop's requested full pass and a scoped pass for moved app scopes (indexTick), and arms the canary pointer gate on the sweep (canaryPointerGate); read site unchanged, offset moved registry:Host@4381 83841634974cc5058a882a0fb642c84983c54e4c46a9e31bd619307549797864

+@legacy ce2cf944137713e8cb39ddade175b99907b510b0c0d6033f0a9d2c408f4e4e79 internal/host/agent.go genPollPass legacy accepted-legacy accepted-legacy;rev3=J1;basis=root-route;rev3=PROPOSED-s3-change-index;identity=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos);basis=armed, an app already in the cache skips its generation read unless its scope moved, its last read failed, or that read is the backstop's age (release.ReadGate); read sites unchanged at the same offsets whole:Route@399,whole:Route@639,whole:Route@685 cc5bfbdba246803782a029bc3868d1f250b92e1868a785a70783368b0f72091e

+internal/host/agent.go genPollPass legacy accepted-legacy accepted-legacy;rev3=J1;basis=root-route;rev3=PROPOSED-s3-change-index;identity=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos);basis=armed, an app already in the cache skips its generation read unless its scope moved, its last read failed, or that read is the backstop's age (release.ReadGate); read sites unchanged at the same offsets whole:Route@399,whole:Route@639,whole:Route@685 cc5bfbdba246803782a029bc3868d1f250b92e1868a785a70783368b0f72091e

+@legacy 3539c4d974f5965c27b0f61531f483b5ce395f24005e190de130bbece08a8f05 internal/host/steering_loop.go steeringPass legacy accepted-legacy accepted-legacy;rev3=J1;basis=root-route;rev3=PROPOSED-s3-change-index;identity=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos);basis=reads the steered records through the record view when it can vouch (viewStore), the bucket otherwise; read site unchanged, offset moved whole:Route@475 5db289406e7e014db706e6e37146396ae88865ffb8a8c43aed90c2433da1ed6d

+internal/host/steering_loop.go steeringPass legacy accepted-legacy accepted-legacy;rev3=J1;basis=root-route;rev3=PROPOSED-s3-change-index;identity=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos);basis=reads the steered records through the record view when it can vouch (viewStore), the bucket otherwise; read site unchanged, offset moved whole:Route@475 5db289406e7e014db706e6e37146396ae88865ffb8a8c43aed90c2433da1ed6d

+@legacy 921dfa45400dc39e0652907d9c16bb21cffc823f63b852a310586dbccb789f46 internal/provision/reconcile.go Reconcile legacy accepted-legacy accepted-legacy;rev3=census-ruling-seeded-instances;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body with the import journal read before the records are acted on (journalPass), seeded records dispatched first (seedAction), journaled hosts kept out of the removal phase and a row's seed column converged from its record; the agent's own pass;rev3=PROPOSED-s3-change-index;identity=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos);basis=over a record view snapshot, a record-gone or app-in-the-trash removal is confirmed in the bucket first (confirmRecordGone, confirmTrashed) and a confirmation that cannot read cleanly keeps the row; disarmed, the store is never a snapshot and both answer true without reading; one whole-Route, one Account and one App site added, each passing rt to a confirmation; a removal can only be withheld, never added registry:Account@19247,registry:Account@20339,registry:Account@33924,registry:Account@33970,registry:Account@35180,registry:App@19220,registry:App@20312,registry:App@33944,registry:App@33982,registry:App@35192,registry:ClaimOwnership@19834,registry:DBPath@26035,registry:DBPath@26050,registry:DBPath@26296,registry:DBPath@26827,registry:DBPath@26840,registry:Gate@22975,registry:Gate@23115,registry:Gate@23380,registry:Hibernate@21953,registry:Hibernate@22271,registry:Hibernate@22622,registry:Hibernate@22910,registry:Host@13124,registry:Host@33902,registry:Host@34072,registry:Host@34169,registry:Host@34284,registry:Host@34629,registry:Host@34726,registry:Host@35324,registry:Host@35482,registry:Host@35584,registry:Kind@19976,registry:Kind@20239,registry:Kind@25953,registry:Kind@25966,registry:Kind@26076,registry:Kind@26089,registry:Kind@26738,registry:Kind@26749,registry:Kind@33138,registry:Kind@35315,registry:Kind@35473,registry:Kind@35575,registry:Pool@33230,registry:Provisioned@19196,registry:Provisioned@20288,registry:Provisioned@33188,registry:Region@33219,registry:Replication@22356,registry:Replication@22483,registry:Seed@24455,registry:SeedSource@23960,registry:Socket@26001,registry:Socket@26016,registry:Socket@26313,registry:Socket@26797,registry:Socket@26810,registry:Unit@25919,registry:Unit@25932,registry:Unit@26764,registry:Unit@26775,whole:ClaimOwnership@19837,whole:ClaimOwnership@19854,whole:Route@13106,whole:Route@13117,whole:Route@13135,whole:Route@14235,whole:Route@14535,whole:Route@14542,whole:Route@14582,whole:Route@14943,whole:Route@15261,whole:Route@16122,whole:Route@16478,whole:Route@16487,whole:Route@16533,whole:Route@18841,whole:Route@19312,whole:Route@19322,whole:Route@19679,whole:Route@19686,whole:Route@19754,whole:Route@20077,whole:Route@20720,whole:Route@22043,whole:Route@26145,whole:Route@27624,whole:Route@27669,whole:Route@27679,whole:Route@28542,whole:Route@29294,whole:Route@32586,whole:Route@33255,whole:Route@35008,whole:Route@35395 a7d6072c888cfcf87a8eb3b4c076495ca22201e2eb2ed49e9fbc92dd20868852

+internal/provision/reconcile.go Reconcile legacy accepted-legacy accepted-legacy;rev3=census-ruling-seeded-instances;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body with the import journal read before the records are acted on (journalPass), seeded records dispatched first (seedAction), journaled hosts kept out of the removal phase and a row's seed column converged from its record; the agent's own pass;rev3=PROPOSED-s3-change-index;identity=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos);basis=over a record view snapshot, a record-gone or app-in-the-trash removal is confirmed in the bucket first (confirmRecordGone, confirmTrashed) and a confirmation that cannot read cleanly keeps the row; disarmed, the store is never a snapshot and both answer true without reading; one whole-Route, one Account and one App site added, each passing rt to a confirmation; a removal can only be withheld, never added registry:Account@19247,registry:Account@20339,registry:Account@33924,registry:Account@33970,registry:Account@35180,registry:App@19220,registry:App@20312,registry:App@33944,registry:App@33982,registry:App@35192,registry:ClaimOwnership@19834,registry:DBPath@26035,registry:DBPath@26050,registry:DBPath@26296,registry:DBPath@26827,registry:DBPath@26840,registry:Gate@22975,registry:Gate@23115,registry:Gate@23380,registry:Hibernate@21953,registry:Hibernate@22271,registry:Hibernate@22622,registry:Hibernate@22910,registry:Host@13124,registry:Host@33902,registry:Host@34072,registry:Host@34169,registry:Host@34284,registry:Host@34629,registry:Host@34726,registry:Host@35324,registry:Host@35482,registry:Host@35584,registry:Kind@19976,registry:Kind@20239,registry:Kind@25953,registry:Kind@25966,registry:Kind@26076,registry:Kind@26089,registry:Kind@26738,registry:Kind@26749,registry:Kind@33138,registry:Kind@35315,registry:Kind@35473,registry:Kind@35575,registry:Pool@33230,registry:Provisioned@19196,registry:Provisioned@20288,registry:Provisioned@33188,registry:Region@33219,registry:Replication@22356,registry:Replication@22483,registry:Seed@24455,registry:SeedSource@23960,registry:Socket@26001,registry:Socket@26016,registry:Socket@26313,registry:Socket@26797,registry:Socket@26810,registry:Unit@25919,registry:Unit@25932,registry:Unit@26764,registry:Unit@26775,whole:ClaimOwnership@19837,whole:ClaimOwnership@19854,whole:Route@13106,whole:Route@13117,whole:Route@13135,whole:Route@14235,whole:Route@14535,whole:Route@14542,whole:Route@14582,whole:Route@14943,whole:Route@15261,whole:Route@16122,whole:Route@16478,whole:Route@16487,whole:Route@16533,whole:Route@18841,whole:Route@19312,whole:Route@19322,whole:Route@19679,whole:Route@19686,whole:Route@19754,whole:Route@20077,whole:Route@20720,whole:Route@22043,whole:Route@26145,whole:Route@27624,whole:Route@27669,whole:Route@27679,whole:Route@28542,whole:Route@29294,whole:Route@32586,whole:Route@33255,whole:Route@35008,whole:Route@35395 a7d6072c888cfcf87a8eb3b4c076495ca22201e2eb2ed49e9fbc92dd20868852

+@legacy 96ccad12ba9ca42b8baf649552e8a9d63ad61439e00f1818c490df1e2d725804 internal/provision/reconcile.go holdExisting legacy accepted-legacy accepted-legacy;rev3=J1;basis=root-route;rev3=PROPOSED-s3-change-index;identity=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos);basis=the hold's record re-read reads the bucket (freshStore), never a record view snapshot; read sites unchanged, offsets moved registry:Account@640,registry:Account@795,registry:App@613,registry:App@781,registry:HoldOp@333,registry:HoldOp@371,registry:HoldOp@489,registry:Provisioned@589,registry:Status@1885,registry:Status@472 752df1628829a1effd249e58a5c52535e047c691affabc902c68f18f8fc8c28a

+internal/provision/reconcile.go holdExisting legacy accepted-legacy accepted-legacy;rev3=J1;basis=root-route;rev3=PROPOSED-s3-change-index;identity=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos);basis=the hold's record re-read reads the bucket (freshStore), never a record view snapshot; read sites unchanged, offsets moved registry:Account@640,registry:Account@795,registry:App@613,registry:App@781,registry:HoldOp@333,registry:HoldOp@371,registry:HoldOp@489,registry:Provisioned@589,registry:Status@1885,registry:Status@472 752df1628829a1effd249e58a5c52535e047c691affabc902c68f18f8fc8c28a

+@legacy 3c23bfc0c57c80d04a2d114323c5f4b0a8459f5ae049c74de654160fe5c2ab51 internal/provision/sidecar_reconcile.go ReconcileSidecars legacy accepted-legacy accepted-legacy;rev3=J1;basis=root-route;rev3=PROPOSED-s3-change-index;identity=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos);basis=over a record view snapshot, a record-gone removal is confirmed in the bucket first (confirmSidecarGone) and a confirmation that cannot read cleanly keeps the row; one whole-Route site added, passing rt to it; a removal can only be withheld, never added registry:Account@10349,registry:Account@10588,registry:Account@11541,registry:Account@12291,registry:App@10322,registry:App@10574,registry:App@11514,registry:App@12277,registry:Args@11166,registry:Args@11437,registry:Channel@11154,registry:ClaimOwnership@10967,registry:Host@13167,registry:Host@13214,registry:Host@13337,registry:Host@13749,registry:Host@13898,registry:Host@14005,registry:Host@7943,registry:Kind@10263,registry:Kind@10537,registry:Kind@11454,registry:Kind@12240,registry:Kind@13000,registry:Pool@13118,registry:Provisioned@10295,registry:Provisioned@10552,registry:Provisioned@11486,registry:Provisioned@12255,registry:Provisioned@13027,registry:Region@13068,whole:ClaimOwnership@10970,whole:ClaimOwnership@10987,whole:Route@10812,whole:Route@10819,whole:Route@10887,whole:Route@11222,whole:Route@11599,whole:Route@12985,whole:Route@13514,whole:Route@13815,whole:Route@7925,whole:Route@7936,whole:Route@7954,whole:Route@8140,whole:Route@8509,whole:Route@8518,whole:Route@9951 da6e3c45950cb9ebb61d49a080fcb700a3a0bf373354269f503e52abe71cb72d

+internal/provision/sidecar_reconcile.go ReconcileSidecars legacy accepted-legacy accepted-legacy;rev3=J1;basis=root-route;rev3=PROPOSED-s3-change-index;identity=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos);basis=over a record view snapshot, a record-gone removal is confirmed in the bucket first (confirmSidecarGone) and a confirmation that cannot read cleanly keeps the row; one whole-Route site added, passing rt to it; a removal can only be withheld, never added registry:Account@10349,registry:Account@10588,registry:Account@11541,registry:Account@12291,registry:App@10322,registry:App@10574,registry:App@11514,registry:App@12277,registry:Args@11166,registry:Args@11437,registry:Channel@11154,registry:ClaimOwnership@10967,registry:Host@13167,registry:Host@13214,registry:Host@13337,registry:Host@13749,registry:Host@13898,registry:Host@14005,registry:Host@7943,registry:Kind@10263,registry:Kind@10537,registry:Kind@11454,registry:Kind@12240,registry:Kind@13000,registry:Pool@13118,registry:Provisioned@10295,registry:Provisioned@10552,registry:Provisioned@11486,registry:Provisioned@12255,registry:Provisioned@13027,registry:Region@13068,whole:ClaimOwnership@10970,whole:ClaimOwnership@10987,whole:Route@10812,whole:Route@10819,whole:Route@10887,whole:Route@11222,whole:Route@11599,whole:Route@12985,whole:Route@13514,whole:Route@13815,whole:Route@7925,whole:Route@7936,whole:Route@7954,whole:Route@8140,whole:Route@8509,whole:Route@8518,whole:Route@9951 da6e3c45950cb9ebb61d49a080fcb700a3a0bf373354269f503e52abe71cb72d

+@legacy 047df94a818a724f8f2a922d08335c594677e9604cdd637c396f7d3465b893a6 internal/telemetry/telemetry.go Resolve legacy accepted-legacy accepted-legacy;rev3=J4;basis=root-input;rev3=PROPOSED-s3-change-index;identity=unchanged (the console and the agent);basis=the fold over the defaults moved into Fold, which the agent's switch pass calls over cached settings; the same two telemetry.Read calls, offsets moved file:Read@167,file:Read@279 a8ebfdad89a2b5ca7d41883bfe62c5c7a4a0989cf44909a131026b95178890f2

+internal/telemetry/telemetry.go Resolve legacy accepted-legacy accepted-legacy;rev3=J4;basis=root-input;rev3=PROPOSED-s3-change-index;identity=unchanged (the console and the agent);basis=the fold over the defaults moved into Fold, which the agent's switch pass calls over cached settings; the same two telemetry.Read calls, offsets moved file:Read@167,file:Read@279 a8ebfdad89a2b5ca7d41883bfe62c5c7a4a0989cf44909a131026b95178890f2

+internal/host/activation_command_linux.go runSystemClaims authority G,J4 rev3=census-ruling-install-console-upgrade;identity=explicit operator CLI uid 0;basis=as census-ruling-claim-step6-artifacts-fix1; install-console also takes --upgrade --from <sha256>, which upgradeFlagsRefused (no read site) admits only together and only for install-console, refusing them elsewhere as unknown flags were; without --upgrade the install path and its output are unchanged;rev3=PROPOSED-s3-change-index;identity=explicit operator CLI uid 0;basis=opens the deployment store with NewDeploymentS3StoreIn in place of NewS3StoreIn, so its deployment-bucket writes bump control/changes.json after they succeed (the bump reads and rewrites only that object and decides nothing else); read site unchanged, offset moved file:Read@1771 7541f194a34f6e85b8176e5ebb7302d9f99582caa3e40bef034af0e1ba6180c8

+internal/host/agent.go fastConvergeLoop authority B3 rev3=census-ruling-moves-offline;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body (census-ruling-carlos-run) with the offline keep view read before the first reconcile pass (refreshOfflineView); read sites unchanged, offsets moved; main's B3 authority retained;rev3=PROPOSED-s3-change-index;identity=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos);basis=the full pass's legs moved unchanged into passLegs.full (changeindex.go), shared with the scoped pass; armed, it sets the watch, the scoped pass, the backstop request and the canary gate on the tick's deps; read sites unchanged, offsets moved; B3 authority retained whole:Route@7551,whole:Route@8114 698576b28047cf9dd2a8cd7e0e5e1743c69a6c7b58faa3bbbc8e79e079fa3609

+internal/host/agent.go runAgent authority B,C,D,F rev3=census-ruling-seeded-instances;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body with wireSeedPlacement called in the activator start's Configure step, before armMovesPass, and the startup sweep's result stored for the import rollback in Recover; read sites unchanged, offsets moved; main's B,C,D,F authority retained PROPOSED E46: captured claim selection and root journal mutation; root RPC outside service host exclusion; SQL/route data never grants root authority. Executing identity: service controller; root for inventory/retirement callbacks.;rev3=PROPOSED-325;identity=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos);basis=passes the agent's log sink to armRunsPass; reads unchanged;rev3=PROPOSED-s3-change-index;identity=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos);basis=arms the change index (armChangeIndex) and starts the record view's backstop loop before the loops that read through it, and hands the edge the watch loader (edge.WithChangeWatch); read sites unchanged at the same offsets file:Exec@13802,file:Open@731,registry:App@10065,whole:Route@10057,whole:Route@23351 96c68e31c5b6005a0f3a8e71ba5a628f00e501310a0eb19429c5184f6094ffea

+internal/release/adopt.go PassFilter authority B3,E3,J1,E1,E2 Signed named-unit recovery is independent of release and health history. Root rechecks canonical source, unit, process, signed target and trusted live pointer; captures attempt authority before publication; verifies readiness and resumes without repeated effects. Fixtures: TestPlan14SignedActiveFixIgnoresHistory, TestPlan14SignedActiveFixAuthority, TestPlan14SignedFixSupersedesOlderAttempt, TestPlan14ActiveRecoveryProcessCrash, TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14SignedRestartRequiresTrustedLiveLink. E7 applies merge ruling 4: unbound no-census routes use the legacy pass and restart; ordinary candidates make no binding store call. Fixtures: TestR2UnguardedERecoveryUpdate, TestR2UnguardedERecoveryIncidentRecipe, TestPlan14ERecoveryBindingRefusalKeepsPromotedFix. E19: both destructive readers use the root reservation snapshot under existing release exclusion. Exact artifact and containing-tree identities are retained; missing completeness refuses destruction. Production installation/launch/kernel completeness and verified retirement remain unfinished. Fixtures: TestPlan14GenerationDeletionCannotUnpin, TestPlan14GenerationSnapshotCompleteness, TestPlan14GenerationSnapshotPermitsUnreservedRestage, TestPlan14GenerationSnapshotPinsContainingTree, TestPlan14GenerationSnapshotEmptyIsUnknown, TestPlan14GenerationConsumerMode.;rev3=PROPOSED-p3;run=8;identity=carlos adopt uid 0; legacy agent pass uid carlos;basis=resolves protected route inputs before filters, recovery and dispatch on census boxes and bypasses service-owned failure opener only there;rev3=PROPOSED-s3-change-index;identity=carlos adopt uid 0; legacy agent pass uid carlos;basis=asks the optional pointer gate (gatePointers) once per channel group before selection and reports each group's pointer outcome to it; only the agent's fast sweep arms a gate (WithPointerGate), so under carlos adopt the gate is nil and the pass is unchanged; a gate can only leave a group out of the pass, never add one; one whole-Route site added registry:App@10095,registry:App@27134,registry:App@29591,registry:App@30083,registry:App@30320,registry:App@31727,registry:App@6740,registry:App@9954,registry:Hibernate@29966,registry:Host@1061,registry:Host@1426,registry:Host@30136,registry:Host@31052,registry:Host@31780,registry:Host@3413,registry:Host@3480,registry:Host@3576,registry:Host@3611,registry:UpdateSettings@9832,whole:Route@10090,whole:Route@1046,whole:Route@1164,whole:Route@1188,whole:Route@1461,whole:Route@1622,whole:Route@27129,whole:Route@2726,whole:Route@2768,whole:Route@2877,whole:Route@2901,whole:Route@2932,whole:Route@29586,whole:Route@29844,whole:Route@29866,whole:Route@29913,whole:Route@29931,whole:Route@29941,whole:Route@29984,whole:Route@30005,whole:Route@30018,whole:Route@30078,whole:Route@30104,whole:Route@30178,whole:Route@30217,whole:Route@30233,whole:Route@30261,whole:Route@30315,whole:Route@30341,whole:Route@3074,whole:Route@31094,whole:Route@31148,whole:Route@31164,whole:Route@3139,whole:Route@31671,whole:Route@31722,whole:Route@31748,whole:Route@31822,whole:Route@31857,whole:Route@31873,whole:Route@3225,whole:Route@3247,whole:Route@3347,whole:Route@4430,whole:Route@5077,whole:Route@6662,whole:Route@6684,whole:Route@6735,whole:Route@6761,whole:Route@761,whole:Route@803,whole:Route@950,whole:Route@9783,whole:Route@988,whole:Route@9897,whole:Route@9942 16886bf9c97cfa09c83696c8551dd8754d618deecc84089a216e1c4923b7ba11

+internal/release/adopt.go type passConfig authority E2,E3 E19: both destructive readers use the root reservation snapshot under existing release exclusion. Exact artifact and containing-tree identities are retained; missing completeness refuses destruction. Production installation/launch/kernel completeness and verified retirement remain unfinished. Fixtures: TestPlan14GenerationDeletionCannotUnpin, TestPlan14GenerationSnapshotCompleteness, TestPlan14GenerationSnapshotPermitsUnreservedRestage, TestPlan14GenerationSnapshotPinsContainingTree, TestPlan14GenerationSnapshotEmptyIsUnknown, TestPlan14GenerationConsumerMode, TestPlan14GenerationProductionModeGate, TestPlan14GenerationSnapshotPermitsFreshTree.;rev3=PROPOSED-p3;run=8;identity=carlos adopt uid 0; legacy agent pass uid carlos;basis=stores the typed census-only root update provider and per-pass resolved input authority;rev3=census-ruling-315;identity=legacy agent pass uid carlos (RootRestartsUnits; never set on carlos adopt);basis=adds the unitsToRoot bool set by RootRestartsUnits; reads nothing;rev3=PROPOSED-s3-change-index;identity=carlos adopt uid 0; legacy agent pass uid carlos;basis=adds the pointerGate field, set only by WithPointerGate (the agent's fast sweep); reads nothing e0d69f63e9eff24f36565acc22c979ba5e02f3a4834c6bdd22b9b877b35ec0e6

+internal/host/buildstate.go buildStates.refreshAll authority E3,J1,J4 root-route;rev3=PROPOSED-s3-change-index;identity=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos);basis=its body moved into refreshKept, which it calls with a nil filter; reads nothing itself now 4176187b6c2e8f04c5c0852d2f050805d5fffa90f00cb2239c5a56820b0f5716

+@legacy e3977adb7e4ca02f89764e24f57d69f14f5d7083ad7b7e113b62a7042759aba0 internal/appconfig/syncexec.go syncOptions.kept legacy accepted-legacy accepted-legacy;rev3=PROPOSED-s3-change-index;basis=root-route; J1, as SyncExecWithCallbacks; the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): the scoped pass's route filter; a nil filter keeps every route, so it only ever narrows a pass whole:Route@84 c1fdeba96e3f8de8dd74bd1082bc704908de0352b9974229c235f662e8112bca

+internal/appconfig/syncexec.go syncOptions.kept legacy accepted-legacy accepted-legacy;rev3=PROPOSED-s3-change-index;basis=root-route; J1, as SyncExecWithCallbacks; the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): the scoped pass's route filter; a nil filter keeps every route, so it only ever narrows a pass whole:Route@84 c1fdeba96e3f8de8dd74bd1082bc704908de0352b9974229c235f662e8112bca

+@legacy b55d739eb0dea7335f1ac74733f2e960f1b3d3bb210f318ed6cf9835e076a9bc internal/console/store.go Store.AppsWithActionSince legacy accepted-legacy accepted-legacy;rev3=PROPOSED-s3-change-index;basis=root-input; console SQL on its own audit table, a plain SELECT like Store.Events, as its store siblings (J4); the console (cmd/console serve under console.service, user carlos-console): the run sweep's orphan candidates file:Query@102 687ad5b1aa378b7bec6eae7eb6799dc02bd29431a3bb4dab00d5b8ee93a8382b

+internal/console/store.go Store.AppsWithActionSince legacy accepted-legacy accepted-legacy;rev3=PROPOSED-s3-change-index;basis=root-input; console SQL on its own audit table, a plain SELECT like Store.Events, as its store siblings (J4); the console (cmd/console serve under console.service, user carlos-console): the run sweep's orphan candidates file:Query@102 687ad5b1aa378b7bec6eae7eb6799dc02bd29431a3bb4dab00d5b8ee93a8382b

+@legacy f28343c6b0a5ca31cc0d46e1bdd739cd85f0e1c15d45ec4152b17157ced81b0d internal/host/agent.go fastDeps.canaryPointerGate legacy accepted-legacy accepted-legacy;rev3=PROPOSED-s3-change-index;basis=root-route; J1, as fastTick; the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): the fast sweep's pointer gate skips a canary group's pointer read only while its app scope has not moved, its last good read is younger than the backstop, and every route of the group is live on that read's head (canarySettled); otherwise the pointer is read as before. Non-canary groups are never gated whole:Route@486 292b54654ad519079463fa62fd0b77fed4082ed451143a5315f804a6b4b0df92

+internal/host/agent.go fastDeps.canaryPointerGate legacy accepted-legacy accepted-legacy;rev3=PROPOSED-s3-change-index;basis=root-route; J1, as fastTick; the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): the fast sweep's pointer gate skips a canary group's pointer read only while its app scope has not moved, its last good read is younger than the backstop, and every route of the group is live on that read's head (canarySettled); otherwise the pointer is read as before. Non-canary groups are never gated whole:Route@486 292b54654ad519079463fa62fd0b77fed4082ed451143a5315f804a6b4b0df92

+@legacy 645f221929437d885441b81d21e99723934e93784dd32b99b95b86ed60aa3431 internal/host/agent.go fastDeps.canarySettled legacy accepted-legacy accepted-legacy;rev3=PROPOSED-s3-change-index;basis=root-route; J1, as fastTick; the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): compares each route's live version (release.LiveVersion under the agent's opt dir) with the group's last good head; any doubt answers false and the pointer is read registry:Host@244,whole:Route@137,whole:Route@190 0755dca3a80d24fda9fbff0cc9dd46f981d82aa9a897e0e2da0a2bd606a83928

+internal/host/agent.go fastDeps.canarySettled legacy accepted-legacy accepted-legacy;rev3=PROPOSED-s3-change-index;basis=root-route; J1, as fastTick; the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): compares each route's live version (release.LiveVersion under the agent's opt dir) with the group's last good head; any doubt answers false and the pointer is read registry:Host@244,whole:Route@137,whole:Route@190 0755dca3a80d24fda9fbff0cc9dd46f981d82aa9a897e0e2da0a2bd606a83928

+internal/host/buildstate.go buildStates.refreshKept authority E3,J1,J4 root-route;rev3=PROPOSED-s3-change-index;identity=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos);basis=refreshAll's body, moved, with an optional route filter for the scoped pass; a filtered call reads only the hosts it keeps and never moves the rotation point; refreshAll's E3,J1,J4 authority carried over registry:Host@549,whole:Route@442,whole:Route@472,whole:Route@517 ae4f5c22ca45a5234ccf839949f57704a12e7998b40463a845c96b8ddc3e7665

+@legacy 2b132b661a502799e3d1cc6441f558042e84152cdde7a7b3f56985e550e7ff07 internal/host/changeindex.go movedRoutes legacy accepted-legacy accepted-legacy;rev3=PROPOSED-s3-change-index;basis=root-route; J1; the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): the scoped pass's route filter, keeping the routes whose app scope the change index says moved registry:App@297,whole:Route@292 3d4f7ef1ca7ebe9573f8f9b02d9bebcc4f8a8dac6762c4314e5f655575598624

+internal/host/changeindex.go movedRoutes legacy accepted-legacy accepted-legacy;rev3=PROPOSED-s3-change-index;basis=root-route; J1; the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): the scoped pass's route filter, keeping the routes whose app scope the change index says moved registry:App@297,whole:Route@292 3d4f7ef1ca7ebe9573f8f9b02d9bebcc4f8a8dac6762c4314e5f655575598624

+@legacy cbe3829c5481a82e62de8f1a6c02f1491428c194ba7474465818232caf23aa15 internal/host/telemetry_pass.go telemetryReads.read legacy accepted-legacy accepted-legacy;rev3=PROPOSED-s3-change-index;basis=root-input; J4, as telemetry.Resolve; the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): the switch pass's read of one telemetry settings object (telemetry.Read), skipped while its scope has not moved and a last good value is held; a failed read keeps the last good value and marks the scope for a re-read file:Read@396 3fe9990dab690ff466226f7f65939ab82ba09ef31ddd5ab60f6ad3d8b64354f0

+internal/host/telemetry_pass.go telemetryReads.read legacy accepted-legacy accepted-legacy;rev3=PROPOSED-s3-change-index;basis=root-input; J4, as telemetry.Resolve; the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): the switch pass's read of one telemetry settings object (telemetry.Read), skipped while its scope has not moved and a last good value is held; a failed read keeps the last good value and marks the scope for a re-read file:Read@396 3fe9990dab690ff466226f7f65939ab82ba09ef31ddd5ab60f6ad3d8b64354f0

+@legacy 99dc23ec49d8ed4f18d24e660b93e53a72dda9743fbcfc089eff922298880188 internal/host/telemetry_pass.go telemetrySwitchesWith legacy accepted-legacy accepted-legacy;rev3=PROPOSED-s3-change-index;basis=root-route; J1, as telemetrySwitches; the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): telemetrySwitches' body, moved, reading through telemetryReads under its own mutex; a pair with no good value at either level is left off, the safe side of the switch registry:App@459,registry:App@547,registry:App@842,registry:Kind@436,whole:Route@422,whole:Route@521 447b8b5b67dee2c43268dc4176c9b3c5be9383f2c4cf5f19a739b0536553ff01

+internal/host/telemetry_pass.go telemetrySwitchesWith legacy accepted-legacy accepted-legacy;rev3=PROPOSED-s3-change-index;basis=root-route; J1, as telemetrySwitches; the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): telemetrySwitches' body, moved, reading through telemetryReads under its own mutex; a pair with no good value at either level is left off, the safe side of the switch registry:App@459,registry:App@547,registry:App@842,registry:Kind@436,whole:Route@422,whole:Route@521 447b8b5b67dee2c43268dc4176c9b3c5be9383f2c4cf5f19a739b0536553ff01

+@legacy 694edc3d0bd428dd36e2f12b6d0044e94dc7ec1b293fd616893d908fd82d397f internal/provision/recordview_store.go confirmRecordGone legacy accepted-legacy accepted-legacy;rev3=PROPOSED-s3-change-index;basis=root-route; J1, as Reconcile; the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): re-reads the instance record behind rt from the bucket (freshStore) only when Reconcile runs over a record view snapshot; it can only keep a row (absent or out of scope confirms the removal; present and in scope, or unreadable, keeps the row); over any other store it answers true without reading registry:Account@195,registry:App@207,registry:Host@215,registry:Host@428,registry:Host@646 3ba665dac788963a8387bede69c1e714b58c9fd80c96860460e21745d33a579a

+internal/provision/recordview_store.go confirmRecordGone legacy accepted-legacy accepted-legacy;rev3=PROPOSED-s3-change-index;basis=root-route; J1, as Reconcile; the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): re-reads the instance record behind rt from the bucket (freshStore) only when Reconcile runs over a record view snapshot; it can only keep a row (absent or out of scope confirms the removal; present and in scope, or unreadable, keeps the row); over any other store it answers true without reading registry:Account@195,registry:App@207,registry:Host@215,registry:Host@428,registry:Host@646 3ba665dac788963a8387bede69c1e714b58c9fd80c96860460e21745d33a579a

+@legacy ea53a4122d022bb65b87451838a997e51a9f2f444ad3c06d7da5e2d3a1d5058e internal/provision/recordview_store.go confirmSidecarGone legacy accepted-legacy accepted-legacy;rev3=PROPOSED-s3-change-index;basis=root-route; J1, as ReconcileSidecars; the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): confirmRecordGone for a sidecar row's record; it can only keep a row; over any other store it answers true without reading registry:Account@210,registry:App@222,registry:Host@451,registry:Host@498,registry:Host@700,registry:Slug@230 c86f50acb20c1f2b8058b708c035640fbd8ed511f05b6b2e0d00317baa2e907a

+internal/provision/recordview_store.go confirmSidecarGone legacy accepted-legacy accepted-legacy;rev3=PROPOSED-s3-change-index;basis=root-route; J1, as ReconcileSidecars; the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): confirmRecordGone for a sidecar row's record; it can only keep a row; over any other store it answers true without reading registry:Account@210,registry:App@222,registry:Host@451,registry:Host@498,registry:Host@700,registry:Slug@230 c86f50acb20c1f2b8058b708c035640fbd8ed511f05b6b2e0d00317baa2e907a

+@legacy a5465363888fad7a0da13831699aad0c7ed0df31228b7afcf3da62a3f9086f93 internal/provision/recordview_store.go snapStore.Open legacy accepted-legacy accepted-legacy;rev3=PROPOSED-s3-change-index;basis=root-input; J4, as the other store wrappers' Open; the agent and the console through the record view: forwards to the live store (release.OpenObject); the snapshot caches no bodies for Open file:Open@20 41ea2555c81b1091989cf1acd25b6ccf8c7081a6135f0a86e128b3c9fd775e1c

+internal/provision/recordview_store.go snapStore.Open legacy accepted-legacy accepted-legacy;rev3=PROPOSED-s3-change-index;basis=root-input; J4, as the other store wrappers' Open; the agent and the console through the record view: forwards to the live store (release.OpenObject); the snapshot caches no bodies for Open file:Open@20 41ea2555c81b1091989cf1acd25b6ccf8c7081a6135f0a86e128b3c9fd775e1c

+internal/release/adopt.go passConfig.gatePointers authority B3,E3,J1 root-route;kept=B3,E3;scope=protected-decision-only;rev3=PROPOSED-s3-change-index;identity=carlos adopt uid 0 (gate nil: returns adopts unchanged, reads nothing); the agent's fast sweep uid carlos (gate armed);basis=groups the routes adopts admits by (account, app, channel) and asks the gate once per group; it can only narrow adopts, never widen it; PassFilter's B3,E3,J1 authority registry:App@305,whole:Route@300,whole:Route@326,whole:Route@420,whole:Route@442,whole:Route@479,whole:Route@497,whole:Route@548,whole:Route@567,whole:Route@578,whole:Route@750,whole:Route@955,whole:Route@979 e9f5ff820fdf8522b3613b9c102c32d474391cf83761c6f5795629fadea02c31

+@legacy 17e4b1fcf789646f705702fd2a975867a5f50aae1760453a9f944b9f2bf246f8 internal/release/conditional_delete.go DirStore.deleteIfMatchRaw legacy accepted-legacy accepted-legacy;rev3=PROPOSED-s3-change-index;basis=root-input; J4, as DirStore.DeleteIfMatch was; every process that opens a deployment store, as its siblings: DeleteIfMatch's body and its one site, moved unchanged; DeleteIfMatch calls it and bumps the change index after a successful delete file:ReadFile@244 987f7f91ca5755752e5cc672eb3ff1a83bbaa5848bc0e08bd7ea4d9965121fbb

+internal/release/conditional_delete.go DirStore.deleteIfMatchRaw legacy accepted-legacy accepted-legacy;rev3=PROPOSED-s3-change-index;basis=root-input; J4, as DirStore.DeleteIfMatch was; every process that opens a deployment store, as its siblings: DeleteIfMatch's body and its one site, moved unchanged; DeleteIfMatch calls it and bumps the change index after a successful delete file:ReadFile@244 987f7f91ca5755752e5cc672eb3ff1a83bbaa5848bc0e08bd7ea4d9965121fbb

+@legacy 9c4c1dc2689813405f2ec1d88145de6789af4d5e27598c9156b06b7332021360 internal/release/store.go DirStore.putRaw legacy accepted-legacy accepted-legacy;rev3=PROPOSED-s3-change-index;basis=root-input; J4, as DirStore.Put was; every process that opens a deployment store, as its siblings: Put's body and its one site, moved unchanged; Put calls it and bumps the change index after a successful write file:Stat@443 6fa73bb52e3eddf17d11f45f0e528041f8e0d9ad2f99a04b784b3c920bb16715

+internal/release/store.go DirStore.putRaw legacy accepted-legacy accepted-legacy;rev3=PROPOSED-s3-change-index;basis=root-input; J4, as DirStore.Put was; every process that opens a deployment store, as its siblings: Put's body and its one site, moved unchanged; Put calls it and bumps the change index after a successful write file:Stat@443 6fa73bb52e3eddf17d11f45f0e528041f8e0d9ad2f99a04b784b3c920bb16715

+@legacy 076c048c2d32b1f45a7da2f122482962173398a35efbb447f7613d54c7487635 internal/release/store.go DirStore.putFromRaw legacy accepted-legacy accepted-legacy;rev3=PROPOSED-s3-change-index;basis=root-input; J4, as DirStore.PutFrom was; every process that opens a deployment store, as its siblings: PutFrom's body and its one site, moved unchanged; PutFrom calls it and bumps the change index after a successful write file:Stat@462 036cd7896e1c78439bdd7cecc6764f98945047ad48412b37780d7ec846e25831

+internal/release/store.go DirStore.putFromRaw legacy accepted-legacy accepted-legacy;rev3=PROPOSED-s3-change-index;basis=root-input; J4, as DirStore.PutFrom was; every process that opens a deployment store, as its siblings: PutFrom's body and its one site, moved unchanged; PutFrom calls it and bumps the change index after a successful write file:Stat@462 036cd7896e1c78439bdd7cecc6764f98945047ad48412b37780d7ec846e25831

+@legacy 96662d9835256b9fb8a396eacf16fa81fc8d2b70ff06efa375cc13d3391100f3 internal/release/store.go DirStore.ListETags legacy accepted-legacy accepted-legacy;rev3=PROPOSED-s3-change-index;basis=root-input; J4, as DirStore.ListMod; every process that opens a deployment store, as its siblings: ListMod's walk with each file's content hash, the ETag listing the record view reads file:WalkDir@145 ac8b82bdec3524884d46fcc8d0c0daed2eae75e9d8438577567f4221cea1fe82

+internal/release/store.go DirStore.ListETags legacy accepted-legacy accepted-legacy;rev3=PROPOSED-s3-change-index;basis=root-input; J4, as DirStore.ListMod; every process that opens a deployment store, as its siblings: ListMod's walk with each file's content hash, the ETag listing the record view reads file:WalkDir@145 ac8b82bdec3524884d46fcc8d0c0daed2eae75e9d8438577567f4221cea1fe82

+@legacy c93045dc7bc00cc27518f23dba471a499989b910d0197bf2b3d99d94d12f916c internal/release/store.go S3Store.GetIfChanged legacy accepted-legacy accepted-legacy;rev3=PROPOSED-s3-change-index;basis=root-input; J4, as S3Store.Get; every process that opens a deployment store, as its siblings: S3Store.Get's read sent with If-None-Match, a 304 answering unchanged without the body file:ReadAll@511 959fea16d1332f47c2444ced07034544d733b4d831b7b0382517e100aa431dcc

+internal/release/store.go S3Store.GetIfChanged legacy accepted-legacy accepted-legacy;rev3=PROPOSED-s3-change-index;basis=root-input; J4, as S3Store.Get; every process that opens a deployment store, as its siblings: S3Store.Get's read sent with If-None-Match, a 304 answering unchanged without the body file:ReadAll@511 959fea16d1332f47c2444ced07034544d733b4d831b7b0382517e100aa431dcc

+# Four frozen units still declared now read nothing; each is retired by an H3 census-ruling removal, in the form email-signin used. A removal is not in the seal.

+@remove internal/release/store.go DirStore.Put

+@removed internal/release/store.go DirStore.Put H3 census-ruling-s3-change-index (PROPOSED, awaiting the census owner on #280): still declared, and reads nothing now: its body and its one site (file:Stat) moved unchanged into DirStore.putRaw, an accepted-legacy row in this overlay; Put calls it and, after a successful write, bumps the change index.

+@remove internal/release/store.go DirStore.PutFrom

+@removed internal/release/store.go DirStore.PutFrom H3 census-ruling-s3-change-index (PROPOSED, awaiting the census owner on #280): still declared, and reads nothing now: its body and its one site (file:Stat) moved unchanged into DirStore.putFromRaw, an accepted-legacy row in this overlay; PutFrom calls it and, after a successful write, bumps the change index.

+@remove internal/release/conditional_delete.go DirStore.DeleteIfMatch

+@removed internal/release/conditional_delete.go DirStore.DeleteIfMatch H3 census-ruling-s3-change-index (PROPOSED, awaiting the census owner on #280): still declared, and reads nothing now: its body and its one site (file:ReadFile) moved unchanged into DirStore.deleteIfMatchRaw, an accepted-legacy row in this overlay; DeleteIfMatch calls it and, after a successful delete, bumps the change index.

+@remove internal/host/telemetry_pass.go telemetrySwitches

+@removed internal/host/telemetry_pass.go telemetrySwitches H3 census-ruling-s3-change-index (PROPOSED, awaiting the census owner on #280): still declared, and reads nothing now: its body and its six sites moved into telemetrySwitchesWith, an accepted-legacy row in this overlay, which it calls with the process's telemetryReads and the time. It runs in the agent as carlos.

+# Envelopes re-pinned: ., cmd/console, internal/appconfig, internal/console, internal/edge, internal/host, internal/hostops, internal/ops, internal/provision, internal/release, internal/telemetry, internal/vet. The scan's only read-site changes are the rows above.

+@coverage . f181735991e3c549167c6845c3b280ca5554c5f598c66b02c08447b566e2135f

+@coverage cmd/console 3f8cf7ac42db92a130af5bba06bdd34f5f53bd8728ee7ff7bf0a51d20a11a6ee

+@coverage internal/appconfig ec91c8e0e6bc3599f021ff360e1549559bf61d80d60d8dd9ae9ef0c38bd5503c

+@coverage internal/console b427d685dcf5ebcba922529f27ec85e358f73f9d539f53da1e9d627d187d1373

+@coverage internal/edge f9552de00786e2d31023a7bd4835a0eb86c754b295a2659c5c70c4ded00ba431

+@coverage internal/host 02bf9d577ced0f1f630cbd4618631e3c2811f996224287ecb944fb94ffb9e2c7

+@coverage internal/hostops fe58f0e6036bfccdf39ab6d9575addf11f94f87b17fd139964b4f5f22cb93be4

+@coverage internal/ops afe4c144d6cd68e3fc46b2967767b605747300dead1259e81a484276b1b1088b

+@coverage internal/provision 1e213d9d9e698cecf266dfd855129dbadc1c1707fa47bf4b33fdc77919d72397

+@coverage internal/release 55ea0a4bb25f00c3b4494ae4cd6129d072c9311e81ddc908260192540008739a

+@coverage internal/telemetry 4f3f802bac2db2136eeaaee607678f34a629e19d305f327f42f34594a6ff65f8

+@coverage internal/vet 933738430ab95c59f0570e0d892f91c99c3de8cfcc6b2f7d8b1caaad21c1847d