carlos / platform Public

provision: census for the final review's fix round 4

The internal/console envelope re-pinned in place (the cleanup's panic
recovery); no unit row changes and the seal stands.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude 1 day ago 3cae338167fbd24b45788c9ddd5669eda4b763a2 parent d91ad10

2 files changed, +4 −1

docs/superpowers/notes/census-proposal-self-serve-moves-2.md +2 −0
internal/provision/testdata/plan14-root-reads-self-serve-moves-2.tsv +2 −1

diff --git a/docs/superpowers/notes/census-proposal-self-serve-moves-2.md b/docs/superpowers/notes/census-proposal-self-serve-moves-2.md

index 682cb64a8..42d677f1d 100644

--- a/docs/superpowers/notes/census-proposal-self-serve-moves-2.md

+++ b/docs/superpowers/notes/census-proposal-self-serve-moves-2.md

@@ -55,3 +55,5 @@ The final review's fix round (console half) adds no root read, class or task and

The final review's fix round 2 adds no root read, class or task and no record write. In the root-read overlay `serve` (paging armed through `startPaging` from the start scan's own evidence, then the bootstrap orphan page) and `Store.SelfServeRecoveryPending` (`QueryRowContext` under the evidence read's 30 s bound) are re-pinned in place with their bases extended; the cmd/console, internal/console and internal/provision envelopes are re-pinned in place, and the seal moves to `f7f1a9f9…`. In the record-write inventory `SetRecordMoveAt` (the request's proposed stamp as the move's updated_at under `Expect.Stamp`, so a replay writes the same bytes; operator doors pass none), `Server.selfServeRun` (passes that stamp) and `Server.readOfflineEvidence` (judged at the pass's clock; a key-site) are re-pinned. The return index deleter now deletes the sweep's judged entry only (`deleteReturnIndexEntryAt`, `DeleteIfMatch` on the ETag the sweep read), and the expiry pass's hourly store sweep (`trashSweep`) also runs the index sweep (`returnSweepHourly`, 256 entries and 30 s at most) whatever the self-serve mode; neither is a Put-family unit, so neither has an inventory row. The writers list is otherwise unchanged.

The final review's fix round 3 adds no root read, class or task, no record write and no writer, and re-pins no unit row. The return door's index cleanup now runs detached after the serial bump and the 202 (counted in the server's `detached` WaitGroup, which `Server.Shutdown` waits for), the hourly index sweep takes the shared mutex with TryLock-or-skip and lists one page of at most 256 keys through `release.PageLister`, and the journal half of the evidence read is abandoned at its deadline (`journalPending`). Only the internal/console envelope is re-pinned in place, and the seal stands at `f7f1a9f9…`. The writers list is unchanged.

+The final review's fix round 4 adds no root read, class or task, no record write and no writer, and re-pins no unit row: the return door's detached index cleanup recovers a panic and logs it with the move id. Only the internal/console envelope is re-pinned in place, and the seal stands at `f7f1a9f9…`.

diff --git a/internal/provision/testdata/plan14-root-reads-self-serve-moves-2.tsv b/internal/provision/testdata/plan14-root-reads-self-serve-moves-2.tsv

index eaf649ef7..93e595ebc 100644

--- a/internal/provision/testdata/plan14-root-reads-self-serve-moves-2.tsv

+++ b/internal/provision/testdata/plan14-root-reads-self-serve-moves-2.tsv

@@ -23,7 +23,7 @@ internal/console/templates/settings.html external legacy accepted-legacy accepte

internal/provision/offline_move.go offlineBegin legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=root-input (J4, as OfflineStart); the console (cmd/console serve under console.service, user carlos-console): self-serve moves 1 Task 7's body (OfflineStart's, the state a parameter; a direct start advances move_seq and stamps move.seq, refusing ErrLifetimeExhausted at MaxInt64 before any write), and it now also creates the self-serve move in offline-queued for OfflineQueue (queued_at, staged_at and precheck_at at the caller's stamp, move.seq set to the record's move_seq, no advance) and records return_of; a stage and a queue hold nothing; its one site is still rec.ActiveRun.Open(), a method on the record's run state (RunState.Open), not a file read; self-serve moves 2 Task 2 file:Open@208 0a9b432ddf2f39a977c0651e377258b35c1d05635e9979583eeac6253d6c0ec8

@coverage internal/provision c05f991c074ee6bf4a79352116c2402a479eae8cb43371b9316abe0baaf49d2d

# Task 3 (per-box reservations with a legacy projection and a sentinel, the fenced reclaim and the operator doors' bound admission), rev3=PROPOSED-self-serve-moves-2: no root read, class or task is added and no accepted-legacy unit is re-pinned, so the seal does not move. The new units (moves.ParseOfflineActive, moves.OfflineActiveBody, the console's offlinereserve.go, the doors' offlineApplyBound and offlineAdvanceBound) read no file: their reads are the bucket's control/offline-moves/active.json and the instance record through the judged readers and fenceRecord. Envelopes re-pinned in place (Task 2's rows replaced): internal/console (offlinereserve.go, the start and stage doors, the Server's two evidence fields) and internal/moves (the reservation table in offline.go).

-@coverage internal/console 17ba046f9a80b899eda3be28bd904b4d5475c1f0602a07a2e2d9e90e11c92821

+@coverage internal/console 9fe3acf3fc8d2d31cb178368a10e2fdce74a474e351999680de9aefa2e770f8a

@coverage internal/moves bcac95270e69cdea56c9af080d134cc13586be1a0b7d079928372aded9df17ac

# Task 4 (the journal, the events table, the console lease and the pass skeleton), rev3=PROPOSED-self-serve-moves-2: no root read, class or task is added. The console SQLite journal (selfserve_store.go) adds twenty-two units, each frozen accepted-legacy with a reviewed basis (console SQL as carlos-console, no bucket or root action), and the lease's console name adds one crypto/rand read (Server.selfServeConsoleID); serve (in place: the paging arm takes the store, the pass is started), NewServer (the row evidence and the recovery-mode scan) and Store.migrate (migrateSelfServe) are re-pinned. The seal moves. The lease and the pass read control/offline-moves/console.json and active.json from the bucket, not a file. Envelopes re-pinned in place: cmd/console, internal/console and internal/provision (WithWriteGuard in WriteRecord).

@legacy a8dd51a494ab3cd2ad371ded2850b6d78492569729527ea82cd8dd0f2b418a78 internal/console/selfserve_lease.go Server.selfServeConsoleID legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: reads crypto/rand once per process for the random console name the self-serve moves lease carries; randomness grants no root authority file:Read@110 3303b18ec5c77ccaf662064801f94276bfe947c31378cc1ecb8c4fe509d5d4d1

@@ -241,3 +241,4 @@ internal/console/selfserve_store.go Store.ConfirmSelfServeRequestLanded legacy a

@coverage internal/alerting d70d1997f5fb0d2e8b948c56b4e9e65159ea7e9488a95cc737715ebe2bedd675

# Final review fix round 2, rev3=PROPOSED-self-serve-moves-2: no root read, class or task is added. serve (startPaging: the arm from the start scan's evidence, then the bootstrap orphan page, item 6) and Store.SelfServeRecoveryPending (QueryRowContext under the evidence read's bound, item 5) are re-pinned in place with their bases extended, sites unchanged in kind. The cmd/console, internal/console and internal/provision envelopes are re-pinned in place. The seal moves.

# Final review fix round 3, rev3=PROPOSED-self-serve-moves-2: no root read, class, task or unit row changes. The return door's index cleanup runs detached after the answer (Server.Shutdown waits for it), the hourly index sweep is TryLock-or-skip and lists one bounded page, and the journal read is abandoned at the evidence read's deadline (journalPending); none adds a read site. The internal/console envelope is re-pinned in place; the seal stands.

+# Final review fix round 4, rev3=PROPOSED-self-serve-moves-2: no root read, class, task or unit row changes. The return door's detached index cleanup recovers a panic and logs it; no read site is added. The internal/console envelope is re-pinned in place; the seal stands.