amadan
plan: self-serve moves 1 rev 17 (Astra review 16: app lifecycle checked under the lock, a lock table, one-transaction cancellation, apps.lifetime id, box purge fenced at the marker, purge acts only on its own slots, judged restore evidence) and 2 rev 9 (Astra review 8: reconciliation to phase and substep, abandonment only when leaving a wait, expiry committed against the cut, the handoff's substep persisted)
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2 files changed,
+20
−20
docs/superpowers/plans/2026-10-22-self-serve-moves-1-lifetimes-and-order.md+11 −11docs/superpowers/plans/2026-10-22-self-serve-moves-2-door-token-job.md+9 −9
CI failed — run details
CI log
amadan: log truncated — showing the last 209503 bytes of 1048751
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopping (cutting-stopping)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopping
2026/10/22 10:31:50 moves: a.go.example.com: the claim follows rollback rb_lki6hkh6pkkpxjrhdxamaigrh4
2026/10/22 10:31:50 moves: a.go.example.com: generation mv_abcdefghijklmnopqrstuvwxyz built at TXID 3
2026/10/22 10:31:50 moves: a.go.example.com: sealed 4 replica objects at TXID 3
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz published (landing-published)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is published
2026/10/22 10:31:50 moves: a.go.example.com: generation rb_abcdefghijklmnopqrstuvwxyz built at TXID 3
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz archived (cutting-archived)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is archived
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz archived (cutting-archived)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is archived
2026/10/22 10:31:50 moves: a.go.example.com: database installed at /tmp/TestSourceParkWaitsForCommita_committed_record_whose_claim_is_n3909451405/005/a.go.example.com.db (sha256:ae0661eb68be3f7cf598dba7530492d53b78f5082395b4a1ac8e1f86ea82228d), generation mv_abcdefghijklmnopqrstuvwxyz
2026/10/22 10:31:50 moves: a.go.example.com: the target of rollback rb_lki6hkh6pkkpxjrhdxamaigrh4 stopped at TXID 3 (clean false, src_covered false)
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz published (rolling_back-source-published)
2026/10/22 10:31:50 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is published
2026/10/22 10:31:50 moves: a.go.example.com: the target of rollback rb_lki6hkh6pkkpxjrhdxamaigrh4 is released
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz flipped (cutting-flipped)
2026/10/22 10:31:50 moves: a.go.example.com: flipped to uk
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz flipped (cutting-flipped)
2026/10/22 10:31:50 moves: a.go.example.com: flipped to uk
2026/10/22 10:31:50 moves: a.go.example.com: the target gave execution up for rollback rb_lki6hkh6pkkpxjrhdxamaigrh4, citing moves/bab/app/a.go.example.com/mv_abcdefghijklmnopqrstuvwxyz/stopped-target.json
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopped (cutting-stopped)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopped
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz local (rolling_back-source-local)
2026/10/22 10:31:50 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is local
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz restored (landing-restored)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is restored
2026/10/22 10:31:50 moves: a.go.example.com: the target of rollback rb_lki6hkh6pkkpxjrhdxamaigrh4 is returning
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz waits at restored: this box has no probe wake (claim Plan 11's launcher and Plan 5 Task 9's arming are needed)
2026/10/22 10:31:50 moves: a.go.example.com: stopped at TXID 3; execution given up, citing moves/bab/app/a.go.example.com/mv_abcdefghijklmnopqrstuvwxyz/stopped-source.json
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz ready (ready)
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz local (landing-local)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is local
2026/10/22 10:31:50 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz is ready (last round moved 1815 bytes; bar 16777216)
2026/10/22 10:31:50 moves: a.go.example.com: read the sealed build state moves/a.go.example.com/mv_abcdefghijklmnopqrstuvwxyz/state/build-state.json: the version is 87 bytes, sealed as 88
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz parking (landing-parking)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is parking
2026/10/22 10:31:50 moves: a.go.example.com: the source's artifacts of stamp 1 are retired
2026/10/22 10:31:50 moves: a.go.example.com: sealed 4 replica objects at TXID 3
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz staged (cutting-staged)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is staged
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz cut_requested (cutting-requested)
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz building (landing-building)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is building
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz ready (ready)
2026/10/22 10:31:50 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz is ready (last round moved 1815 bytes; bar 16777216)
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz staged (cutting-staged)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is staged
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz admitted (cutting-admitted)
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz cut_requested (cutting-requested)
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz archived (cutting-archived)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is archived
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopping (cutting-stopping)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopping
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz archived (cutting-archived)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is archived
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz flipped (cutting-flipped)
2026/10/22 10:31:50 moves: a.go.example.com: flipped to uk
2026/10/22 10:31:50 moves: a.go.example.com: the source's artifacts of stamp 5 are retired
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopped (cutting-stopped)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopped
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz flipped (cutting-flipped)
2026/10/22 10:31:50 moves: a.go.example.com: flipped to uk
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz admitted (cutting-admitted)
2026/10/22 10:31:50 moves: a.go.example.com: the local artifacts of rb_abcdefghijklmnopqrstuvwxyz are parked in /tmp/TestDirtyReturnRetiresRetiredStampLeftovers3190238682/002/.parked/cc4fe64fa6da6232556d039690a7c19690555ce5d542faba1e57a3d3c896c3bb/a.go.example.com/d4a376247fb7ee3d7bcab5b729de25bd
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopping (cutting-stopping)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopping
2026/10/22 10:31:50 moves: a.go.example.com: stopped at TXID 3; execution given up, citing moves/bab/app/a.go.example.com/mv_abcdefghijklmnopqrstuvwxyz/stopped-source.json
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopped (cutting-stopped)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopped
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz parking (landing-parking)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is parking
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz parking (landing-parking)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is parking
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz building (landing-building)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is building
2026/10/22 10:31:50 moves: a.go.example.com: stopped at TXID 3; execution given up, citing moves/bab/app/a.go.example.com/mv_abcdefghijklmnopqrstuvwxyz/stopped-source.json
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz building (landing-building)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is building
2026/10/22 10:31:50 moves: a.go.example.com: sealed 4 replica objects at TXID 3
2026/10/22 10:31:50 moves: a.go.example.com: sealed 4 replica objects at TXID 3
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz staged (cutting-staged)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is staged
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz staged (cutting-staged)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is staged
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz archived (cutting-archived)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is archived
2026/10/22 10:31:50 moves: a.go.example.com: the prepared files manifest instances/a.go.example.com/files/g-mv_abcdefghijklmnopqrstuvwxyz/manifest.json is written (sha256 bdd5101a4adb10e6490f5f54780ae99c4392728e66784a373d480b548b961831)
2026/10/22 10:31:50 moves: a.go.example.com: files, environment, timers and columns installed; .files-gen written
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz flipped (cutting-flipped)
2026/10/22 10:31:50 moves: a.go.example.com: flipped to uk
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz configured (landing-configured)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is configured
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz archived (cutting-archived)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is archived
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz requested (requested)
2026/10/22 10:31:50 moves: a.go.example.com: the prepared files manifest instances/a.go.example.com/files/g-rb_abcdefghijklmnopqrstuvwxyz/manifest.json is written (sha256 55dbb82acc5c0c115c4dafe3b5bb8fd1a6b54694ab110cf32b00cbad0e10f430)
2026/10/22 10:31:50 moves: a.go.example.com: generation mv_abcdefghijklmnopqrstuvwxyz built at TXID 3
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz flipped (cutting-flipped)
2026/10/22 10:31:50 moves: a.go.example.com: flipped to uk
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz published (landing-published)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is published
2026/10/22 10:31:50 moves: a.go.example.com: files, environment, timers and columns installed; .files-gen written
2026/10/22 10:31:50 moves: a.go.example.com: staged the files archive sha256:c9229ef8e7256a1dcd5c2715b11ac3016951e8fee8e0bfa823aa2460f0d331c8 (2 files, 19 bytes)
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz configured (rolling_back-source-configured)
2026/10/22 10:31:50 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is configured
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz local (landing-local)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is local
2026/10/22 10:31:50 moves: a.go.example.com: not ready: the target has not published a readiness report yet
2026/10/22 10:31:50 moves: a.go.example.com: generation mv_abcdefghijklmnopqrstuvwxyz built at TXID 3
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz published (landing-published)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is published
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz parking (landing-parking)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is parking
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz local (landing-local)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is local
2026/10/22 10:31:50 moves: a.go.example.com: the prepared files manifest instances/a.go.example.com/files/g-mv_abcdefghijklmnopqrstuvwxyz/manifest.json is written (sha256 bdd5101a4adb10e6490f5f54780ae99c4392728e66784a373d480b548b961831)
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz ready (ready)
2026/10/22 10:31:50 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz is ready (last round moved 1815 bytes; bar 16777216)
2026/10/22 10:31:50 moves: a.go.example.com: files, environment, timers and columns installed; .files-gen written
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz configured (landing-configured)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is configured
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz building (landing-building)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is building
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz cut_requested (cutting-requested)
2026/10/22 10:31:50 moves: a.go.example.com: database installed at /tmp/TestCommittedOpenWaitsUnarmed74457357/005/a.go.example.com.db (sha256:ae0661eb68be3f7cf598dba7530492d53b78f5082395b4a1ac8e1f86ea82228d), generation mv_abcdefghijklmnopqrstuvwxyz
2026/10/22 10:31:50 moves: a.go.example.com: generation mv_abcdefghijklmnopqrstuvwxyz built at TXID 3
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz admitted (cutting-admitted)
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopping (cutting-stopping)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopping
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz published (landing-published)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is published
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopped (cutting-stopped)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopped
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz local (landing-local)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is local
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz restored (landing-restored)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is restored
2026/10/22 10:31:50 moves: a.go.example.com: database installed at /tmp/TestDirtyReturnRetiresRetiredStampLeftovers3190238682/002/a.go.example.com.db (sha256:ae0661eb68be3f7cf598dba7530492d53b78f5082395b4a1ac8e1f86ea82228d), generation rb_abcdefghijklmnopqrstuvwxyz
2026/10/22 10:31:50 moves: a.go.example.com: generation mv_abcdefghijklmnopqrstuvwxyz built at TXID 3
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz building (rolling_back-source-building)
2026/10/22 10:31:50 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is building
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz waits at restored: this box has no probe wake (claim Plan 11's launcher and Plan 5 Task 9's arming are needed)
2026/10/22 10:31:50 moves: a.go.example.com: stopped at TXID 3; execution given up, citing moves/bab/app/a.go.example.com/mv_abcdefghijklmnopqrstuvwxyz/stopped-source.json
2026/10/22 10:31:50 moves: a.go.example.com: the prepared files manifest instances/a.go.example.com/files/g-mv_abcdefghijklmnopqrstuvwxyz/manifest.json is written (sha256 bdd5101a4adb10e6490f5f54780ae99c4392728e66784a373d480b548b961831)
2026/10/22 10:31:50 moves: a.go.example.com: files, environment, timers and columns installed; .files-gen written
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz configured (landing-configured)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is configured
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz restored (rolling_back-source-restored)
2026/10/22 10:31:50 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is restored
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz building (rolling_back-source-building)
2026/10/22 10:31:50 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is building
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz probing (landing-probing)
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz requested (requested)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is probing
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz published (landing-published)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is published
2026/10/22 10:31:50 moves: a.go.example.com: sealed 4 replica objects at TXID 3
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz probe_attempt (probe_attempt-1)
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz staged (cutting-staged)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is staged
2026/10/22 10:31:50 moves: a.go.example.com: the installation is no longer this install's: /tmp/TestLandingInstallRefusesASuccessora_dangling_marker_symlink2517714296/005/a.go.example.com.db.gen is not a regular file (Lrwxrwxrwx)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz passed its probe on attempt 1 of 2
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz archived (cutting-archived)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is archived
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz probed (landing-probed)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is probed
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz local (landing-local)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is local
2026/10/22 10:31:50 moves: a.go.example.com: the prepared files manifest instances/a.go.example.com/files/g-mv_abcdefghijklmnopqrstuvwxyz/manifest.json is written (sha256 bdd5101a4adb10e6490f5f54780ae99c4392728e66784a373d480b548b961831)
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz flipped (cutting-flipped)
2026/10/22 10:31:50 moves: a.go.example.com: flipped to uk
2026/10/22 10:31:50 moves: a.go.example.com: files, environment, timers and columns installed; .files-gen written
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz configured (landing-configured)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is configured
2026/10/22 10:31:50 moves: a.go.example.com: staged the files archive sha256:c9229ef8e7256a1dcd5c2715b11ac3016951e8fee8e0bfa823aa2460f0d331c8 (2 files, 19 bytes)
2026/10/22 10:31:50 moves: a.go.example.com: not ready: the target has not published a readiness report yet
2026/10/22 10:31:50 moves: a.go.example.com: generation rb_abcdefghijklmnopqrstuvwxyz built at TXID 3
2026/10/22 10:31:50 moves: a.go.example.com: held at probed by the test
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz published (rolling_back-source-published)
2026/10/22 10:31:50 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is published
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz local (rolling_back-source-local)
2026/10/22 10:31:50 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is local
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz committed (committed)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is committed
2026/10/22 10:31:50 moves: a.go.example.com: database installed at /tmp/TestCommittedOpenIsProved1949211214/014/a.go.example.com.db (sha256:ae0661eb68be3f7cf598dba7530492d53b78f5082395b4a1ac8e1f86ea82228d), generation mv_abcdefghijklmnopqrstuvwxyz
2026/10/22 10:31:50 moves: a.go.example.com: the prepared files manifest instances/a.go.example.com/files/g-mv_abcdefghijklmnopqrstuvwxyz/manifest.json is written (sha256 bdd5101a4adb10e6490f5f54780ae99c4392728e66784a373d480b548b961831)
2026/10/22 10:31:50 moves: a.go.example.com: the claim of landing mv_abcdefghijklmnopqrstuvwxyz is committed
2026/10/22 10:31:50 moves: a.go.example.com: the open of mv_abcdefghijklmnopqrstuvwxyz waits: this box cannot release the hold
2026/10/22 10:31:50 moves: a.go.example.com: files, environment, timers and columns installed; .files-gen written
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz restored (landing-restored)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is restored
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz configured (landing-configured)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is configured
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz waits at restored: this box has no probe wake (claim Plan 11's launcher and Plan 5 Task 9's arming are needed)
2026/10/22 10:31:50 moves: a.go.example.com: database installed at /tmp/TestCommitReassertsALaggingProbedClaim1608631312/005/a.go.example.com.db (sha256:ae0661eb68be3f7cf598dba7530492d53b78f5082395b4a1ac8e1f86ea82228d), generation mv_abcdefghijklmnopqrstuvwxyz
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz restored (landing-restored)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is restored
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz waits at restored: this box has no probe wake (claim Plan 11's launcher and Plan 5 Task 9's arming are needed)
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz requested (requested)
2026/10/22 10:31:50 moves: a.go.example.com: generation rb_abcdefghijklmnopqrstuvwxyz built at TXID 3
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz published (rolling_back-source-published)
2026/10/22 10:31:50 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is published
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz probing (landing-probing)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is probing
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz local (rolling_back-source-local)
2026/10/22 10:31:50 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is local
2026/10/22 10:31:50 moves: a.go.example.com: staged the files archive sha256:c9229ef8e7256a1dcd5c2715b11ac3016951e8fee8e0bfa823aa2460f0d331c8 (2 files, 19 bytes)
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz ready (ready)
2026/10/22 10:31:50 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz is ready (last round moved 1815 bytes; bar 16777216)
2026/10/22 10:31:50 moves: a.go.example.com: not ready: the target has not published a readiness report yet
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz probe_attempt (probe_attempt-1)
2026/10/22 10:31:50 moves: a.go.example.com: database installed at /tmp/TestLateCommitRollsBack4170610285/005/a.go.example.com.db (sha256:ae0661eb68be3f7cf598dba7530492d53b78f5082395b4a1ac8e1f86ea82228d), generation mv_abcdefghijklmnopqrstuvwxyz
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz restored (landing-restored)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is restored
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz passed its probe on attempt 1 of 2
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz cut_requested (cutting-requested)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz waits at restored: this box has no probe wake (claim Plan 11's launcher and Plan 5 Task 9's arming are needed)
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz requested (requested)
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz probed (landing-probed)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is probed
2026/10/22 10:31:50 moves: a.go.example.com: held at probed by the test
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz probing (landing-probing)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is probing
2026/10/22 10:31:50 moves: a.go.example.com: staged the files archive sha256:c9229ef8e7256a1dcd5c2715b11ac3016951e8fee8e0bfa823aa2460f0d331c8 (2 files, 19 bytes)
2026/10/22 10:31:50 moves: a.go.example.com: not ready: the target has not published a readiness report yet
2026/10/22 10:31:50 moves: a.go.example.com: this box's inventory lists paths under stamp 9, which the return of mv_abcdefghijklmnopqrstuvwxyz cannot account for; nothing is moved
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz committed (committed)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is committed
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stuck (stuck-0)
2026/10/22 10:31:50 moves: a.go.example.com: the return rb_abcdefghijklmnopqrstuvwxyz stops for an operator: the source holds files of an installation the return cannot account for
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz admitted (cutting-admitted)
2026/10/22 10:31:50 moves: a.go.example.com: the claim of landing mv_abcdefghijklmnopqrstuvwxyz is committed
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopping (cutting-stopping)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopping
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz probe_attempt (probe_attempt-1)
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopped (cutting-stopped)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopped
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz passed its probe on attempt 1 of 2
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz probed (landing-probed)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is probed
2026/10/22 10:31:50 moves: a.go.example.com: held at probed by the test
2026/10/22 10:31:50 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz's lane is archived; its park is acknowledged after its horizon
2026/10/22 10:31:50 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz closes once the target has opened and the source has parked (opened false, parked false)
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz opened (committed-opened)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is open
2026/10/22 10:31:50 moves: a.go.example.com: the source's artifacts of stamp 1 are retired
2026/10/22 10:31:50 moves: a.go.example.com: stopped at TXID 3; execution given up, citing moves/bab/app/a.go.example.com/mv_abcdefghijklmnopqrstuvwxyz/stopped-source.json
2026/10/22 10:31:50 moves: a.go.example.com: the claim's landing phase caught up from "probing" to "probed"
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz committed (committed)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is committed
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is probing
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz ready (ready)
2026/10/22 10:31:50 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz is ready (last round moved 1815 bytes; bar 16777216)
2026/10/22 10:31:50 moves: a.go.example.com: the claim of landing mv_abcdefghijklmnopqrstuvwxyz is committed
2026/10/22 10:31:50 moves: a.go.example.com: the local artifacts of rb_abcdefghijklmnopqrstuvwxyz are parked in /tmp/TestDirtyReturnUnknownStampIsStuckUntilRetriedunknown1049098833/002/.parked/cc4fe64fa6da6232556d039690a7c19690555ce5d542faba1e57a3d3c896c3bb/a.go.example.com/6058638390145a7a42d3a8f4b5ed4d2a
2026/10/22 10:31:50 moves: a.go.example.com: sealed 4 replica objects at TXID 3
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz cut_requested (cutting-requested)
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz opened (committed-opened)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is open
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz passed its probe on attempt 1 of 2
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is probed
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is committed
2026/10/22 10:31:50 moves: a.go.example.com: the prepared files manifest instances/a.go.example.com/files/g-rb_abcdefghijklmnopqrstuvwxyz/manifest.json is written (sha256 55dbb82acc5c0c115c4dafe3b5bb8fd1a6b54694ab110cf32b00cbad0e10f430)
2026/10/22 10:31:50 moves: a.go.example.com: files, environment, timers and columns installed; .files-gen written
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz configured (rolling_back-source-configured)
2026/10/22 10:31:50 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is configured
2026/10/22 10:31:50 moves: a.go.example.com: the claim of landing mv_abcdefghijklmnopqrstuvwxyz is committed
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz staged (cutting-staged)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is staged
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz archived (cutting-archived)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is archived
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz flipped (cutting-flipped)
2026/10/22 10:31:50 moves: a.go.example.com: flipped to uk
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is open
2026/10/22 10:31:50 moves: a.go.example.com: database installed at /tmp/TestDirtyReturnUnknownStampIsStuckUntilRetriedunknown1049098833/002/a.go.example.com.db (sha256:ae0661eb68be3f7cf598dba7530492d53b78f5082395b4a1ac8e1f86ea82228d), generation rb_abcdefghijklmnopqrstuvwxyz
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz requested (requested)
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz parking (landing-parking)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is parking
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz restored (rolling_back-source-restored)
2026/10/22 10:31:50 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is restored
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz admitted (cutting-admitted)
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopping (cutting-stopping)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopping
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopped (cutting-stopped)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopped
2026/10/22 10:31:50 moves: a.go.example.com: stopped at TXID 3; execution given up, citing moves/bab/app/a.go.example.com/mv_abcdefghijklmnopqrstuvwxyz/stopped-source.json
2026/10/22 10:31:50 moves: a.go.example.com: sealed 4 replica objects at TXID 3
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz staged (cutting-staged)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is staged
2026/10/22 10:31:50 moves: a.go.example.com: staged the files archive sha256:c9229ef8e7256a1dcd5c2715b11ac3016951e8fee8e0bfa823aa2460f0d331c8 (2 files, 19 bytes)
2026/10/22 10:31:50 moves: a.go.example.com: not ready: the target has not published a readiness report yet
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz archived (cutting-archived)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is archived
2026/10/22 10:31:50 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz's lane is archived; its park is acknowledged after its horizon
2026/10/22 10:31:50 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz closes once the target has opened and the source has parked (opened true, parked false)
2026/10/22 10:31:50 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz's lane is archived; its park is acknowledged after its horizon
2026/10/22 10:31:50 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz closes once the target has opened and the source has parked (opened true, parked false)
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz probing (landing-probing)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is probing
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz flipped (cutting-flipped)
2026/10/22 10:31:50 moves: a.go.example.com: flipped to uk
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz probe_attempt (probe_attempt-1)
2026/10/22 10:31:50 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz's lane is archived; its park is acknowledged after its horizon
2026/10/22 10:31:50 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz closes once the target has opened and the source has parked (opened true, parked false)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz passed its probe on attempt 1 of 2
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz requested (requested)
2026/10/22 10:31:50 moves: a.go.example.com: staged the files archive sha256:c9229ef8e7256a1dcd5c2715b11ac3016951e8fee8e0bfa823aa2460f0d331c8 (2 files, 19 bytes)
2026/10/22 10:31:50 moves: a.go.example.com: not ready: the target has not published a readiness report yet
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz building (landing-building)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is building
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz probed (landing-probed)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is probed
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz parking (landing-parking)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is parking
2026/10/22 10:31:50 moves: a.go.example.com: held at probed by the test
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz ready (ready)
2026/10/22 10:31:50 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz is ready (last round moved 1815 bytes; bar 16777216)
2026/10/22 10:31:50 moves: a.go.example.com: the commit of landing mv_abcdefghijklmnopqrstuvwxyz came after its deadline
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz cut_requested (cutting-requested)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz stops for a rollback: the commit came after the deadline
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz admitted (cutting-admitted)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz rolls back as rb_vyh2wlqnqxii4jiln7wcufcffa: the commit came after the deadline
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz rolling_back (rolling_back)
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopping (cutting-stopping)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopping
2026/10/22 10:31:50 moves: a.go.example.com: the claim follows rollback rb_vyh2wlqnqxii4jiln7wcufcffa
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopped (cutting-stopped)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopped
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz ready (ready)
2026/10/22 10:31:50 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz is ready (last round moved 1815 bytes; bar 16777216)
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz ready (ready)
2026/10/22 10:31:50 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz is ready (last round moved 1815 bytes; bar 16777216)
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz building (landing-building)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is building
2026/10/22 10:31:50 moves: a.go.example.com: stopped at TXID 3; execution given up, citing moves/bab/app/a.go.example.com/mv_abcdefghijklmnopqrstuvwxyz/stopped-source.json
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz requested (requested)
2026/10/22 10:31:50 moves: a.go.example.com: sealed 4 replica objects at TXID 3
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz staged (cutting-staged)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is staged
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz cut_requested (cutting-requested)
2026/10/22 10:31:50 moves: a.go.example.com: staged the files archive sha256:c9229ef8e7256a1dcd5c2715b11ac3016951e8fee8e0bfa823aa2460f0d331c8 (2 files, 19 bytes)
2026/10/22 10:31:50 moves: a.go.example.com: not ready: the target has not published a readiness report yet
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz archived (cutting-archived)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is archived
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz requested (requested)
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz admitted (cutting-admitted)
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz flipped (cutting-flipped)
2026/10/22 10:31:50 moves: a.go.example.com: flipped to uk
2026/10/22 10:31:50 moves: a.go.example.com: staged the files archive sha256:c9229ef8e7256a1dcd5c2715b11ac3016951e8fee8e0bfa823aa2460f0d331c8 (2 files, 19 bytes)
2026/10/22 10:31:50 moves: a.go.example.com: not ready: the target has not published a readiness report yet
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz cut_requested (cutting-requested)
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopping (cutting-stopping)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopping
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopped (cutting-stopped)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopped
2026/10/22 10:31:50 moves: a.go.example.com: stopped at TXID 3; execution given up, citing moves/bab/app/a.go.example.com/mv_abcdefghijklmnopqrstuvwxyz/stopped-source.json
2026/10/22 10:31:50 moves: a.go.example.com: generation mv_abcdefghijklmnopqrstuvwxyz built at TXID 3
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz published (landing-published)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is published
2026/10/22 10:31:50 moves: a.go.example.com: sealed 4 replica objects at TXID 3
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz staged (cutting-staged)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is staged
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz local (landing-local)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is local
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz admitted (cutting-admitted)
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopping (cutting-stopping)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopping
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz archived (cutting-archived)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is archived
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopped (cutting-stopped)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopped
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz flipped (cutting-flipped)
2026/10/22 10:31:50 moves: a.go.example.com: flipped to uk
2026/10/22 10:31:50 moves: a.go.example.com: generation mv_abcdefghijklmnopqrstuvwxyz built at TXID 3
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz requested (requested)
2026/10/22 10:31:50 moves: a.go.example.com: the source's location instances/a.go.example.com is parked
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz published (landing-published)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is published
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz ready (ready)
2026/10/22 10:31:50 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz is ready (last round moved 1815 bytes; bar 16777216)
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz ready (ready)
2026/10/22 10:31:50 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz is ready (last round moved 1815 bytes; bar 16777216)
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz parking (landing-parking)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is parking
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz local (landing-local)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is local
2026/10/22 10:31:50 moves: a.go.example.com: stopped at TXID 3; execution given up, citing moves/bab/app/a.go.example.com/mv_abcdefghijklmnopqrstuvwxyz/stopped-source.json
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz building (rolling_back-source-building)
2026/10/22 10:31:50 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is building
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz cut_requested (cutting-requested)
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz cut_requested (cutting-requested)
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz requested (requested)
2026/10/22 10:31:50 moves: a.go.example.com: sealed 4 replica objects at TXID 3
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz building (landing-building)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is building
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz admitted (cutting-admitted)
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopping (cutting-stopping)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopping
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopped (cutting-stopped)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopped
2026/10/22 10:31:50 moves: a.go.example.com: the local artifacts of mv_abcdefghijklmnopqrstuvwxyz are parked in /tmp/TestRealWritersLogEveryTransitionprobe_to_done3811725508/002/.parked/cc4fe64fa6da6232556d039690a7c19690555ce5d542faba1e57a3d3c896c3bb/a.go.example.com/4aefeff724963b3bf27b066de59adeb1
2026/10/22 10:31:50 moves: a.go.example.com: the prepared files manifest instances/a.go.example.com/files/g-mv_abcdefghijklmnopqrstuvwxyz/manifest.json is written (sha256 bdd5101a4adb10e6490f5f54780ae99c4392728e66784a373d480b548b961831)
2026/10/22 10:31:50 moves: a.go.example.com: staged the files archive sha256:c9229ef8e7256a1dcd5c2715b11ac3016951e8fee8e0bfa823aa2460f0d331c8 (2 files, 19 bytes)
2026/10/22 10:31:50 moves: a.go.example.com: files, environment, timers and columns installed; .files-gen written
2026/10/22 10:31:50 moves: a.go.example.com: the source's row and its timers are deleted
2026/10/22 10:31:50 moves: a.go.example.com: not ready: the target has not published a readiness report yet
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz configured (landing-configured)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is configured
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz staged (cutting-staged)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is staged
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz admitted (cutting-admitted)
2026/10/22 10:31:50 moves: a.go.example.com: stopped at TXID 3; execution given up, citing moves/bab/app/a.go.example.com/mv_abcdefghijklmnopqrstuvwxyz/stopped-source.json
2026/10/22 10:31:50 moves: a.go.example.com: the prepared files manifest instances/a.go.example.com/files/g-mv_abcdefghijklmnopqrstuvwxyz/manifest.json is written (sha256 bdd5101a4adb10e6490f5f54780ae99c4392728e66784a373d480b548b961831)
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopping (cutting-stopping)
2026/10/22 10:31:50 moves: a.go.example.com: write .files-gen: the installation is no longer this install's: /tmp/TestLandingNeverDeletesFilesItDidNotCreatereplaced_after_the_pl1203153110/005/a.go.example.com is not the files directory this landing placed (<nil>)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopping
2026/10/22 10:31:50 moves: a.go.example.com: sealed 4 replica objects at TXID 3
2026/10/22 10:31:50 moves: a.go.example.com: generation rb_abcdefghijklmnopqrstuvwxyz built at TXID 3
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz staged (cutting-staged)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is staged
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz published (rolling_back-source-published)
2026/10/22 10:31:50 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is published
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz archived (cutting-archived)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is archived
2026/10/22 10:31:50 moves: a.go.example.com: staged the files archive sha256:c9229ef8e7256a1dcd5c2715b11ac3016951e8fee8e0bfa823aa2460f0d331c8 (2 files, 19 bytes)
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz ready (ready)
2026/10/22 10:31:50 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz is ready (last round moved 1815 bytes; bar 16777216)
2026/10/22 10:31:50 moves: a.go.example.com: not ready: the target has not published a readiness report yet
2026/10/22 10:31:50 moves: a.go.example.com: the source has parked what it kept for mv_abcdefghijklmnopqrstuvwxyz
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopped (cutting-stopped)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopped
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz flipped (cutting-flipped)
2026/10/22 10:31:50 moves: a.go.example.com: flipped to uk
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz local (rolling_back-source-local)
2026/10/22 10:31:50 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is local
2026/10/22 10:31:50 moves: a.go.example.com: the source's finalization of mv_abcdefghijklmnopqrstuvwxyz is complete
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz archived (cutting-archived)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is archived
2026/10/22 10:31:50 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz waits for 2 park(s) of the move to be acknowledged before it closes
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz cut_requested (cutting-requested)
2026/10/22 10:31:50 moves: a.go.example.com: stopped at TXID 3; execution given up, citing moves/bab/app/a.go.example.com/mv_abcdefghijklmnopqrstuvwxyz/stopped-source.json
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz flipped (cutting-flipped)
2026/10/22 10:31:50 moves: a.go.example.com: flipped to uk
2026/10/22 10:31:50 moves: a.go.example.com: the source's artifacts of stamp 1 are retired
2026/10/22 10:31:50 moves: a.go.example.com: sealed 4 replica objects at TXID 3
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz staged (cutting-staged)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is staged
2026/10/22 10:31:50 moves: a.go.example.com: the local artifacts of rb_abcdefghijklmnopqrstuvwxyz are parked in /tmp/TestDirtyReturnCorruptBuildIsStuck2783083887/002/.parked/cc4fe64fa6da6232556d039690a7c19690555ce5d542faba1e57a3d3c896c3bb/a.go.example.com/549339d24587f79d71d64734514a6705
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz admitted (cutting-admitted)
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz archived (cutting-archived)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is archived
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopping (cutting-stopping)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopping
2026/10/22 10:31:50 moves: a.go.example.com: database installed at /tmp/TestCommittedOpenRepeatsConditionally905764453/005/a.go.example.com.db (sha256:ae0661eb68be3f7cf598dba7530492d53b78f5082395b4a1ac8e1f86ea82228d), generation mv_abcdefghijklmnopqrstuvwxyz
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz flipped (cutting-flipped)
2026/10/22 10:31:50 moves: a.go.example.com: flipped to uk
2026/10/22 10:31:50 moves: a.go.example.com: generation mv_abcdefghijklmnopqrstuvwxyz built at TXID 3
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz published (landing-published)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is published
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz ready (ready)
2026/10/22 10:31:50 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz is ready (last round moved 1815 bytes; bar 16777216)
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz local (landing-local)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is local
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz cut_requested (cutting-requested)
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopped (cutting-stopped)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopped
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz admitted (cutting-admitted)
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz restored (landing-restored)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is restored
2026/10/22 10:31:50 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz's lane in uk is parked
2026/10/22 10:31:50 moves: a.go.example.com: the prepared files manifest instances/a.go.example.com/files/g-rb_abcdefghijklmnopqrstuvwxyz/manifest.json is written (sha256 55dbb82acc5c0c115c4dafe3b5bb8fd1a6b54694ab110cf32b00cbad0e10f430)
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopping (cutting-stopping)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopping
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz parking (landing-parking)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is parking
2026/10/22 10:31:50 moves: a.go.example.com: files, environment, timers and columns installed; .files-gen written
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopped (cutting-stopped)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopped
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz waits at restored: this box has no probe wake (claim Plan 11's launcher and Plan 5 Task 9's arming are needed)
2026/10/22 10:31:50 moves: a.go.example.com: stopped at TXID 3; execution given up, citing moves/bab/app/a.go.example.com/mv_abcdefghijklmnopqrstuvwxyz/stopped-source.json
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz configured (rolling_back-source-configured)
2026/10/22 10:31:50 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is configured
2026/10/22 10:31:50 moves: a.go.example.com: sealed 4 replica objects at TXID 3
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz building (landing-building)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is building
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz requested (requested)
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz staged (cutting-staged)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is staged
2026/10/22 10:31:50 moves: a.go.example.com: the built database is sha256:bf6d7760a6de8ff12dbfe23881bc831647c97260658ce0ba4f7c7221232e2011, the manifest says sha256:ae0661eb68be3f7cf598dba7530492d53b78f5082395b4a1ac8e1f86ea82228d
2026/10/22 10:31:50 moves: a.go.example.com: stopped at TXID 3; execution given up, citing moves/bab/app/a.go.example.com/mv_abcdefghijklmnopqrstuvwxyz/stopped-source.json
2026/10/22 10:31:50 moves: a.go.example.com: sealed 4 replica objects at TXID 3
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz staged (cutting-staged)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is staged
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz archived (cutting-archived)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is archived
2026/10/22 10:31:50 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz is done; the instance is in uk
2026/10/22 10:31:50 moves: a.go.example.com: staged the files archive sha256:c9229ef8e7256a1dcd5c2715b11ac3016951e8fee8e0bfa823aa2460f0d331c8 (2 files, 19 bytes)
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz flipped (cutting-flipped)
2026/10/22 10:31:50 moves: a.go.example.com: flipped to uk
2026/10/22 10:31:50 moves: a.go.example.com: the prepared files manifest instances/a.go.example.com/files/g-mv_abcdefghijklmnopqrstuvwxyz/manifest.json is written (sha256 bdd5101a4adb10e6490f5f54780ae99c4392728e66784a373d480b548b961831)
2026/10/22 10:31:50 moves: a.go.example.com: not ready: the target has not published a readiness report yet
2026/10/22 10:31:50 moves: a.go.example.com: the claim is serving under uk-box after move mv_abcdefghijklmnopqrstuvwxyz
2026/10/22 10:31:50 agent: instance keys: 1 minted, 0 already present, 0 set by app configuration, 0 never started here, 0 waiting for their configuration, 0 failed, 0 rows skipped
2026/10/22 10:31:50 moves: a.go.example.com: files, environment, timers and columns installed; .files-gen written
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz probing (landing-probing)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is probing
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz configured (landing-configured)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is configured
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz archived (cutting-archived)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is archived
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz probe_attempt (probe_attempt-1)
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz flipped (cutting-flipped)
2026/10/22 10:31:50 moves: a.go.example.com: flipped to uk
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz passed its probe on attempt 1 of 2
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz requested (requested)
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz probed (landing-probed)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is probed
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stuck (stuck-0)
2026/10/22 10:31:50 moves: a.go.example.com: the return rb_abcdefghijklmnopqrstuvwxyz stops for an operator: the returned database does not match the build
2026/10/22 10:31:50 moves: a.go.example.com: the installation is no longer this install's: /tmp/TestLandingInstallRefusesASuccessora_dangling_database_symlink2594966889/005/a.go.example.com.db is not a regular file (Lrwxrwxrwx)
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz parking (landing-parking)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is parking
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz building (landing-building)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is building
2026/10/22 10:31:50 moves: a.go.example.com: held at probed by the test
2026/10/22 10:31:50 moves: a.go.example.com: staged the files archive sha256:c9229ef8e7256a1dcd5c2715b11ac3016951e8fee8e0bfa823aa2460f0d331c8 (2 files, 19 bytes)
2026/10/22 10:31:50 moves: a.go.example.com: not ready: the target has not published a readiness report yet
2026/10/22 10:31:50 moves: a.go.example.com: generation mv_abcdefghijklmnopqrstuvwxyz built at TXID 3
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz committed (committed)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is committed
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz published (landing-published)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is published
2026/10/22 10:31:50 moves: a.go.example.com: the claim of landing mv_abcdefghijklmnopqrstuvwxyz is committed
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz ready (ready)
2026/10/22 10:31:50 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz is ready (last round moved 1815 bytes; bar 16777216)
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz cut_requested (cutting-requested)
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz requested (requested)
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz local (landing-local)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is local
2026/10/22 10:31:50 moves: a.go.example.com: generation mv_abcdefghijklmnopqrstuvwxyz built at TXID 3
2026/10/22 10:31:50 moves: a.go.example.com: staged the files archive sha256:c9229ef8e7256a1dcd5c2715b11ac3016951e8fee8e0bfa823aa2460f0d331c8 (2 files, 19 bytes)
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz requested (requested)
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz published (landing-published)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is published
2026/10/22 10:31:50 moves: a.go.example.com: not ready: the target has not published a readiness report yet
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz opened (committed-opened)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is open
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz local (landing-local)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is local
2026/10/22 10:31:50 moves: a.go.example.com: staged the files archive sha256:c9229ef8e7256a1dcd5c2715b11ac3016951e8fee8e0bfa823aa2460f0d331c8 (2 files, 19 bytes)
2026/10/22 10:31:50 moves: a.go.example.com: not ready: the target has not published a readiness report yet
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz building (rolling_back-source-building)
2026/10/22 10:31:50 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is building
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz ready (ready)
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz requested (requested)
2026/10/22 10:31:50 moves: a.go.example.com: the prepared files manifest instances/a.go.example.com/files/g-mv_abcdefghijklmnopqrstuvwxyz/manifest.json is written (sha256 bdd5101a4adb10e6490f5f54780ae99c4392728e66784a373d480b548b961831)
2026/10/22 10:31:50 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz is ready (last round moved 1815 bytes; bar 16777216)
2026/10/22 10:31:50 moves: a.go.example.com: files, environment, timers and columns installed; .files-gen written
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz ready (ready)
2026/10/22 10:31:50 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz is ready (last round moved 1815 bytes; bar 16777216)
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz configured (landing-configured)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is configured
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz admitted (cutting-admitted)
2026/10/22 10:31:50 moves: a.go.example.com: staged the files archive sha256:c9229ef8e7256a1dcd5c2715b11ac3016951e8fee8e0bfa823aa2460f0d331c8 (2 files, 19 bytes)
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz cut_requested (cutting-requested)
2026/10/22 10:31:50 moves: a.go.example.com: not ready: the target has not published a readiness report yet
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopping (cutting-stopping)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopping
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopped (cutting-stopped)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopped
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz cut_requested (cutting-requested)
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz admitted (cutting-admitted)
2026/10/22 10:31:50 moves: a.go.example.com: stopped at TXID 3; execution given up, citing moves/bab/app/a.go.example.com/mv_abcdefghijklmnopqrstuvwxyz/stopped-source.json
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopping (cutting-stopping)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopping
2026/10/22 10:31:50 moves: a.go.example.com: sealed 4 replica objects at TXID 3
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopped (cutting-stopped)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopped
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz admitted (cutting-admitted)
2026/10/22 10:31:50 moves: a.go.example.com: the prepared files manifest instances/a.go.example.com/files/g-mv_abcdefghijklmnopqrstuvwxyz/manifest.json is written (sha256 bdd5101a4adb10e6490f5f54780ae99c4392728e66784a373d480b548b961831)
2026/10/22 10:31:50 moves: a.go.example.com: stopped at TXID 3; execution given up, citing moves/bab/app/a.go.example.com/mv_abcdefghijklmnopqrstuvwxyz/stopped-source.json
2026/10/22 10:31:50 moves: a.go.example.com: files, environment, timers and columns installed; .files-gen written
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz configured (landing-configured)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is configured
2026/10/22 10:31:50 moves: a.go.example.com: sealed 4 replica objects at TXID 3
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz staged (cutting-staged)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is staged
2026/10/22 10:31:50 moves: a.go.example.com: generation rb_abcdefghijklmnopqrstuvwxyz built at TXID 3
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz archived (cutting-archived)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is archived
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz ready (ready)
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz published (rolling_back-source-published)
2026/10/22 10:31:50 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is published
2026/10/22 10:31:50 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz is ready (last round moved 1815 bytes; bar 16777216)
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopping (cutting-stopping)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopping
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopped (cutting-stopped)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopped
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz local (rolling_back-source-local)
2026/10/22 10:31:50 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is local
2026/10/22 10:31:50 moves: a.go.example.com: database installed at /tmp/TestOpenAfterCrashDoesNotReprobe104515182/005/a.go.example.com.db (sha256:ae0661eb68be3f7cf598dba7530492d53b78f5082395b4a1ac8e1f86ea82228d), generation mv_abcdefghijklmnopqrstuvwxyz
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz flipped (cutting-flipped)
2026/10/22 10:31:50 moves: a.go.example.com: flipped to uk
2026/10/22 10:31:50 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz's lane is archived; its park is acknowledged after its horizon
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz cut_requested (cutting-requested)
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz restored (landing-restored)
2026/10/22 10:31:50 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz closes once the target has opened and the source has parked (opened true, parked false)
2026/10/22 10:31:50 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is restored
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz staged (cutting-staged)
2026/10/22 10:31:50 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is staged
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz admitted (cutting-admitted)
2026/10/22 10:31:51 moves: a.go.example.com: database installed at /tmp/TestCommitThenOpenInOrder4114241362/005/a.go.example.com.db (sha256:ae0661eb68be3f7cf598dba7530492d53b78f5082395b4a1ac8e1f86ea82228d), generation mv_abcdefghijklmnopqrstuvwxyz
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz waits at restored: this box has no probe wake (claim Plan 11's launcher and Plan 5 Task 9's arming are needed)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz building (rolling_back-source-building)
2026/10/22 10:31:51 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is building
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopping (cutting-stopping)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopping
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopped (cutting-stopped)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopped
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz restored (landing-restored)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is restored
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz waits at restored: this box has no probe wake (claim Plan 11's launcher and Plan 5 Task 9's arming are needed)
2026/10/22 10:31:51 moves: a.go.example.com: stopped at TXID 3; execution given up, citing moves/bab/app/a.go.example.com/mv_abcdefghijklmnopqrstuvwxyz/stopped-source.json
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz parking (landing-parking)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is parking
2026/10/22 10:31:50 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz archived (cutting-archived)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is archived
2026/10/22 10:31:51 moves: a.go.example.com: stopped at TXID 3; execution given up, citing moves/bab/app/a.go.example.com/mv_abcdefghijklmnopqrstuvwxyz/stopped-source.json
2026/10/22 10:31:51 moves: a.go.example.com: sealed 4 replica objects at TXID 3
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz flipped (cutting-flipped)
2026/10/22 10:31:51 moves: a.go.example.com: flipped to uk
2026/10/22 10:31:51 moves: a.go.example.com: sealed 4 replica objects at TXID 3
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz staged (cutting-staged)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is staged
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz staged (cutting-staged)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is staged
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz archived (cutting-archived)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is archived
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz archived (cutting-archived)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is archived
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz flipped (cutting-flipped)
2026/10/22 10:31:51 moves: a.go.example.com: flipped to uk
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz flipped (cutting-flipped)
2026/10/22 10:31:51 moves: a.go.example.com: flipped to uk
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz building (landing-building)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is building
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz probing (landing-probing)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is probing
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz probing (landing-probing)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is probing
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz probe_attempt (probe_attempt-1)
2026/10/22 10:31:51 moves: a.go.example.com: generation mv_abcdefghijklmnopqrstuvwxyz built at TXID 3
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz published (landing-published)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is published
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz local (landing-local)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is local
2026/10/22 10:31:51 moves: a.go.example.com: generation rb_abcdefghijklmnopqrstuvwxyz built at TXID 3
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz passed its probe on attempt 1 of 2
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz published (rolling_back-source-published)
2026/10/22 10:31:51 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is published
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz requested (requested)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz probed (landing-probed)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is probed
2026/10/22 10:31:51 moves: a.go.example.com: held at probed by the test
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz probe_attempt (probe_attempt-1)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz passed its probe on attempt 1 of 2
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz probed (landing-probed)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is probed
2026/10/22 10:31:51 moves: a.go.example.com: held at probed by the test
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz local (rolling_back-source-local)
2026/10/22 10:31:51 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is local
2026/10/22 10:31:51 moves: a.go.example.com: install the files: injected crash
2026/10/22 10:31:51 moves: a.go.example.com: this box's inventory lists paths under stamp 11, which the return of mv_abcdefghijklmnopqrstuvwxyz cannot account for; nothing is moved
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stuck (stuck-0)
2026/10/22 10:31:51 moves: a.go.example.com: the return rb_abcdefghijklmnopqrstuvwxyz stops for an operator: the source holds files of an installation the return cannot account for
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz committed (committed)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is committed
2026/10/22 10:31:51 moves: a.go.example.com: the source's artifacts of stamp 1 are retired
2026/10/22 10:31:51 moves: a.go.example.com: the claim of landing mv_abcdefghijklmnopqrstuvwxyz is committed
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz building (rolling_back-source-building)
2026/10/22 10:31:51 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is building
2026/10/22 10:31:51 moves: a.go.example.com: the prepared files manifest instances/a.go.example.com/files/g-mv_abcdefghijklmnopqrstuvwxyz/manifest.json is written (sha256 bdd5101a4adb10e6490f5f54780ae99c4392728e66784a373d480b548b961831)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz committed (committed)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is committed
2026/10/22 10:31:51 moves: a.go.example.com: files, environment, timers and columns installed; .files-gen written
2026/10/22 10:31:51 moves: a.go.example.com: the local artifacts of rb_abcdefghijklmnopqrstuvwxyz are parked in /tmp/TestDirtyReturnUnknownStampIsStuckUntilRetriedthe_live_session3576342128/002/.parked/cc4fe64fa6da6232556d039690a7c19690555ce5d542faba1e57a3d3c896c3bb/a.go.example.com/78ebdfeb0d2b8436ec3904e1f9be2ad7
2026/10/22 10:31:51 moves: a.go.example.com: staged the files archive sha256:c9229ef8e7256a1dcd5c2715b11ac3016951e8fee8e0bfa823aa2460f0d331c8 (2 files, 19 bytes)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz configured (landing-configured)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is configured
2026/10/22 10:31:51 moves: a.go.example.com: not ready: the target has not published a readiness report yet
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz opened (committed-opened)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is open
2026/10/22 10:31:51 moves: a.go.example.com: the claim of landing mv_abcdefghijklmnopqrstuvwxyz is committed
2026/10/22 10:31:51 moves: a.go.example.com: the prepared files manifest instances/a.go.example.com/files/g-rb_abcdefghijklmnopqrstuvwxyz/manifest.json is written (sha256 55dbb82acc5c0c115c4dafe3b5bb8fd1a6b54694ab110cf32b00cbad0e10f430)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz opened (committed-opened)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is open
2026/10/22 10:31:51 moves: a.go.example.com: files, environment, timers and columns installed; .files-gen written
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz ready (ready)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz configured (rolling_back-source-configured)
2026/10/22 10:31:51 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is configured
2026/10/22 10:31:51 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz is ready (last round moved 1815 bytes; bar 16777216)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz cut_requested (cutting-requested)
2026/10/22 10:31:51 moves: a.go.example.com: generation rb_abcdefghijklmnopqrstuvwxyz built at TXID 3
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz published (rolling_back-source-published)
2026/10/22 10:31:51 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is published
2026/10/22 10:31:51 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz's lane is archived; its park is acknowledged after its horizon
2026/10/22 10:31:51 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz closes once the target has opened and the source has parked (opened true, parked false)
2026/10/22 10:31:51 moves: a.go.example.com: database installed at /tmp/TestLandingNeverDeletesFilesItDidNotCreatean_empty_directory_an3831884878/005/a.go.example.com.db (sha256:ae0661eb68be3f7cf598dba7530492d53b78f5082395b4a1ac8e1f86ea82228d), generation mv_abcdefghijklmnopqrstuvwxyz
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz local (rolling_back-source-local)
2026/10/22 10:31:51 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is local
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz admitted (cutting-admitted)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopping (cutting-stopping)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopping
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopped (cutting-stopped)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopped
2026/10/22 10:31:51 moves: a.go.example.com: stopped at TXID 3; execution given up, citing moves/bab/app/a.go.example.com/mv_abcdefghijklmnopqrstuvwxyz/stopped-source.json
2026/10/22 10:31:51 moves: a.go.example.com: the local artifacts of rb_abcdefghijklmnopqrstuvwxyz are parked in /tmp/TestDirtyReturnNeverInstallsOverWhatItDidNotParkfiles2843109961/002/.parked/cc4fe64fa6da6232556d039690a7c19690555ce5d542faba1e57a3d3c896c3bb/a.go.example.com/4b10208463ece08b346611a0eb9b496c
2026/10/22 10:31:51 moves: a.go.example.com: sealed 4 replica objects at TXID 3
2026/10/22 10:31:51 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz's lane is archived; its park is acknowledged after its horizon
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz building (rolling_back-source-building)
2026/10/22 10:31:51 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is building
2026/10/22 10:31:51 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz closes once the target has opened and the source has parked (opened true, parked false)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz staged (cutting-staged)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is staged
2026/10/22 10:31:51 moves: a.go.example.com: database installed at /tmp/TestDirtyReturnUnknownStampIsStuckUntilRetriedthe_live_session3576342128/002/a.go.example.com.db (sha256:ae0661eb68be3f7cf598dba7530492d53b78f5082395b4a1ac8e1f86ea82228d), generation rb_abcdefghijklmnopqrstuvwxyz
2026/10/22 10:31:51 moves: a.go.example.com: the files paths hold what this install did not write: /tmp/TestDirtyReturnNeverInstallsOverWhatItDidNotParkfiles2843109961/002/a.go.example.com holds sentinel.txt; nothing was moved or removed
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz restored (rolling_back-source-restored)
2026/10/22 10:31:51 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is restored
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz archived (cutting-archived)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is archived
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stuck (stuck-0)
2026/10/22 10:31:51 moves: a.go.example.com: the return rb_abcdefghijklmnopqrstuvwxyz stops for an operator: the files directory holds files the return did not write
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz restored (landing-restored)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is restored
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz flipped (cutting-flipped)
2026/10/22 10:31:51 moves: a.go.example.com: flipped to uk
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz waits at restored: this box has no probe wake (claim Plan 11's launcher and Plan 5 Task 9's arming are needed)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz parking (landing-parking)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is parking
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz building (landing-building)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is building
2026/10/22 10:31:51 moves: a.go.example.com: generation rb_abcdefghijklmnopqrstuvwxyz built at TXID 3
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz published (rolling_back-source-published)
2026/10/22 10:31:51 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is published
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz local (rolling_back-source-local)
2026/10/22 10:31:51 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is local
2026/10/22 10:31:51 moves: a.go.example.com: the local artifacts of rb_abcdefghijklmnopqrstuvwxyz are parked in /tmp/TestDirtyReturnReplaysFromTheJournalafter-retired1947236459/002/.parked/cc4fe64fa6da6232556d039690a7c19690555ce5d542faba1e57a3d3c896c3bb/a.go.example.com/76d03b4603f00c28696520869f7b3e94
2026/10/22 10:31:51 moves: a.go.example.com: the prepared files manifest instances/a.go.example.com/files/g-rb_abcdefghijklmnopqrstuvwxyz/manifest.json is written (sha256 55dbb82acc5c0c115c4dafe3b5bb8fd1a6b54694ab110cf32b00cbad0e10f430)
2026/10/22 10:31:51 moves: a.go.example.com: files, environment, timers and columns installed; .files-gen written
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz configured (rolling_back-source-configured)
2026/10/22 10:31:51 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is configured
2026/10/22 10:31:51 moves: a.go.example.com: database installed at /tmp/TestDirtyReturnReplaysFromTheJournalafter-retired1947236459/002/a.go.example.com.db (sha256:ae0661eb68be3f7cf598dba7530492d53b78f5082395b4a1ac8e1f86ea82228d), generation rb_abcdefghijklmnopqrstuvwxyz
2026/10/22 10:31:51 moves: a.go.example.com: generation mv_abcdefghijklmnopqrstuvwxyz built at TXID 3
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz published (landing-published)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is published
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz local (landing-local)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is local
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz restored (rolling_back-source-restored)
2026/10/22 10:31:51 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is restored
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz requested (requested)
2026/10/22 10:31:51 moves: a.go.example.com: the prepared files manifest instances/a.go.example.com/files/g-mv_abcdefghijklmnopqrstuvwxyz/manifest.json is written (sha256 bdd5101a4adb10e6490f5f54780ae99c4392728e66784a373d480b548b961831)
2026/10/22 10:31:51 moves: a.go.example.com: files, environment, timers and columns installed; .files-gen written
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz configured (landing-configured)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is configured
2026/10/22 10:31:51 moves: a.go.example.com: staged the files archive sha256:c9229ef8e7256a1dcd5c2715b11ac3016951e8fee8e0bfa823aa2460f0d331c8 (2 files, 19 bytes)
2026/10/22 10:31:51 moves: a.go.example.com: the installation is no longer this install's: /tmp/TestLandingInstallRefusesASuccessora_dangling_WAL_symlink176261421/005/a.go.example.com.db-wal exists beside an absent database
--- FAIL: TestInstallChannelPolicyRefusals (0.27s)
--- FAIL: TestInstallChannelPolicyRefusals/unpublished_mode (0.03s)
systemapply.go:1132: system apply: no moves protocol floor is armed on this box; "v1.4.0" is not checked against one
systemapply.go:582: system apply: chown root: chown /tmp/TestInstallChannelPolicyRefusalsunpublished_mode159231135/002/carlos: invalid argument
installchannel_policy_test.go:395: err an update is running on this box, so nothing was installed: resource temporarily unavailable, want "the --policy file is not an armed policy signed for this deployment, so nothing was installed"
--- FAIL: TestInstallChannelPolicyRefusals/a_symlinked_carlos.prev (0.05s)
systemapply.go:1132: system apply: no moves protocol floor is armed on this box; "v1.4.0" is not checked against one
systemapply.go:582: system apply: chown root: chown /tmp/TestInstallChannelPolicyRefusalsa_symlinked_carlos.prev2579042467/002/carlos: invalid argument
installchannel_policy_test.go:395: err an update is running on this box, so nothing was installed: resource temporarily unavailable, want "/tmp/TestInstallChannelPolicyRefusalsa_symlinked_carlos.prev2579042467/002/carlos.prev holds a build this command did not install, so nothing was installed"
--- FAIL: TestInstallChannelPolicyRefusals/a_carlos.prev_that_is_a_directory (0.01s)
systemapply.go:1132: system apply: no moves protocol floor is armed on this box; "v1.4.0" is not checked against one
systemapply.go:582: system apply: chown root: chown /tmp/TestInstallChannelPolicyRefusalsa_carlos.prev_that_is_a_directo2962442572/002/carlos: invalid argument
installchannel_policy_test.go:395: err an update is running on this box, so nothing was installed: resource temporarily unavailable, want "/tmp/TestInstallChannelPolicyRefusalsa_carlos.prev_that_is_a_directo2962442572/002/carlos.prev holds a build this command did not install, so nothing was installed"
2026/10/22 10:31:51 moves: a.go.example.com: not ready: the target has not published a readiness report yet
2026/10/22 10:31:51 moves: a.go.example.com: the source's finalization of mv_abcdefghijklmnopqrstuvwxyz waits: park: unsafe or incomplete input: the claim is landing/"probed" for "mv_abcdefghijklmnopqrstuvwxyz", not this move's commit
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz requested (requested)
2026/10/22 10:31:51 moves: a.go.example.com: staged the files archive sha256:c9229ef8e7256a1dcd5c2715b11ac3016951e8fee8e0bfa823aa2460f0d331c8 (2 files, 19 bytes)
platform.example.com: update to v2 failed: console.service did not come up: not ready after 5s: permission denied — rolled the symlink back
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz requested (requested)
2026/10/22 10:31:51 moves: a.go.example.com: not ready: the target has not published a readiness report yet
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz ready (ready)
2026/10/22 10:31:51 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz is ready (last round moved 1815 bytes; bar 16777216)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz cut_requested (cutting-requested)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz admitted (cutting-admitted)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopping (cutting-stopping)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopping
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopped (cutting-stopped)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopped
--- FAIL: TestInstallChannelPolicyIdentityRefusals (0.28s)
--- FAIL: TestInstallChannelPolicyIdentityRefusals/another_artifact_under_the_release (0.01s)
systemapply.go:1132: system apply: no moves protocol floor is armed on this box; "v1.4.0" is not checked against one
systemapply.go:582: system apply: chown root: chown /tmp/TestInstallChannelPolicyIdentityRefusalsanother_artifact_under_1050885196/002/carlos: invalid argument
installchannel_identity_test.go:334: err an update is running on this box, so nothing was installed: resource temporarily unavailable, want "the --identity file names v1.4.0 (v1.4.0), not the release the stable channel names, so nothing was installed"
2026/10/22 10:31:51 moves: a.go.example.com: stopped at TXID 3; execution given up, citing moves/bab/app/a.go.example.com/mv_abcdefghijklmnopqrstuvwxyz/stopped-source.json
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz ready (ready)
2026/10/22 10:31:51 moves: a.go.example.com: staged the files archive sha256:c9229ef8e7256a1dcd5c2715b11ac3016951e8fee8e0bfa823aa2460f0d331c8 (2 files, 19 bytes)
2026/10/22 10:31:51 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz is ready (last round moved 1815 bytes; bar 16777216)
2026/10/22 10:31:51 moves: a.go.example.com: not ready: the target has not published a readiness report yet
2026/10/22 10:31:51 moves: a.go.example.com: sealed 4 replica objects at TXID 3
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz staged (cutting-staged)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is staged
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz cut_requested (cutting-requested)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz archived (cutting-archived)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is archived
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz admitted (cutting-admitted)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz flipped (cutting-flipped)
2026/10/22 10:31:51 moves: a.go.example.com: flipped to uk
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopping (cutting-stopping)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopping
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopped (cutting-stopped)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopped
2026/10/22 10:31:51 moves: a.go.example.com: stopped at TXID 3; execution given up, citing moves/bab/app/a.go.example.com/mv_abcdefghijklmnopqrstuvwxyz/stopped-source.json
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz requested (requested)
2026/10/22 10:31:51 moves: a.go.example.com: sealed 4 replica objects at TXID 3
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz requested (requested)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz ready (ready)
2026/10/22 10:31:51 moves: a.go.example.com: staged the files archive sha256:c9229ef8e7256a1dcd5c2715b11ac3016951e8fee8e0bfa823aa2460f0d331c8 (2 files, 19 bytes)
2026/10/22 10:31:51 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz is ready (last round moved 1815 bytes; bar 16777216)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz staged (cutting-staged)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is staged
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz archived (cutting-archived)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is archived
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz flipped (cutting-flipped)
2026/10/22 10:31:51 moves: a.go.example.com: flipped to uk
2026/10/22 10:31:51 moves: a.go.example.com: staged the files archive sha256:c9229ef8e7256a1dcd5c2715b11ac3016951e8fee8e0bfa823aa2460f0d331c8 (2 files, 19 bytes)
2026/10/22 10:31:51 moves: a.go.example.com: not ready: the target has not published a readiness report yet
2026/10/22 10:31:51 moves: a.go.example.com: not ready: the target has not published a readiness report yet
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz cut_requested (cutting-requested)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz parking (landing-parking)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is parking
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz ready (ready)
2026/10/22 10:31:51 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz is ready (last round moved 1815 bytes; bar 16777216)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz building (landing-building)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is building
2026/10/22 10:31:51 moves: a.go.example.com: injected crash
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz cut_requested (cutting-requested)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is past its cut_deadline (2026-10-07T09:01:55Z)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz admitted (cutting-admitted)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz rolls back as rb_bw3gtyslc5ld3q4azujjtjrw4a: the landing ran past its deadline
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz admitted (cutting-admitted)
2026/10/22 10:31:51 moves: a.go.example.com: the claim follows rollback rb_bw3gtyslc5ld3q4azujjtjrw4a
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopping (cutting-stopping)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopping
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopping (cutting-stopping)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopping
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopped (cutting-stopped)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopped
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz ready (ready)
2026/10/22 10:31:51 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz is ready (last round moved 1815 bytes; bar 16777216)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopped (cutting-stopped)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopped
2026/10/22 10:31:51 moves: a.go.example.com: the target of rollback rb_bw3gtyslc5ld3q4azujjtjrw4a stopped at TXID 3 (clean false, src_covered false)
2026/10/22 10:31:51 moves: a.go.example.com: the target of rollback rb_bw3gtyslc5ld3q4azujjtjrw4a is released
2026/10/22 10:31:51 moves: a.go.example.com: stopped at TXID 3; execution given up, citing moves/bab/app/a.go.example.com/mv_abcdefghijklmnopqrstuvwxyz/stopped-source.json
2026/10/22 10:31:51 moves: a.go.example.com: the target gave execution up for rollback rb_bw3gtyslc5ld3q4azujjtjrw4a, citing moves/bab/app/a.go.example.com/mv_abcdefghijklmnopqrstuvwxyz/stopped-target.json
2026/10/22 10:31:51 moves: a.go.example.com: the target of rollback rb_bw3gtyslc5ld3q4azujjtjrw4a is returning
2026/10/22 10:31:51 moves: a.go.example.com: sealed 4 replica objects at TXID 3
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz staged (cutting-staged)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is staged
2026/10/22 10:31:51 moves: a.go.example.com: the return lane of rb_bw3gtyslc5ld3q4azujjtjrw4a is sealed: 4 replica objects at TXID 3
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz archived (cutting-archived)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is archived
2026/10/22 10:31:51 moves: a.go.example.com: the target of rollback rb_bw3gtyslc5ld3q4azujjtjrw4a is returned
2026/10/22 10:31:51 moves: a.go.example.com: the target keeps what it holds for rollback rb_bw3gtyslc5ld3q4azujjtjrw4a until the source has recovered
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz flipped (cutting-flipped)
2026/10/22 10:31:51 moves: a.go.example.com: flipped to uk
2026/10/22 10:31:51 moves: a.go.example.com: stopped at TXID 3; execution given up, citing moves/bab/app/a.go.example.com/mv_abcdefghijklmnopqrstuvwxyz/stopped-source.json
2026/10/22 10:31:51 moves: a.go.example.com: sealed 4 replica objects at TXID 3
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz staged (cutting-staged)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is staged
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz cut_requested (cutting-requested)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz archived (cutting-archived)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is archived
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz flipped (cutting-flipped)
2026/10/22 10:31:51 moves: a.go.example.com: flipped to uk
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz admitted (cutting-admitted)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopping (cutting-stopping)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopping
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz parking (landing-parking)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is parking
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz requested (requested)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz building (landing-building)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is building
2026/10/22 10:31:51 moves: a.go.example.com: staged the files archive sha256:c9229ef8e7256a1dcd5c2715b11ac3016951e8fee8e0bfa823aa2460f0d331c8 (2 files, 19 bytes)
2026/10/22 10:31:51 moves: a.go.example.com: not ready: the target has not published a readiness report yet
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopped (cutting-stopped)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopped
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz ready (ready)
2026/10/22 10:31:51 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz is ready (last round moved 1815 bytes; bar 16777216)
2026/10/22 10:31:51 moves: a.go.example.com: stopped at TXID 3; execution given up, citing moves/bab/app/a.go.example.com/mv_abcdefghijklmnopqrstuvwxyz/stopped-source.json
2026/10/22 10:31:51 moves: a.go.example.com: sealed 4 replica objects at TXID 3
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz cut_requested (cutting-requested)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz staged (cutting-staged)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is staged
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz archived (cutting-archived)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is archived
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz flipped (cutting-flipped)
2026/10/22 10:31:51 moves: a.go.example.com: flipped to uk
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz admitted (cutting-admitted)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopping (cutting-stopping)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopping
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz parking (landing-parking)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is parking
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopped (cutting-stopped)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopped
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz building (landing-building)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is building
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz requested (requested)
2026/10/22 10:31:51 moves: a.go.example.com: stopped at TXID 3; execution given up, citing moves/bab/app/a.go.example.com/mv_abcdefghijklmnopqrstuvwxyz/stopped-source.json
2026/10/22 10:31:51 moves: a.go.example.com: sealed 4 replica objects at TXID 3
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz staged (cutting-staged)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is staged
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz archived (cutting-archived)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is archived
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz building (rolling_back-source-building)
platform.example.com: rolled back to v1 but could not start it: console.service did not come up: not ready after 5s: permission denied — this host may be serving nothing
2026/10/22 10:31:51 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is building
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz flipped (cutting-flipped)
2026/10/22 10:31:51 moves: a.go.example.com: flipped to uk
2026/10/22 10:31:51 moves: a.go.example.com: staged the files archive sha256:c9229ef8e7256a1dcd5c2715b11ac3016951e8fee8e0bfa823aa2460f0d331c8 (2 files, 19 bytes)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz requested (requested)
2026/10/22 10:31:51 moves: a.go.example.com: not ready: the target has not published a readiness report yet
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz requested (requested)
2026/10/22 10:31:51 moves: a.go.example.com: the landing placed the moved build state at instances/a.go.example.com/build-state.json
2026/10/22 10:31:51 moves: a.go.example.com: generation mv_abcdefghijklmnopqrstuvwxyz built at TXID 3
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz published (landing-published)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is published
2026/10/22 10:31:51 moves: a.go.example.com: staged the files archive sha256:c9229ef8e7256a1dcd5c2715b11ac3016951e8fee8e0bfa823aa2460f0d331c8 (2 files, 19 bytes)
2026/10/22 10:31:51 moves: a.go.example.com: not ready: the target has not published a readiness report yet
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz local (landing-local)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is local
2026/10/22 10:31:51 moves: a.go.example.com: staged the files archive sha256:c9229ef8e7256a1dcd5c2715b11ac3016951e8fee8e0bfa823aa2460f0d331c8 (2 files, 19 bytes)
2026/10/22 10:31:51 moves: a.go.example.com: not ready: the target has not published a readiness report yet
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz requested (requested)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz ready (ready)
2026/10/22 10:31:51 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz is ready (last round moved 1815 bytes; bar 16777216)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz ready (ready)
2026/10/22 10:31:51 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz is ready (last round moved 1815 bytes; bar 16777216)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz ready (ready)
2026/10/22 10:31:51 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz is ready (last round moved 1815 bytes; bar 16777216)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz cut_requested (cutting-requested)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz cut_requested (cutting-requested)
2026/10/22 10:31:51 moves: a.go.example.com: generation rb_abcdefghijklmnopqrstuvwxyz built at TXID 3
2026/10/22 10:31:51 moves: a.go.example.com: staged the files archive sha256:c9229ef8e7256a1dcd5c2715b11ac3016951e8fee8e0bfa823aa2460f0d331c8 (2 files, 19 bytes)
2026/10/22 10:31:51 moves: a.go.example.com: not ready: the target has not published a readiness report yet
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz published (rolling_back-source-published)
2026/10/22 10:31:51 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is published
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz local (rolling_back-source-local)
2026/10/22 10:31:51 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is local
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz admitted (cutting-admitted)
2026/10/22 10:31:51 moves: a.go.example.com: the landing placed the moved build state at instances/a.go.example.com/build-state.json
2026/10/22 10:31:51 moves: a.go.example.com: generation mv_abcdefghijklmnopqrstuvwxyz built at TXID 3
2026/10/22 10:31:51 moves: a.go.example.com: the prepared files manifest instances/a.go.example.com/files/g-mv_abcdefghijklmnopqrstuvwxyz/manifest.json is written (sha256 bdd5101a4adb10e6490f5f54780ae99c4392728e66784a373d480b548b961831)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz published (landing-published)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is published
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopping (cutting-stopping)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopping
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz cut_requested (cutting-requested)
2026/10/22 10:31:51 moves: a.go.example.com: the source's artifacts of stamp 1 are retired
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz admitted (cutting-admitted)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopped (cutting-stopped)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopped
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopping (cutting-stopping)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopping
2026/10/22 10:31:51 moves: a.go.example.com: files, environment, timers and columns installed; .files-gen written
2026/10/22 10:31:51 moves: a.go.example.com: the local artifacts of rb_abcdefghijklmnopqrstuvwxyz are parked in /tmp/TestDirtyReturnNeverInstallsOverWhatItDidNotParkmarker1621037240/002/.parked/cc4fe64fa6da6232556d039690a7c19690555ce5d542faba1e57a3d3c896c3bb/a.go.example.com/646bd64169dc499dcddc0b9600ebd8d1
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz configured (landing-configured)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is configured
2026/10/22 10:31:51 moves: a.go.example.com: stopped at TXID 3; execution given up, citing moves/bab/app/a.go.example.com/mv_abcdefghijklmnopqrstuvwxyz/stopped-source.json
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz local (landing-local)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is local
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz requested (requested)
2026/10/22 10:31:51 moves: a.go.example.com: sealed 4 replica objects at TXID 3
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz building (rolling_back-source-building)
2026/10/22 10:31:51 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is building
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz staged (cutting-staged)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is staged
2026/10/22 10:31:51 moves: a.go.example.com: database installed at /tmp/TestTheReturnLaneCarriesTheBuildState1813458767/005/a.go.example.com.db (sha256:ae0661eb68be3f7cf598dba7530492d53b78f5082395b4a1ac8e1f86ea82228d), generation mv_abcdefghijklmnopqrstuvwxyz
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz archived (cutting-archived)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is archived
2026/10/22 10:31:51 moves: a.go.example.com: staged the files archive sha256:c9229ef8e7256a1dcd5c2715b11ac3016951e8fee8e0bfa823aa2460f0d331c8 (2 files, 19 bytes)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz flipped (cutting-flipped)
2026/10/22 10:31:51 moves: a.go.example.com: flipped to uk
2026/10/22 10:31:51 moves: a.go.example.com: not ready: the target has not published a readiness report yet
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopped (cutting-stopped)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopped
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz restored (landing-restored)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is restored
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz parking (landing-parking)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is parking
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz waits at restored: this box has no probe wake (claim Plan 11's launcher and Plan 5 Task 9's arming are needed)
2026/10/22 10:31:51 moves: a.go.example.com: stopped at TXID 3; execution given up, citing moves/bab/app/a.go.example.com/mv_abcdefghijklmnopqrstuvwxyz/stopped-source.json
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz ready (ready)
2026/10/22 10:31:51 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz is ready (last round moved 1815 bytes; bar 16777216)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz admitted (cutting-admitted)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz building (landing-building)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is building
2026/10/22 10:31:51 moves: a.go.example.com: the prepared files manifest instances/a.go.example.com/files/g-mv_abcdefghijklmnopqrstuvwxyz/manifest.json is written (sha256 bdd5101a4adb10e6490f5f54780ae99c4392728e66784a373d480b548b961831)
2026/10/22 10:31:51 moves: a.go.example.com: sealed 4 replica objects at TXID 3
2026/10/22 10:31:51 moves: a.go.example.com: files, environment, timers and columns installed; .files-gen written
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz cut_requested (cutting-requested)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz configured (landing-configured)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is configured
2026/10/22 10:31:51 moves: a.go.example.com: generation rb_abcdefghijklmnopqrstuvwxyz built at TXID 3
2026/10/22 10:31:51 moves: a.go.example.com: the prepared files manifest instances/a.go.example.com/files/g-rb_abcdefghijklmnopqrstuvwxyz/manifest.json is written (sha256 55dbb82acc5c0c115c4dafe3b5bb8fd1a6b54694ab110cf32b00cbad0e10f430)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz published (rolling_back-source-published)
2026/10/22 10:31:51 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is published
2026/10/22 10:31:51 moves: a.go.example.com: files, environment, timers and columns installed; .files-gen written
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopping (cutting-stopping)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopping
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopped (cutting-stopped)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopped
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz configured (rolling_back-source-configured)
2026/10/22 10:31:51 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is configured
2026/10/22 10:31:51 moves: a.go.example.com: stopped at TXID 3; execution given up, citing moves/bab/app/a.go.example.com/mv_abcdefghijklmnopqrstuvwxyz/stopped-source.json
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz local (rolling_back-source-local)
2026/10/22 10:31:51 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is local
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is past its cut_deadline (2026-10-07T09:01:55Z)
2026/10/22 10:31:51 moves: a.go.example.com: sealed 4 replica objects at TXID 3
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz staged (cutting-staged)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is staged
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz rolls back as rb_txdfbccoqyrsr3dispip3uwtw4: the landing ran past its deadline
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz ready (ready)
2026/10/22 10:31:51 moves: a.go.example.com: the claim follows rollback rb_txdfbccoqyrsr3dispip3uwtw4
2026/10/22 10:31:51 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz is ready (last round moved 1815 bytes; bar 16777216)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz staged (cutting-staged)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is staged
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz archived (cutting-archived)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is archived
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz cut_requested (cutting-requested)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz flipped (cutting-flipped)
2026/10/22 10:31:51 moves: a.go.example.com: flipped to uk
2026/10/22 10:31:51 moves: a.go.example.com: the local artifacts of rb_abcdefghijklmnopqrstuvwxyz are parked in /tmp/TestDirtyReturnReplaysFromTheJournalafter-pre_move_parked-plan4249052060/002/.parked/cc4fe64fa6da6232556d039690a7c19690555ce5d542faba1e57a3d3c896c3bb/a.go.example.com/db2de28a688a8bc7642dbce06e93f0e3
2026/10/22 10:31:51 moves: a.go.example.com: the target of rollback rb_txdfbccoqyrsr3dispip3uwtw4 stopped at TXID 3 (clean false, src_covered false)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz admitted (cutting-admitted)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz archived (cutting-archived)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is archived
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz admitted (cutting-admitted)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopping (cutting-stopping)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopping
2026/10/22 10:31:51 moves: a.go.example.com: the target of rollback rb_txdfbccoqyrsr3dispip3uwtw4 is released
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz flipped (cutting-flipped)
2026/10/22 10:31:51 moves: a.go.example.com: flipped to uk
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopped (cutting-stopped)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopped
2026/10/22 10:31:51 moves: a.go.example.com: the target gave execution up for rollback rb_txdfbccoqyrsr3dispip3uwtw4, citing moves/bab/app/a.go.example.com/mv_abcdefghijklmnopqrstuvwxyz/stopped-target.json
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopping (cutting-stopping)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopping
2026/10/22 10:31:51 moves: a.go.example.com: the target of rollback rb_txdfbccoqyrsr3dispip3uwtw4 is returning
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz parking (landing-parking)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is parking
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopped (cutting-stopped)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopped
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz building (landing-building)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is building
2026/10/22 10:31:51 moves: a.go.example.com: the prepared files manifest instances/a.go.example.com/files/g-rb_abcdefghijklmnopqrstuvwxyz/manifest.json is written (sha256 55dbb82acc5c0c115c4dafe3b5bb8fd1a6b54694ab110cf32b00cbad0e10f430)
2026/10/22 10:31:51 moves: a.go.example.com: the return lane of rb_txdfbccoqyrsr3dispip3uwtw4 is sealed: 4 replica objects at TXID 3
2026/10/22 10:31:51 moves: a.go.example.com: stopped at TXID 3; execution given up, citing moves/bab/app/a.go.example.com/mv_abcdefghijklmnopqrstuvwxyz/stopped-source.json
2026/10/22 10:31:51 moves: a.go.example.com: the target of rollback rb_txdfbccoqyrsr3dispip3uwtw4 is returned
2026/10/22 10:31:51 moves: a.go.example.com: files, environment, timers and columns installed; .files-gen written
2026/10/22 10:31:51 moves: a.go.example.com: the target keeps what it holds for rollback rb_txdfbccoqyrsr3dispip3uwtw4 until the source has recovered
2026/10/22 10:31:51 moves: a.go.example.com: stopped at TXID 3; execution given up, citing moves/bab/app/a.go.example.com/mv_abcdefghijklmnopqrstuvwxyz/stopped-source.json
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz configured (rolling_back-source-configured)
2026/10/22 10:31:51 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is configured
2026/10/22 10:31:51 moves: a.go.example.com: database installed at /tmp/TestTheSourceLocationParkAcknowledgesWithABuildState3911637656/005/a.go.example.com.db (sha256:ae0661eb68be3f7cf598dba7530492d53b78f5082395b4a1ac8e1f86ea82228d), generation mv_abcdefghijklmnopqrstuvwxyz
2026/10/22 10:31:51 moves: a.go.example.com: generation mv_abcdefghijklmnopqrstuvwxyz built at TXID 3
2026/10/22 10:31:51 moves: a.go.example.com: sealed 4 replica objects at TXID 3
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz published (landing-published)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is published
2026/10/22 10:31:51 moves: a.go.example.com: sealed 4 replica objects at TXID 3
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz staged (cutting-staged)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is staged
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz staged (cutting-staged)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is staged
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz restored (landing-restored)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is restored
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz archived (cutting-archived)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is archived
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz archived (cutting-archived)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is archived
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz flipped (cutting-flipped)
2026/10/22 10:31:51 moves: a.go.example.com: flipped to uk
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz waits at restored: this box has no probe wake (claim Plan 11's launcher and Plan 5 Task 9's arming are needed)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz local (landing-local)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is local
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz flipped (cutting-flipped)
2026/10/22 10:31:51 moves: a.go.example.com: flipped to uk
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz parking (landing-parking)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is parking
2026/10/22 10:31:51 moves: a.go.example.com: database installed at /tmp/TestDirtyReturnReplaysFromTheJournalafter-pre_move_parked-plan4249052060/002/a.go.example.com.db (sha256:ae0661eb68be3f7cf598dba7530492d53b78f5082395b4a1ac8e1f86ea82228d), generation rb_abcdefghijklmnopqrstuvwxyz
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz parking (landing-parking)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is parking
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz building (landing-building)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is building
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz building (landing-building)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is building
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz restored (rolling_back-source-restored)
2026/10/22 10:31:51 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is restored
2026/10/22 10:31:51 moves: a.go.example.com: the prepared files manifest instances/a.go.example.com/files/g-mv_abcdefghijklmnopqrstuvwxyz/manifest.json is written (sha256 bdd5101a4adb10e6490f5f54780ae99c4392728e66784a373d480b548b961831)
2026/10/22 10:31:51 moves: a.go.example.com: files, environment, timers and columns installed; .files-gen written
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz configured (landing-configured)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is configured
2026/10/22 10:31:51 moves: a.go.example.com: generation mv_abcdefghijklmnopqrstuvwxyz built at TXID 3
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz published (landing-published)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is published
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz local (landing-local)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is local
2026/10/22 10:31:51 moves: a.go.example.com: the prepared files manifest instances/a.go.example.com/files/g-mv_abcdefghijklmnopqrstuvwxyz/manifest.json is written (sha256 bdd5101a4adb10e6490f5f54780ae99c4392728e66784a373d480b548b961831)
2026/10/22 10:31:51 moves: a.go.example.com: files, environment, timers and columns installed; .files-gen written
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz configured (landing-configured)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is configured
2026/10/22 10:31:51 moves: a.go.example.com: the landing carries no build state; removed version null of an earlier stay's at instances/a.go.example.com/build-state.json
2026/10/22 10:31:51 moves: a.go.example.com: generation mv_abcdefghijklmnopqrstuvwxyz built at TXID 3
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz published (landing-published)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is published
2026/10/22 10:31:51 moves: a.go.example.com: the source's location instances/a.go.example.com is parked
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz local (landing-local)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is local
2026/10/22 10:31:51 moves: a.go.example.com: generation mv_abcdefghijklmnopqrstuvwxyz built at TXID 3
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz published (landing-published)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is published
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz local (landing-local)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is local
2026/10/22 10:31:51 moves: a.go.example.com: the prepared files manifest instances/a.go.example.com/files/g-mv_abcdefghijklmnopqrstuvwxyz/manifest.json is written (sha256 bdd5101a4adb10e6490f5f54780ae99c4392728e66784a373d480b548b961831)
2026/10/22 10:31:51 moves: a.go.example.com: files, environment, timers and columns installed; .files-gen written
2026/10/22 10:31:51 moves: a.go.example.com: database installed at /tmp/TestSourceParkWaitsForCommita_committed_record_whose_row_anothe4274205340/005/a.go.example.com.db (sha256:ae0661eb68be3f7cf598dba7530492d53b78f5082395b4a1ac8e1f86ea82228d), generation mv_abcdefghijklmnopqrstuvwxyz
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz configured (landing-configured)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is configured
2026/10/22 10:31:51 moves: a.go.example.com: the installation is no longer this install's: /tmp/TestLandingInstallRefusesASuccessora_successor_marker3617802349/005/a.go.example.com.db.gen names generation successor
2026/10/22 10:31:51 moves: a.go.example.com: the prepared files manifest instances/a.go.example.com/files/g-mv_abcdefghijklmnopqrstuvwxyz/manifest.json is written (sha256 bdd5101a4adb10e6490f5f54780ae99c4392728e66784a373d480b548b961831)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz restored (landing-restored)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is restored
2026/10/22 10:31:51 moves: a.go.example.com: files, environment, timers and columns installed; .files-gen written
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz configured (landing-configured)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is configured
2026/10/22 10:31:51 moves: a.go.example.com: database installed at /tmp/TestALandingWithNoBuildStatePlacesNone1841436548/005/a.go.example.com.db (sha256:ae0661eb68be3f7cf598dba7530492d53b78f5082395b4a1ac8e1f86ea82228d), generation mv_abcdefghijklmnopqrstuvwxyz
2026/10/22 10:31:51 moves: a.go.example.com: the local artifacts of mv_abcdefghijklmnopqrstuvwxyz are parked in /tmp/TestSourceParkSurvivesACrashAfterTheRowDeleteafter-row-delete3967856812/002/.parked/cc4fe64fa6da6232556d039690a7c19690555ce5d542faba1e57a3d3c896c3bb/a.go.example.com/0a3b8abec34e26227dcca575cd15d9ba
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz waits at restored: this box has no probe wake (claim Plan 11's launcher and Plan 5 Task 9's arming are needed)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz restored (landing-restored)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is restored
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz waits at restored: this box has no probe wake (claim Plan 11's launcher and Plan 5 Task 9's arming are needed)
2026/10/22 10:31:51 moves: a.go.example.com: the source's row and its timers are deleted
2026/10/22 10:31:51 moves: a.go.example.com: injected crash
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz requested (requested)
2026/10/22 10:31:51 moves: a.go.example.com: staged the files archive sha256:c9229ef8e7256a1dcd5c2715b11ac3016951e8fee8e0bfa823aa2460f0d331c8 (2 files, 19 bytes)
2026/10/22 10:31:51 moves: a.go.example.com: not ready: the target has not published a readiness report yet
2026/10/22 10:31:51 moves: a.go.example.com: database installed at /tmp/TestALandingWithNoBuildStateRemovesALeftoverOne2264167242/005/a.go.example.com.db (sha256:ae0661eb68be3f7cf598dba7530492d53b78f5082395b4a1ac8e1f86ea82228d), generation mv_abcdefghijklmnopqrstuvwxyz
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz restored (landing-restored)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is restored
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz waits at restored: this box has no probe wake (claim Plan 11's launcher and Plan 5 Task 9's arming are needed)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz ready (ready)
2026/10/22 10:31:51 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz is ready (last round moved 1815 bytes; bar 16777216)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz cut_requested (cutting-requested)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz admitted (cutting-admitted)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopping (cutting-stopping)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopping
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopped (cutting-stopped)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopped
2026/10/22 10:31:51 moves: a.go.example.com: stopped at TXID 3; execution given up, citing moves/bab/app/a.go.example.com/mv_abcdefghijklmnopqrstuvwxyz/stopped-source.json
2026/10/22 10:31:51 moves: a.go.example.com: sealed 4 replica objects at TXID 3
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz staged (cutting-staged)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is staged
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz archived (cutting-archived)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is archived
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz flipped (cutting-flipped)
2026/10/22 10:31:51 moves: a.go.example.com: flipped to uk
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz requested (requested)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz parking (landing-parking)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is parking
2026/10/22 10:31:51 moves: a.go.example.com: staged the files archive sha256:c9229ef8e7256a1dcd5c2715b11ac3016951e8fee8e0bfa823aa2460f0d331c8 (2 files, 19 bytes)
2026/10/22 10:31:51 moves: a.go.example.com: not ready: the target has not published a readiness report yet
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz building (landing-building)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is building
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz requested (requested)
2026/10/22 10:31:51 moves: a.go.example.com: staged the files archive sha256:c9229ef8e7256a1dcd5c2715b11ac3016951e8fee8e0bfa823aa2460f0d331c8 (2 files, 19 bytes)
2026/10/22 10:31:51 moves: a.go.example.com: not ready: the target has not published a readiness report yet
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz ready (ready)
2026/10/22 10:31:51 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz is ready (last round moved 1815 bytes; bar 16777216)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz cut_requested (cutting-requested)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz source_parked (committed-source_parked)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz admitted (cutting-admitted)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopping (cutting-stopping)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopping
2026/10/22 10:31:51 moves: a.go.example.com: the source has parked what it kept for mv_abcdefghijklmnopqrstuvwxyz
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopped (cutting-stopped)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopped
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz ready (ready)
2026/10/22 10:31:51 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz is ready (last round moved 1815 bytes; bar 16777216)
2026/10/22 10:31:51 moves: a.go.example.com: the source's finalization of mv_abcdefghijklmnopqrstuvwxyz is complete
2026/10/22 10:31:51 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz closes once the target has opened and the source has parked (opened false, parked true)
2026/10/22 10:31:51 moves: a.go.example.com: stopped at TXID 3; execution given up, citing moves/bab/app/a.go.example.com/mv_abcdefghijklmnopqrstuvwxyz/stopped-source.json
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz cut_requested (cutting-requested)
2026/10/22 10:31:51 moves: a.go.example.com: sealed 4 replica objects at TXID 3
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz staged (cutting-staged)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is staged
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz admitted (cutting-admitted)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz archived (cutting-archived)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is archived
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopping (cutting-stopping)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopping
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz flipped (cutting-flipped)
2026/10/22 10:31:51 moves: a.go.example.com: flipped to uk
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopped (cutting-stopped)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopped
2026/10/22 10:31:51 moves: a.go.example.com: stopped at TXID 3; execution given up, citing moves/bab/app/a.go.example.com/mv_abcdefghijklmnopqrstuvwxyz/stopped-source.json
2026/10/22 10:31:51 moves: a.go.example.com: the landing placed the moved build state at instances/a.go.example.com/build-state.json
2026/10/22 10:31:51 moves: a.go.example.com: generation mv_abcdefghijklmnopqrstuvwxyz built at TXID 3
2026/10/22 10:31:51 moves: a.go.example.com: sealed 4 replica objects at TXID 3
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz published (landing-published)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is published
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz staged (cutting-staged)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is staged
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz local (landing-local)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is local
2026/10/22 10:31:51 moves: a.go.example.com: the prepared files manifest instances/a.go.example.com/files/g-mv_abcdefghijklmnopqrstuvwxyz/manifest.json is written (sha256 bdd5101a4adb10e6490f5f54780ae99c4392728e66784a373d480b548b961831)
2026/10/22 10:31:51 moves: a.go.example.com: files, environment, timers and columns installed; .files-gen written
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz archived (cutting-archived)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is archived
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz configured (landing-configured)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is configured
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz flipped (cutting-flipped)
2026/10/22 10:31:51 moves: a.go.example.com: flipped to uk
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz building (rolling_back-source-building)
2026/10/22 10:31:51 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is building
2026/10/22 10:31:51 moves: a.go.example.com: database installed at /tmp/TestTheLandingPlacesTheSealedVersionNotALaterOne350794887/005/a.go.example.com.db (sha256:ae0661eb68be3f7cf598dba7530492d53b78f5082395b4a1ac8e1f86ea82228d), generation mv_abcdefghijklmnopqrstuvwxyz
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz restored (landing-restored)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is restored
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz waits at restored: this box has no probe wake (claim Plan 11's launcher and Plan 5 Task 9's arming are needed)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz requested (requested)
2026/10/22 10:31:51 moves: a.go.example.com: generation rb_abcdefghijklmnopqrstuvwxyz built at TXID 3
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz published (rolling_back-source-published)
2026/10/22 10:31:51 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is published
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz local (rolling_back-source-local)
2026/10/22 10:31:51 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is local
2026/10/22 10:31:51 moves: a.go.example.com: staged the files archive sha256:c9229ef8e7256a1dcd5c2715b11ac3016951e8fee8e0bfa823aa2460f0d331c8 (2 files, 19 bytes)
2026/10/22 10:31:51 moves: a.go.example.com: not ready: the target has not published a readiness report yet
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz ready (ready)
2026/10/22 10:31:51 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz is ready (last round moved 1815 bytes; bar 16777216)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz cut_requested (cutting-requested)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz admitted (cutting-admitted)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopping (cutting-stopping)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopping
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopped (cutting-stopped)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopped
2026/10/22 10:31:51 moves: a.go.example.com: the prepared files manifest instances/a.go.example.com/files/g-rb_abcdefghijklmnopqrstuvwxyz/manifest.json is written (sha256 55dbb82acc5c0c115c4dafe3b5bb8fd1a6b54694ab110cf32b00cbad0e10f430)
2026/10/22 10:31:51 moves: a.go.example.com: files, environment, timers and columns installed; .files-gen written
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz configured (rolling_back-source-configured)
2026/10/22 10:31:51 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is configured
2026/10/22 10:31:51 moves: a.go.example.com: stopped at TXID 3; execution given up, citing moves/bab/app/a.go.example.com/mv_abcdefghijklmnopqrstuvwxyz/stopped-source.json
2026/10/22 10:31:51 moves: a.go.example.com: sealed 4 replica objects at TXID 3
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz staged (cutting-staged)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is staged
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz archived (cutting-archived)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is archived
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz flipped (cutting-flipped)
2026/10/22 10:31:51 moves: a.go.example.com: flipped to uk
2026/10/22 10:31:51 moves: a.go.example.com: T7: stage v7: promotion record app/v7: signature verification failed
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz parking (landing-parking)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is parking
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz building (landing-building)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is building
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz requested (requested)
2026/10/22 10:31:51 moves: a.go.example.com: staged the files archive sha256:c9229ef8e7256a1dcd5c2715b11ac3016951e8fee8e0bfa823aa2460f0d331c8 (2 files, 19 bytes)
2026/10/22 10:31:51 moves: a.go.example.com: not ready: the target has not published a readiness report yet
2026/10/22 10:31:51 moves: a.go.example.com: database installed at /tmp/TestDirtyReturnReplaysFromTheJournalafter-pre_move_parked2111378713/002/a.go.example.com.db (sha256:ae0661eb68be3f7cf598dba7530492d53b78f5082395b4a1ac8e1f86ea82228d), generation rb_abcdefghijklmnopqrstuvwxyz
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz restored (rolling_back-source-restored)
2026/10/22 10:31:51 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is restored
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz requested (requested)
2026/10/22 10:31:51 moves: a.go.example.com: staged the files archive sha256:c9229ef8e7256a1dcd5c2715b11ac3016951e8fee8e0bfa823aa2460f0d331c8 (2 files, 19 bytes)
2026/10/22 10:31:51 moves: a.go.example.com: not ready: the target has not published a readiness report yet
2026/10/22 10:31:51 moves: a.go.example.com: generation mv_abcdefghijklmnopqrstuvwxyz built at TXID 3
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz published (landing-published)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is published
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz local (landing-local)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is local
2026/10/22 10:31:51 moves: a.go.example.com: the prepared files manifest instances/a.go.example.com/files/g-mv_abcdefghijklmnopqrstuvwxyz/manifest.json is written (sha256 bdd5101a4adb10e6490f5f54780ae99c4392728e66784a373d480b548b961831)
2026/10/22 10:31:51 moves: a.go.example.com: files, environment, timers and columns installed; .files-gen written
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz configured (landing-configured)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is configured
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz ready (ready)
2026/10/22 10:31:51 moves: a.go.example.com: hostguard: installation inactive
2026/10/22 10:31:51 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz is ready (last round moved 1815 bytes; bar 16777216)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz cut_requested (cutting-requested)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz admitted (cutting-admitted)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopping (cutting-stopping)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopping
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopped (cutting-stopped)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopped
2026/10/22 10:31:51 moves: a.go.example.com: stopped at TXID 3; execution given up, citing moves/bab/app/a.go.example.com/mv_abcdefghijklmnopqrstuvwxyz/stopped-source.json
2026/10/22 10:31:51 moves: a.go.example.com: sealed 4 replica objects at TXID 3
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz staged (cutting-staged)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is staged
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz archived (cutting-archived)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is archived
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz flipped (cutting-flipped)
2026/10/22 10:31:51 moves: a.go.example.com: flipped to uk
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz building (rolling_back-source-building)
2026/10/22 10:31:51 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is building
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz requested (requested)
2026/10/22 10:31:51 moves: a.go.example.com: staged the files archive sha256:c9229ef8e7256a1dcd5c2715b11ac3016951e8fee8e0bfa823aa2460f0d331c8 (2 files, 19 bytes)
2026/10/22 10:31:51 moves: a.go.example.com: not ready: the target has not published a readiness report yet
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz ready (ready)
2026/10/22 10:31:51 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz is ready (last round moved 1815 bytes; bar 16777216)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz cut_requested (cutting-requested)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz admitted (cutting-admitted)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopping (cutting-stopping)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopping
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopped (cutting-stopped)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopped
2026/10/22 10:31:51 moves: a.go.example.com: stopped at TXID 3; execution given up, citing moves/bab/app/a.go.example.com/mv_abcdefghijklmnopqrstuvwxyz/stopped-source.json
2026/10/22 10:31:51 moves: a.go.example.com: sealed 4 replica objects at TXID 3
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz staged (cutting-staged)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is staged
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz archived (cutting-archived)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is archived
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz flipped (cutting-flipped)
2026/10/22 10:31:51 moves: a.go.example.com: flipped to uk
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz requested (requested)
2026/10/22 10:31:51 moves: a.go.example.com: staged the files archive sha256:c9229ef8e7256a1dcd5c2715b11ac3016951e8fee8e0bfa823aa2460f0d331c8 (2 files, 19 bytes)
2026/10/22 10:31:51 moves: a.go.example.com: not ready: the target has not published a readiness report yet
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz building (rolling_back-source-building)
2026/10/22 10:31:51 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is building
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz ready (ready)
2026/10/22 10:31:51 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz is ready (last round moved 1815 bytes; bar 16777216)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz cut_requested (cutting-requested)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz admitted (cutting-admitted)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopping (cutting-stopping)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopping
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopped (cutting-stopped)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopped
2026/10/22 10:31:51 moves: a.go.example.com: stopped at TXID 3; execution given up, citing moves/bab/app/a.go.example.com/mv_abcdefghijklmnopqrstuvwxyz/stopped-source.json
2026/10/22 10:31:51 moves: a.go.example.com: sealed 4 replica objects at TXID 3
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz staged (cutting-staged)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is staged
2026/10/22 10:31:51 moves: a.go.example.com: generation rb_abcdefghijklmnopqrstuvwxyz built at TXID 3
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz published (rolling_back-source-published)
2026/10/22 10:31:51 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is published
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz archived (cutting-archived)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is archived
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz local (rolling_back-source-local)
2026/10/22 10:31:51 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is local
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz flipped (cutting-flipped)
2026/10/22 10:31:51 moves: a.go.example.com: flipped to uk
2026/10/22 10:31:51 moves: a.go.example.com: the local artifacts of rb_abcdefghijklmnopqrstuvwxyz are parked in /tmp/TestDirtyReturnReplaysFromTheJournalafter-staged3706402176/002/.parked/cc4fe64fa6da6232556d039690a7c19690555ce5d542faba1e57a3d3c896c3bb/a.go.example.com/f6e27e20fb48fee3eb4f2eaa9bff0155
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz parking (landing-parking)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is parking
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz building (landing-building)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is building
2026/10/22 10:31:51 moves: a.go.example.com: the prepared files manifest instances/a.go.example.com/files/g-rb_abcdefghijklmnopqrstuvwxyz/manifest.json is written (sha256 55dbb82acc5c0c115c4dafe3b5bb8fd1a6b54694ab110cf32b00cbad0e10f430)
2026/10/22 10:31:51 moves: a.go.example.com: files, environment, timers and columns installed; .files-gen written
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz configured (rolling_back-source-configured)
2026/10/22 10:31:51 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is configured
2026/10/22 10:31:51 moves: a.go.example.com: database installed at /tmp/TestDirtyReturnReplaysFromTheJournalafter-staged3706402176/002/a.go.example.com.db (sha256:ae0661eb68be3f7cf598dba7530492d53b78f5082395b4a1ac8e1f86ea82228d), generation rb_abcdefghijklmnopqrstuvwxyz
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz restored (rolling_back-source-restored)
2026/10/22 10:31:51 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is restored
2026/10/22 10:31:51 moves: a.go.example.com: generation mv_abcdefghijklmnopqrstuvwxyz built at TXID 3
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz published (landing-published)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is published
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz local (landing-local)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is local
2026/10/22 10:31:51 moves: a.go.example.com: install the files: hostguard: installation inactive
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz requested (requested)
2026/10/22 10:31:51 moves: a.go.example.com: staged the files archive sha256:c9229ef8e7256a1dcd5c2715b11ac3016951e8fee8e0bfa823aa2460f0d331c8 (2 files, 19 bytes)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz requested (requested)
2026/10/22 10:31:51 moves: a.go.example.com: not ready: the target has not published a readiness report yet
2026/10/22 10:31:51 moves: a.go.example.com: staged the files archive sha256:c9229ef8e7256a1dcd5c2715b11ac3016951e8fee8e0bfa823aa2460f0d331c8 (2 files, 19 bytes)
2026/10/22 10:31:51 moves: a.go.example.com: not ready: the target has not published a readiness report yet
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz ready (ready)
2026/10/22 10:31:51 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz is ready (last round moved 1815 bytes; bar 16777216)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz ready (ready)
2026/10/22 10:31:51 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz is ready (last round moved 1815 bytes; bar 16777216)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz cut_requested (cutting-requested)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz cut_requested (cutting-requested)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz admitted (cutting-admitted)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz admitted (cutting-admitted)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopping (cutting-stopping)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopping
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopping (cutting-stopping)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopping
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopped (cutting-stopped)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopped
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopped (cutting-stopped)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopped
2026/10/22 10:31:51 moves: a.go.example.com: stopped at TXID 3; execution given up, citing moves/bab/app/a.go.example.com/mv_abcdefghijklmnopqrstuvwxyz/stopped-source.json
2026/10/22 10:31:51 moves: a.go.example.com: stopped at TXID 3; execution given up, citing moves/bab/app/a.go.example.com/mv_abcdefghijklmnopqrstuvwxyz/stopped-source.json
2026/10/22 10:31:51 moves: a.go.example.com: sealed 4 replica objects at TXID 3
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz staged (cutting-staged)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is staged
2026/10/22 10:31:51 moves: a.go.example.com: sealed 4 replica objects at TXID 3
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz staged (cutting-staged)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is staged
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz archived (cutting-archived)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is archived
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz archived (cutting-archived)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is archived
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz flipped (cutting-flipped)
2026/10/22 10:31:51 moves: a.go.example.com: flipped to uk
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz flipped (cutting-flipped)
2026/10/22 10:31:51 moves: a.go.example.com: flipped to uk
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz parking (landing-parking)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is parking
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz building (landing-building)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is building
2026/10/22 10:31:51 moves: a.go.example.com: the landing placed the moved build state at instances/a.go.example.com/build-state.json
2026/10/22 10:31:51 moves: a.go.example.com: generation mv_abcdefghijklmnopqrstuvwxyz built at TXID 3
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz published (landing-published)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is published
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz building (rolling_back-source-building)
2026/10/22 10:31:51 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is building
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz local (landing-local)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is local
2026/10/22 10:31:51 moves: a.go.example.com: generation rb_abcdefghijklmnopqrstuvwxyz built at TXID 3
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz published (rolling_back-source-published)
2026/10/22 10:31:51 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is published
2026/10/22 10:31:51 moves: a.go.example.com: the prepared files manifest instances/a.go.example.com/files/g-mv_abcdefghijklmnopqrstuvwxyz/manifest.json is written (sha256 bdd5101a4adb10e6490f5f54780ae99c4392728e66784a373d480b548b961831)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz local (rolling_back-source-local)
2026/10/22 10:31:51 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is local
2026/10/22 10:31:51 moves: a.go.example.com: files, environment, timers and columns installed; .files-gen written
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz configured (landing-configured)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is configured
2026/10/22 10:31:51 moves: a.go.example.com: the local artifacts of rb_abcdefghijklmnopqrstuvwxyz are parked in /tmp/TestDirtyReturnReplaysFromTheJournalafter-files-rename372482265/002/.parked/cc4fe64fa6da6232556d039690a7c19690555ce5d542faba1e57a3d3c896c3bb/a.go.example.com/3d0b6401c89cf2908b9ce9324906de51
2026/10/22 10:31:51 moves: a.go.example.com: the prepared files manifest instances/a.go.example.com/files/g-rb_abcdefghijklmnopqrstuvwxyz/manifest.json is written (sha256 55dbb82acc5c0c115c4dafe3b5bb8fd1a6b54694ab110cf32b00cbad0e10f430)
2026/10/22 10:31:51 moves: a.go.example.com: files, environment, timers and columns installed; .files-gen written
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz configured (rolling_back-source-configured)
2026/10/22 10:31:51 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is configured
2026/10/22 10:31:51 moves: a.go.example.com: database installed at /tmp/TestTheLandingPlacesTheBuildStateBeforeTheProbe727185721/005/a.go.example.com.db (sha256:ae0661eb68be3f7cf598dba7530492d53b78f5082395b4a1ac8e1f86ea82228d), generation mv_abcdefghijklmnopqrstuvwxyz
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz restored (landing-restored)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is restored
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz waits at restored: this box has no probe wake (claim Plan 11's launcher and Plan 5 Task 9's arming are needed)
2026/10/22 10:31:51 moves: a.go.example.com: database installed at /tmp/TestDirtyReturnReplaysFromTheJournalafter-files-rename372482265/002/a.go.example.com.db (sha256:ae0661eb68be3f7cf598dba7530492d53b78f5082395b4a1ac8e1f86ea82228d), generation rb_abcdefghijklmnopqrstuvwxyz
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz probing (landing-probing)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is probing
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz restored (rolling_back-source-restored)
2026/10/22 10:31:51 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is restored
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz probe_attempt (probe_attempt-1)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz passed its probe on attempt 1 of 1
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz probed (landing-probed)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is probed
2026/10/22 10:31:51 moves: a.go.example.com: held at probed by the test
warm.test: repointed -> v1 (edge; hibernating — runs it on next wake)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz requested (requested)
2026/10/22 10:31:51 moves: a.go.example.com: staged the files archive sha256:c9229ef8e7256a1dcd5c2715b11ac3016951e8fee8e0bfa823aa2460f0d331c8 (2 files, 19 bytes)
2026/10/22 10:31:51 moves: a.go.example.com: not ready: the target has not published a readiness report yet
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz ready (ready)
2026/10/22 10:31:51 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz is ready (last round moved 1815 bytes; bar 16777216)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz cut_requested (cutting-requested)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz admitted (cutting-admitted)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopping (cutting-stopping)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopping
warm.test: repointed v1 -> v2 (edge; hibernating — runs it on next wake)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopped (cutting-stopped)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopped
2026/10/22 10:31:51 moves: a.go.example.com: stopped at TXID 3; execution given up, citing moves/bab/app/a.go.example.com/mv_abcdefghijklmnopqrstuvwxyz/stopped-source.json
2026/10/22 10:31:51 moves: a.go.example.com: sealed 4 replica objects at TXID 3
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz staged (cutting-staged)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is staged
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz archived (cutting-archived)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is archived
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz flipped (cutting-flipped)
2026/10/22 10:31:51 moves: a.go.example.com: flipped to uk
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz parking (landing-parking)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is parking
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz building (landing-building)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is building
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz requested (requested)
2026/10/22 10:31:51 moves: a.go.example.com: staged the files archive sha256:c9229ef8e7256a1dcd5c2715b11ac3016951e8fee8e0bfa823aa2460f0d331c8 (2 files, 19 bytes)
2026/10/22 10:31:51 moves: a.go.example.com: not ready: the target has not published a readiness report yet
2026/10/22 10:31:51 activator: warm.test serving v1 but v2 is adopted — cycling onto the new build
2026/10/22 10:31:51 agent: warm.test was adopted onto v2 by another pass — cycled its warm instance onto it
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz ready (ready)
2026/10/22 10:31:51 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz is ready (last round moved 1815 bytes; bar 16777216)
2026/10/22 10:31:51 moves: a.go.example.com: the landing placed the moved build state at instances/a.go.example.com/build-state.json
2026/10/22 10:31:51 moves: a.go.example.com: generation mv_abcdefghijklmnopqrstuvwxyz built at TXID 3
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz published (landing-published)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is published
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz cut_requested (cutting-requested)
2026/10/22 10:31:51 activator: warm.test hibernated
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz local (landing-local)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is local
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz admitted (cutting-admitted)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopping (cutting-stopping)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopping
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopped (cutting-stopped)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopped
2026/10/22 10:31:51 moves: a.go.example.com: stopped at TXID 3; execution given up, citing moves/bab/app/a.go.example.com/mv_abcdefghijklmnopqrstuvwxyz/stopped-source.json
2026/10/22 10:31:51 moves: a.go.example.com: sealed 4 replica objects at TXID 3
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz staged (cutting-staged)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is staged
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz archived (cutting-archived)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is archived
2026/10/22 10:31:51 moves: a.go.example.com: the prepared files manifest instances/a.go.example.com/files/g-mv_abcdefghijklmnopqrstuvwxyz/manifest.json is written (sha256 bdd5101a4adb10e6490f5f54780ae99c4392728e66784a373d480b548b961831)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz flipped (cutting-flipped)
2026/10/22 10:31:51 moves: a.go.example.com: flipped to uk
2026/10/22 10:31:51 moves: a.go.example.com: files, environment, timers and columns installed; .files-gen written
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz configured (landing-configured)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is configured
2026/10/22 10:31:51 activator: warm.test hibernated
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz building (rolling_back-source-building)
2026/10/22 10:31:51 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is building
2026/10/22 10:31:51 moves: a.go.example.com: database installed at /tmp/TestTheReturnLaneCarriesTheRequest401282583/005/a.go.example.com.db (sha256:ae0661eb68be3f7cf598dba7530492d53b78f5082395b4a1ac8e1f86ea82228d), generation mv_abcdefghijklmnopqrstuvwxyz
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz restored (landing-restored)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is restored
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz waits at restored: this box has no probe wake (claim Plan 11's launcher and Plan 5 Task 9's arming are needed)
2026/10/22 10:31:51 moves: a.go.example.com: generation rb_abcdefghijklmnopqrstuvwxyz built at TXID 3
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz published (rolling_back-source-published)
2026/10/22 10:31:51 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is published
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz local (rolling_back-source-local)
2026/10/22 10:31:51 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is local
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is past its cut_deadline (2026-10-07T09:01:55Z)
2026/10/22 10:31:51 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz rolls back as rb_qvfqshmsz2ga62uj64ex3oh7gu: the landing ran past its deadline
2026/10/22 10:31:51 moves: a.go.example.com: the local artifacts of rb_abcdefghijklmnopqrstuvwxyz are parked in /tmp/TestDirtyReturnReplaysFromTheJournalafter-record-local1159918750/002/.parked/cc4fe64fa6da6232556d039690a7c19690555ce5d542faba1e57a3d3c896c3bb/a.go.example.com/6336af228c8a8fbda6e6180e53376def
2026/10/22 10:31:51 moves: a.go.example.com: the claim follows rollback rb_qvfqshmsz2ga62uj64ex3oh7gu
2026/10/22 10:31:51 moves: a.go.example.com: the target of rollback rb_qvfqshmsz2ga62uj64ex3oh7gu stopped at TXID 3 (clean false, src_covered false)
2026/10/22 10:31:51 moves: a.go.example.com: the target of rollback rb_qvfqshmsz2ga62uj64ex3oh7gu is released
2026/10/22 10:31:51 moves: a.go.example.com: the target gave execution up for rollback rb_qvfqshmsz2ga62uj64ex3oh7gu, citing moves/bab/app/a.go.example.com/mv_abcdefghijklmnopqrstuvwxyz/stopped-target.json
2026/10/22 10:31:51 moves: a.go.example.com: the target of rollback rb_qvfqshmsz2ga62uj64ex3oh7gu is returning
2026/10/22 10:31:51 moves: a.go.example.com: the prepared files manifest instances/a.go.example.com/files/g-rb_abcdefghijklmnopqrstuvwxyz/manifest.json is written (sha256 55dbb82acc5c0c115c4dafe3b5bb8fd1a6b54694ab110cf32b00cbad0e10f430)
2026/10/22 10:31:51 moves: a.go.example.com: the return lane of rb_qvfqshmsz2ga62uj64ex3oh7gu is sealed: 4 replica objects at TXID 3
2026/10/22 10:31:51 moves: a.go.example.com: files, environment, timers and columns installed; .files-gen written
2026/10/22 10:31:51 moves: a.go.example.com: the target of rollback rb_qvfqshmsz2ga62uj64ex3oh7gu is returned
2026/10/22 10:31:51 moves: a.go.example.com: the target keeps what it holds for rollback rb_qvfqshmsz2ga62uj64ex3oh7gu until the source has recovered
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz configured (rolling_back-source-configured)
2026/10/22 10:31:51 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is configured
2026/10/22 10:31:51 moves: a.go.example.com: database installed at /tmp/TestDirtyReturnReplaysFromTheJournalafter-record-local1159918750/002/a.go.example.com.db (sha256:ae0661eb68be3f7cf598dba7530492d53b78f5082395b4a1ac8e1f86ea82228d), generation rb_abcdefghijklmnopqrstuvwxyz
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz restored (rolling_back-source-restored)
2026/10/22 10:31:51 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is restored
2026/10/22 10:31:51 moves: a.go.example.com: the local artifacts of mv_abcdefghijklmnopqrstuvwxyz are parked in /tmp/TestTheSourceLocationParkAcknowledgesWithABuildState3911637656/002/.parked/cc4fe64fa6da6232556d039690a7c19690555ce5d542faba1e57a3d3c896c3bb/a.go.example.com/c8eac217411b1f70328cb48bf1e71f24
2026/10/22 10:31:51 moves: a.go.example.com: the source's row and its timers are deleted
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz source_parked (committed-source_parked)
2026/10/22 10:31:51 moves: a.go.example.com: the source has parked what it kept for mv_abcdefghijklmnopqrstuvwxyz
2026/10/22 10:31:51 moves: a.go.example.com: the source's finalization of mv_abcdefghijklmnopqrstuvwxyz is complete
2026/10/22 10:31:51 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz closes once the target has opened and the source has parked (opened false, parked true)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz requested (requested)
2026/10/22 10:31:51 moves: a.go.example.com: staged the files archive sha256:c9229ef8e7256a1dcd5c2715b11ac3016951e8fee8e0bfa823aa2460f0d331c8 (2 files, 19 bytes)
2026/10/22 10:31:51 moves: a.go.example.com: not ready: the target has not published a readiness report yet
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz ready (ready)
2026/10/22 10:31:51 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz is ready (last round moved 1815 bytes; bar 16777216)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz cut_requested (cutting-requested)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz admitted (cutting-admitted)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopping (cutting-stopping)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopping
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopped (cutting-stopped)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopped
2026/10/22 10:31:51 moves: a.go.example.com: stopped at TXID 3; execution given up, citing moves/bab/app/a.go.example.com/mv_abcdefghijklmnopqrstuvwxyz/stopped-source.json
2026/10/22 10:31:51 moves: a.go.example.com: sealed 4 replica objects at TXID 3
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz staged (cutting-staged)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is staged
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz archived (cutting-archived)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is archived
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz flipped (cutting-flipped)
2026/10/22 10:31:51 moves: a.go.example.com: flipped to uk
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz requested (requested)
2026/10/22 10:31:51 moves: a.go.example.com: staged the files archive sha256:c9229ef8e7256a1dcd5c2715b11ac3016951e8fee8e0bfa823aa2460f0d331c8 (2 files, 19 bytes)
2026/10/22 10:31:51 moves: a.go.example.com: not ready: the target has not published a readiness report yet
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz ready (ready)
2026/10/22 10:31:51 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz is ready (last round moved 1815 bytes; bar 16777216)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz cut_requested (cutting-requested)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz admitted (cutting-admitted)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopping (cutting-stopping)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopping
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopped (cutting-stopped)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopped
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz building (rolling_back-source-building)
2026/10/22 10:31:51 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is building
2026/10/22 10:31:51 moves: a.go.example.com: stopped at TXID 3; execution given up, citing moves/bab/app/a.go.example.com/mv_abcdefghijklmnopqrstuvwxyz/stopped-source.json
2026/10/22 10:31:51 moves: a.go.example.com: sealed 4 replica objects at TXID 3
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz staged (cutting-staged)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is staged
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz archived (cutting-archived)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is archived
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz flipped (cutting-flipped)
2026/10/22 10:31:51 moves: a.go.example.com: flipped to uk
2026/10/22 10:31:51 moves: a.go.example.com: generation rb_abcdefghijklmnopqrstuvwxyz built at TXID 3
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz published (rolling_back-source-published)
2026/10/22 10:31:51 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is published
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz local (rolling_back-source-local)
2026/10/22 10:31:51 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is local
2026/10/22 10:31:51 moves: a.go.example.com: the local artifacts of rb_abcdefghijklmnopqrstuvwxyz are parked in /tmp/TestDirtyReturnReplaysFromTheJournalafter-db-rename184969774/002/.parked/cc4fe64fa6da6232556d039690a7c19690555ce5d542faba1e57a3d3c896c3bb/a.go.example.com/a06fdbaeec761ae5b49eae6dd4e57d72
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz building (rolling_back-source-building)
2026/10/22 10:31:51 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is building
2026/10/22 10:31:51 moves: a.go.example.com: the prepared files manifest instances/a.go.example.com/files/g-rb_abcdefghijklmnopqrstuvwxyz/manifest.json is written (sha256 55dbb82acc5c0c115c4dafe3b5bb8fd1a6b54694ab110cf32b00cbad0e10f430)
2026/10/22 10:31:51 moves: a.go.example.com: files, environment, timers and columns installed; .files-gen written
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz configured (rolling_back-source-configured)
2026/10/22 10:31:51 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is configured
2026/10/22 10:31:51 moves: a.go.example.com: the return placed the moved build state at instances/a.go.example.com/build-state.json
2026/10/22 10:31:51 moves: a.go.example.com: generation rb_abcdefghijklmnopqrstuvwxyz built at TXID 3
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz published (rolling_back-source-published)
2026/10/22 10:31:51 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is published
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz local (rolling_back-source-local)
2026/10/22 10:31:51 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is local
2026/10/22 10:31:51 moves: a.go.example.com: the source's artifacts of stamp 1 are retired
2026/10/22 10:31:51 moves: a.go.example.com: the local artifacts of rb_abcdefghijklmnopqrstuvwxyz are parked in /tmp/TestTheReturnInstallPlacesTheBuildState1182305595/002/.parked/cc4fe64fa6da6232556d039690a7c19690555ce5d542faba1e57a3d3c896c3bb/a.go.example.com/af880ab80eb634965b596b206cd016da
2026/10/22 10:31:51 moves: a.go.example.com: the prepared files manifest instances/a.go.example.com/files/g-rb_abcdefghijklmnopqrstuvwxyz/manifest.json is written (sha256 55dbb82acc5c0c115c4dafe3b5bb8fd1a6b54694ab110cf32b00cbad0e10f430)
2026/10/22 10:31:51 moves: a.go.example.com: files, environment, timers and columns installed; .files-gen written
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz configured (rolling_back-source-configured)
2026/10/22 10:31:51 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is configured
2026/10/22 10:31:51 moves: a.go.example.com: database installed at /tmp/TestDirtyReturnReplaysFromTheJournalafter-db-rename184969774/002/a.go.example.com.db (sha256:ae0661eb68be3f7cf598dba7530492d53b78f5082395b4a1ac8e1f86ea82228d), generation rb_abcdefghijklmnopqrstuvwxyz
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz restored (rolling_back-source-restored)
2026/10/22 10:31:51 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is restored
2026/10/22 10:31:51 moves: a.go.example.com: database installed at /tmp/TestTheReturnInstallPlacesTheBuildState1182305595/002/a.go.example.com.db (sha256:ae0661eb68be3f7cf598dba7530492d53b78f5082395b4a1ac8e1f86ea82228d), generation rb_abcdefghijklmnopqrstuvwxyz
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz restored (rolling_back-source-restored)
2026/10/22 10:31:51 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is restored
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz requested (requested)
2026/10/22 10:31:51 moves: a.go.example.com: staged the files archive sha256:c9229ef8e7256a1dcd5c2715b11ac3016951e8fee8e0bfa823aa2460f0d331c8 (2 files, 19 bytes)
2026/10/22 10:31:51 moves: a.go.example.com: not ready: the target has not published a readiness report yet
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz ready (ready)
2026/10/22 10:31:51 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz is ready (last round moved 1815 bytes; bar 16777216)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz cut_requested (cutting-requested)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz admitted (cutting-admitted)
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopping (cutting-stopping)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopping
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopped (cutting-stopped)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopped
2026/10/22 10:31:51 moves: a.go.example.com: stopped at TXID 3; execution given up, citing moves/bab/app/a.go.example.com/mv_abcdefghijklmnopqrstuvwxyz/stopped-source.json
2026/10/22 10:31:51 moves: a.go.example.com: sealed 4 replica objects at TXID 3
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz staged (cutting-staged)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is staged
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz archived (cutting-archived)
2026/10/22 10:31:51 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is archived
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz flipped (cutting-flipped)
2026/10/22 10:31:51 moves: a.go.example.com: flipped to uk
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz building (rolling_back-source-building)
2026/10/22 10:31:51 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is building
platform.example.com: update to v2 failed: console.service did not come up: not ready after 5s: permission denied — rolled the symlink back
2026/10/22 10:31:51 moves: a.go.example.com: generation rb_abcdefghijklmnopqrstuvwxyz built at TXID 3
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz published (rolling_back-source-published)
2026/10/22 10:31:51 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is published
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz local (rolling_back-source-local)
2026/10/22 10:31:51 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is local
2026/10/22 10:31:51 moves: a.go.example.com: the local artifacts of rb_abcdefghijklmnopqrstuvwxyz are parked in /tmp/TestDirtyReturnReplaysFromTheJournalafter-record-restored777348017/002/.parked/cc4fe64fa6da6232556d039690a7c19690555ce5d542faba1e57a3d3c896c3bb/a.go.example.com/d27454a7822bad3a1fac532b96751aaa
2026/10/22 10:31:51 moves: a.go.example.com: the prepared files manifest instances/a.go.example.com/files/g-rb_abcdefghijklmnopqrstuvwxyz/manifest.json is written (sha256 55dbb82acc5c0c115c4dafe3b5bb8fd1a6b54694ab110cf32b00cbad0e10f430)
2026/10/22 10:31:51 moves: a.go.example.com: files, environment, timers and columns installed; .files-gen written
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz configured (rolling_back-source-configured)
2026/10/22 10:31:51 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is configured
2026/10/22 10:31:51 moves: a.go.example.com: database installed at /tmp/TestDirtyReturnReplaysFromTheJournalafter-record-restored777348017/002/a.go.example.com.db (sha256:ae0661eb68be3f7cf598dba7530492d53b78f5082395b4a1ac8e1f86ea82228d), generation rb_abcdefghijklmnopqrstuvwxyz
2026/10/22 10:31:51 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz restored (rolling_back-source-restored)
2026/10/22 10:31:51 moves: a.go.example.com: return mv_abcdefghijklmnopqrstuvwxyz is restored
2026/10/22 10:31:51 moves: a.go.example.com: T7: stage v7: release: the held release is not authorized: no promotion record and no signed pointer names it: bab/app at v7
2026/10/22 10:31:51 moves: a.go.example.com: the source's finalization of mv_abcdefghijklmnopqrstuvwxyz waits: this box's row is not held by the move
2026/10/22 10:31:52 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz requested (requested)
2026/10/22 10:31:52 moves: a.go.example.com: staged the files archive sha256:c9229ef8e7256a1dcd5c2715b11ac3016951e8fee8e0bfa823aa2460f0d331c8 (2 files, 19 bytes)
2026/10/22 10:31:52 moves: a.go.example.com: not ready: the target has not published a readiness report yet
2026/10/22 10:31:52 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz ready (ready)
2026/10/22 10:31:52 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz is ready (last round moved 1815 bytes; bar 16777216)
2026/10/22 10:31:52 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz cut_requested (cutting-requested)
2026/10/22 10:31:52 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz admitted (cutting-admitted)
2026/10/22 10:31:52 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopping (cutting-stopping)
2026/10/22 10:31:52 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopping
2026/10/22 10:31:52 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopped (cutting-stopped)
2026/10/22 10:31:52 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopped
2026/10/22 10:31:52 moves: a.go.example.com: stopped at TXID 3; execution given up, citing moves/bab/app/a.go.example.com/mv_abcdefghijklmnopqrstuvwxyz/stopped-source.json
2026/10/22 10:31:52 moves: a.go.example.com: sealed 4 replica objects at TXID 3
2026/10/22 10:31:52 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz staged (cutting-staged)
2026/10/22 10:31:52 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is staged
2026/10/22 10:31:52 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz archived (cutting-archived)
2026/10/22 10:31:52 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is archived
2026/10/22 10:31:52 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz flipped (cutting-flipped)
2026/10/22 10:31:52 moves: a.go.example.com: flipped to uk
2026/10/22 10:31:52 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz parking (landing-parking)
2026/10/22 10:31:52 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is parking
2026/10/22 10:31:52 activator: replica shop.bab.oncarlos.com not started: it has no key of its home's and no control socket, so an app on the instance-key helper would mint its own
2026/10/22 10:31:52 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz building (landing-building)
2026/10/22 10:31:52 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is building
2026/10/22 10:31:52 moves: a.go.example.com: generation mv_abcdefghijklmnopqrstuvwxyz built at TXID 3
2026/10/22 10:31:52 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz published (landing-published)
2026/10/22 10:31:52 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is published
2026/10/22 10:31:52 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz local (landing-local)
2026/10/22 10:31:52 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is local
2026/10/22 10:31:52 moves: a.go.example.com: the prepared files manifest instances/a.go.example.com/files/g-mv_abcdefghijklmnopqrstuvwxyz/manifest.json is written (sha256 bdd5101a4adb10e6490f5f54780ae99c4392728e66784a373d480b548b961831)
2026/10/22 10:31:52 moves: a.go.example.com: files, environment, timers and columns installed; .files-gen written
2026/10/22 10:31:52 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz configured (landing-configured)
2026/10/22 10:31:52 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is configured
2026/10/22 10:31:52 moves: a.go.example.com: database installed at /tmp/TestSourceParkWaitsForCommita_committed_record_with_no_row_and_363655922/005/a.go.example.com.db (sha256:ae0661eb68be3f7cf598dba7530492d53b78f5082395b4a1ac8e1f86ea82228d), generation mv_abcdefghijklmnopqrstuvwxyz
2026/10/22 10:31:52 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz restored (landing-restored)
2026/10/22 10:31:52 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is restored
2026/10/22 10:31:52 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz waits at restored: this box has no probe wake (claim Plan 11's launcher and Plan 5 Task 9's arming are needed)
2026/10/22 10:31:52 agent: build state of a.example.com: context deadline exceeded
2026/10/22 10:31:52 agent: build state refresh: the 200ms budget ran out; 2 of 3 hosts not reached keep their last copy
flap.test: update to new failed: unit would not come back — rolled the symlink back
2026/10/22 10:31:52 activator: replica shop.bab.oncarlos.com not started: CARLOS_INSTANCE_KEY is not its home's key
flap.test: update to new failed: unit would not come back — rolled the symlink back
flap.test: updated old -> new (canary/dev)
2026/10/22 10:31:52 agent: CARLOS_SECRETS_KEY does not parse, so no secrets_key_fp is published: CARLOS_SECRETS_KEY: invalid base64: illegal base64 data at input byte 3
2026/10/22 10:31:52 agent: CARLOS_SECRETS_KEY does not parse, so no secrets_key_fp is published: CARLOS_SECRETS_KEY: crypto/ecdh: invalid private key
2026/10/22 10:31:52 moves: a.go.example.com: the source's finalization of mv_abcdefghijklmnopqrstuvwxyz waits: this box's row is not held by the move
2026/10/22 10:31:52 agent: build state of b.example.com: context deadline exceeded
2026/10/22 10:31:52 agent: build state refresh: the 200ms budget ran out; 2 of 3 hosts not reached keep their last copy
2026/10/22 10:31:52 adopt: bounced exec instance plain.test onto its new version
plain.test: updated -> v1 (canary/dev)
2026/10/22 10:31:52 adopt: bounced exec instance warm.test onto its new version
warm.test: repointed -> v1 (canary/dev; hibernating — bounced if awake, else runs it on next wake)
2026/10/22 10:31:52 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz requested (requested)
2026/10/22 10:31:52 moves: a.go.example.com: staged the files archive sha256:c9229ef8e7256a1dcd5c2715b11ac3016951e8fee8e0bfa823aa2460f0d331c8 (2 files, 19 bytes)
2026/10/22 10:31:52 moves: a.go.example.com: not ready: the target has not published a readiness report yet
sleepy.test: repointed -> v1 (canary/dev; hibernating — bounced if awake, else runs it on next wake)
2026/10/22 10:31:52 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz ready (ready)
2026/10/22 10:31:52 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz is ready (last round moved 1815 bytes; bar 16777216)
2026/10/22 10:31:52 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz cut_requested (cutting-requested)
2026/10/22 10:31:52 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz admitted (cutting-admitted)
platform.example.com: update to v2 failed: console.service did not come up: not ready after 5s: permission denied — rolled the symlink back
2026/10/22 10:31:52 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopping (cutting-stopping)
2026/10/22 10:31:52 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopping
2026/10/22 10:31:52 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz stopped (cutting-stopped)
2026/10/22 10:31:52 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is stopped
2026/10/22 10:31:52 moves: a.go.example.com: stopped at TXID 3; execution given up, citing moves/bab/app/a.go.example.com/mv_abcdefghijklmnopqrstuvwxyz/stopped-source.json
2026/10/22 10:31:52 moves: a.go.example.com: sealed 4 replica objects at TXID 3
2026/10/22 10:31:52 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz staged (cutting-staged)
2026/10/22 10:31:52 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is staged
2026/10/22 10:31:52 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz archived (cutting-archived)
2026/10/22 10:31:52 moves: a.go.example.com: cut mv_abcdefghijklmnopqrstuvwxyz is archived
2026/10/22 10:31:52 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz flipped (cutting-flipped)
2026/10/22 10:31:52 moves: a.go.example.com: flipped to uk
2026/10/22 10:31:52 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz parking (landing-parking)
2026/10/22 10:31:52 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is parking
2026/10/22 10:31:52 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz building (landing-building)
2026/10/22 10:31:52 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is building
2026/10/22 10:31:52 adopt: bounced exec instance warm.test onto its new version
warm.test: repointed -> v1 (canary/dev; hibernating — bounced if awake, else runs it on next wake)
2026/10/22 10:31:52 moves: a.go.example.com: generation mv_abcdefghijklmnopqrstuvwxyz built at TXID 3
2026/10/22 10:31:52 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz published (landing-published)
2026/10/22 10:31:52 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is published
2026/10/22 10:31:52 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz local (landing-local)
2026/10/22 10:31:52 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is local
2026/10/22 10:31:52 moves: a.go.example.com: the prepared files manifest instances/a.go.example.com/files/g-mv_abcdefghijklmnopqrstuvwxyz/manifest.json is written (sha256 bdd5101a4adb10e6490f5f54780ae99c4392728e66784a373d480b548b961831)
2026/10/22 10:31:52 moves: a.go.example.com: files, environment, timers and columns installed; .files-gen written
2026/10/22 10:31:52 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz configured (landing-configured)
2026/10/22 10:31:52 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is configured
2026/10/22 10:31:52 moves: a.go.example.com: database installed at /tmp/TestSourceParkWaitsForCommitthen_the_commit1469114421/005/a.go.example.com.db (sha256:ae0661eb68be3f7cf598dba7530492d53b78f5082395b4a1ac8e1f86ea82228d), generation mv_abcdefghijklmnopqrstuvwxyz
2026/10/22 10:31:52 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz restored (landing-restored)
2026/10/22 10:31:52 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz is restored
2026/10/22 10:31:52 moves: a.go.example.com: landing mv_abcdefghijklmnopqrstuvwxyz waits at restored: this box has no probe wake (claim Plan 11's launcher and Plan 5 Task 9's arming are needed)
platform.example.com: rolled back to v1 but could not start it: console.service did not come up: not ready after 5s: permission denied — this host may be serving nothing
2026/10/22 10:31:52 agent: build state of c.example.com: context deadline exceeded
2026/10/22 10:31:52 agent: build state refresh: the 200ms budget ran out; 2 of 3 hosts not reached keep their last copy
held.example.com: layout migration in flight; bundle not written this pass
2026/10/22 10:31:52 agent: build state of a.example.com: context deadline exceeded
2026/10/22 10:31:52 agent: build state refresh: the 200ms budget ran out; 2 of 3 hosts not reached keep their last copy
2026/10/22 10:31:53 agent: retention: pruned 1 of 1 eligible versions for bab/kass (keep 20)
2026/10/22 10:31:53 agent: retention bab/kass: pruning nothing this pass: no box report names the build state of kass.example.com
2026/10/22 10:31:53 agent: retention: pruned 1 of 1 eligible versions for bab/kass (keep 20)
platform.example.com: update to v2 failed: console.service did not come up: not ready after 5s: permission denied — rolled the symlink back
2026/10/22 10:31:53 moves: a.go.example.com: the source's location instances/a.go.example.com is parked
2026/10/22 10:31:53 moves: a.go.example.com: the local artifacts of mv_abcdefghijklmnopqrstuvwxyz are parked in /tmp/TestSourceParkWaitsForCommitthen_the_commit1469114421/002/.parked/cc4fe64fa6da6232556d039690a7c19690555ce5d542faba1e57a3d3c896c3bb/a.go.example.com/495271fbe5ab04f10e61fe6618a00cb0
2026/10/22 10:31:53 moves: a.go.example.com: the source's row and its timers are deleted
2026/10/22 10:31:53 moves: a.go.example.com: mv_abcdefghijklmnopqrstuvwxyz source_parked (committed-source_parked)
2026/10/22 10:31:53 moves: a.go.example.com: the source has parked what it kept for mv_abcdefghijklmnopqrstuvwxyz
2026/10/22 10:31:53 moves: a.go.example.com: the source's finalization of mv_abcdefghijklmnopqrstuvwxyz is complete
2026/10/22 10:31:53 moves: a.go.example.com: move mv_abcdefghijklmnopqrstuvwxyz closes once the target has opened and the source has parked (opened false, parked true)
2026/10/22 10:31:53 agent: retention: pruned 3 of 3 eligible versions for bab/kass (keep 20)
2026/10/22 10:31:53 agent: tunnel dial: dial tcp 127.0.0.1:40755: connect: connection refused (retry in 2.074460501s)
2026/10/22 10:31:53 agent: retention bab/kass: pruning nothing this pass: this box (sole housekeeper) could not collect its build states: database is locked
platform.example.com: update to v2 failed: console.service did not come up: not ready after 5s: permission denied — rolled the symlink back
platform.example.com: rolled back to v1 but could not start it: console.service did not come up: not ready after 5s: permission denied — this host may be serving nothing
2026/10/22 10:31:53 moves: "a.go.example.com": held release "v7" published for "mv_abcdefghijklmnopqrstuvwxyz" at "landing" "configured"
2026/10/22 10:31:53 moves: "a.go.example.com": held release "v7" published for "mv_abcdefghijklmnopqrstuvwxyz" at "landing" "configured"
2026/10/22 10:31:53 agent: retention bab/kass: pruning nothing this pass: no box report names the build state of kass.example.com
platform.example.com: update to v2 failed: console.service did not come up: not ready after 5s: permission denied — rolled the symlink back
platform.example.com: update to v2 failed: console.service did not come up: not ready after 5s: permission denied — rolled the symlink back
platform.example.com: rolled back to v1 but could not start it: console.service did not come up: not ready after 5s: permission denied — this host may be serving nothing
platform.example.com: update to v2 failed: console.service did not come up: not ready after 5s: permission denied — rolled the symlink back
platform.example.com: update to v2 failed: console.service did not come up: not ready after 5s: permission denied — rolled the symlink back
platform.example.com: rolled back to v1 but could not start it: console.service did not come up: not ready after 5s: permission denied — this host may be serving nothing
platform.example.com: update to v2 failed: console.service did not come up: not ready after 5s: permission denied — rolled the symlink back
FAIL
FAIL github.com/carlosframework/platform/internal/host 148.865s
ok github.com/carlosframework/platform/internal/hostactors 7.360s
ok github.com/carlosframework/platform/internal/hostactors/awsmembership 0.011s
ok github.com/carlosframework/platform/internal/hostbox 5.003s
ok github.com/carlosframework/platform/internal/hostclaim 2.037s
ok github.com/carlosframework/platform/internal/hostenv 0.026s
ok github.com/carlosframework/platform/internal/hostevidence 0.011s
ok github.com/carlosframework/platform/internal/hostexec 8.496s
ok github.com/carlosframework/platform/internal/hostfence 0.102s
ok github.com/carlosframework/platform/internal/hostfiles 11.545s
ok github.com/carlosframework/platform/internal/hostfloor 0.101s
ok github.com/carlosframework/platform/internal/hostguard 1.178s
ok github.com/carlosframework/platform/internal/hostops 4.010s
? github.com/carlosframework/platform/internal/hostops/fencerelease [no test files]
ok github.com/carlosframework/platform/internal/hostops/internal/fencerelease 0.101s
ok github.com/carlosframework/platform/internal/hostquarantine 0.010s
ok github.com/carlosframework/platform/internal/hostrelocate 1.344s
ok github.com/carlosframework/platform/internal/hostresolve 0.596s
ok github.com/carlosframework/platform/internal/hostwrite 0.003s
ok github.com/carlosframework/platform/internal/infraview 0.002s
ok github.com/carlosframework/platform/internal/instancectl 5.343s
ok github.com/carlosframework/platform/internal/instanceexec 3.134s
ok github.com/carlosframework/platform/internal/instancefs 0.007s
ok github.com/carlosframework/platform/internal/instancekey 0.004s
ok github.com/carlosframework/platform/internal/instanceupdates 0.023s
ok github.com/carlosframework/platform/internal/layout 2.731s
ok github.com/carlosframework/platform/internal/lbhealth 0.003s
ok github.com/carlosframework/platform/internal/lease 10.375s
ok github.com/carlosframework/platform/internal/lease/leasetest 0.879s
ok github.com/carlosframework/platform/internal/ledger 0.018s
ok github.com/carlosframework/platform/internal/mail 0.733s
ok github.com/carlosframework/platform/internal/maintenance 0.114s
ok github.com/carlosframework/platform/internal/maintenanceexec 5.795s
ok github.com/carlosframework/platform/internal/maintenanceguard 0.135s
ok github.com/carlosframework/platform/internal/metrics 0.008s
ok github.com/carlosframework/platform/internal/moves 24.546s
ok github.com/carlosframework/platform/internal/moves/archive 1.754s
ok github.com/carlosframework/platform/internal/objstore 0.405s
ok github.com/carlosframework/platform/internal/ops 0.519s
ok github.com/carlosframework/platform/internal/park 0.362s
ok github.com/carlosframework/platform/internal/plans 0.011s
ok github.com/carlosframework/platform/internal/privatefile 0.010s
ok github.com/carlosframework/platform/internal/provision 18.285s
ok github.com/carlosframework/platform/internal/publicrelease 0.018s
? github.com/carlosframework/platform/internal/regionname [no test files]
ok github.com/carlosframework/platform/internal/registry 7.019s
ok github.com/carlosframework/platform/internal/relay 7.232s
ok github.com/carlosframework/platform/internal/release 28.819s
ok github.com/carlosframework/platform/internal/rollout 4.936s
ok github.com/carlosframework/platform/internal/rolloutwords 0.005s
ok github.com/carlosframework/platform/internal/rootaws 0.007s
ok github.com/carlosframework/platform/internal/rootparticipation 0.061s
ok github.com/carlosframework/platform/internal/rootstate 0.034s
ok github.com/carlosframework/platform/internal/runs 0.684s
ok github.com/carlosframework/platform/internal/s3compat 0.021s
ok github.com/carlosframework/platform/internal/safefile 0.006s
ok github.com/carlosframework/platform/internal/schedule 3.723s
ok github.com/carlosframework/platform/internal/seeds 0.026s
ok github.com/carlosframework/platform/internal/sim/hostlife 21.020s
ok github.com/carlosframework/platform/internal/sim/litestreamfacts 3.722s
ok github.com/carlosframework/platform/internal/status 0.157s
ok github.com/carlosframework/platform/internal/steering 0.015s
ok github.com/carlosframework/platform/internal/stopevidence 0.404s
ok github.com/carlosframework/platform/internal/svcrole 0.009s
ok github.com/carlosframework/platform/internal/telemetry 0.006s
ok github.com/carlosframework/platform/internal/termfence 0.005s
ok github.com/carlosframework/platform/internal/tunnelclient 0.005s
ok github.com/carlosframework/platform/internal/unixdial 0.008s
ok github.com/carlosframework/platform/internal/updatewords 0.007s
ok github.com/carlosframework/platform/internal/usage 0.009s
ok github.com/carlosframework/platform/internal/version 0.002s
ok github.com/carlosframework/platform/internal/vet 2.290s
FAIL
=== internal_console@0 (87 s)
ok github.com/carlosframework/platform/internal/console 83.421s
=== internal_console@1 (42 s)
ok github.com/carlosframework/platform/internal/console 37.366s
=== internal_console@2 (46 s)
ok github.com/carlosframework/platform/internal/console 42.962s
=== internal_console@3 (42 s)
ok github.com/carlosframework/platform/internal/console 38.965s
=== internal_console@4 (41 s)
ok github.com/carlosframework/platform/internal/console 38.128s
=== internal_console@5 (39 s)
ok github.com/carlosframework/platform/internal/console 35.830s
=== internal_console@6 (41 s)
ok github.com/carlosframework/platform/internal/console 37.715s
=== internal_console@7 (48 s)
ok github.com/carlosframework/platform/internal/console 44.034s
=== root@0 (38 s)
ok github.com/carlosframework/platform 35.753s
=== root@1 (48 s)
ok github.com/carlosframework/platform 45.346s
=== root@2 (46 s)
ok github.com/carlosframework/platform 43.854s
FAILED: rest
make: *** [Makefile:19: test] Error 1
amadan: step gate failed: exit status 2
amadan: job failed at step gate — its output is above, not at the tail of this log
diff --git a/docs/superpowers/plans/2026-10-22-self-serve-moves-1-lifetimes-and-order.md b/docs/superpowers/plans/2026-10-22-self-serve-moves-1-lifetimes-and-order.md| index 023605d5e..ce176da8e 100644 |
| --- a/docs/superpowers/plans/2026-10-22-self-serve-moves-1-lifetimes-and-order.md |
| +++ b/docs/superpowers/plans/2026-10-22-self-serve-moves-1-lifetimes-and-order.md |
| @@ -2,7 +2,7 @@ |
| > **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking. |
| -Rev 16, 2026-10-22. Rev 15's review (`selfserve-plan1-review15.md`: 13, 14, 15, 16 closed; 5, 10, 17, 18, 19 open) is answered with **one lock order** instead of a snapshot: the create protocol, allocation recovery and the console's purge all take `s.lockApp(acct, app)` and then `withHostname(host)`, so a purge and a create or recovery of the same app never interleave, and the purge observes and retires each instance **inside** the same locked step (no delayed callback can see a successor; a legacy record is retired by **ETag**); an allocation is bound to the **app lifetime** that authorised it (`app_lifetime` = the apps row's `created_at`), so a reused name never replays an old allocation; **boxes stop auto-purging once the cutover marker exists** and the console's expiry pass runs the trash sweep under the app lock, so after the cutover the only purger is the one that can see pending allocations; a slot-bound orphan entry point (`retireSlotOrphanLocked`) exists and the void path's cleanup is stated honestly (a late stale body stays until the next create of the hostname removes it in step 5; a late slot PUT leaves a live orphan the orphan rule reclaims). Rev 14's review (`selfserve-plan1-review14.md`: 9, 11, 12 closed; 5, 10, 13, 14, 15, 16 the purge protocol) is answered by **removing the purge protocol**: four rounds of a lifetime-aware purge each found the next race (snapshot vs recovery, in-flight box sweeps, legacy incarnation 0, the app lock, guard ordering, the schema), so purge goes back to **today's sweep** with one conditional step (an instance record is deleted by `DeleteIfMatch` on an ETag a `Get` captured just before), on the console under the existing `s.lockApp` mutex its callers already hold, on the box as today; and the lifetime protocol **absorbs the consequences** with two rules it already nearly had: a live slot whose record is absent and for which this console holds no pending operation is an **orphan**, retired as kind `orphan` by the next create that meets it (so a purged app's slots never block a hostname); and allocation recovery **never replays a create for a trashed or purged app** (it retires the slot, and anything that landed at its incarnation, as `orphan`, and voids the row), so a late record or slot PUT of a purged app's allocation is cleaned by the same recovery. No generation table, no slot fence, no on-marker, no console trash sweep. Rev 13's review (`selfserve-plan1-review13.md`: findings 1 and 8 closed; 5, 9, 10, 11, 12 the purge) is answered by **taking boxes out of purging once lifetimes are on**: a box that has seen `lifetimes-on.json` never purges an app again (the console's expiry pass gains the store-driven trash sweep the box runs today), so no purger exists that cannot see the console's pending allocations; before the on-marker a box purge deletes an instance record only by `DeleteIfMatch` on an ETag it captured **before** its final marker check. The console's purge runs under the app mutation lock, records the **generation** it observed for every host (slot incarnation or record ETag) before any destructive step, and every retirement states that expectation (never `retireAny`), so a delayed callback cannot touch a successor; a pending allocation is terminalised by **fencing its slot** (a CAS write of a retired slot at its incarnation, against absence or the predecessor's ETag) so an outstanding allocation PUT can never land, then `void`; the purge calls the **locked** retirement under its own `withHostname`; the box has no retirement code at all; the witnesses are split into console and box expectations with their real terminal states. Rev 12's review (`selfserve-plan1-review12.md`: findings 2, 3, 4, 6, 7 closed; 1 a witness contradiction; 5, 8, 9 the purge) is answered: the restart witness no longer activates "at once"; the console writes a durable **`control/lifetimes-on.json`** as the first act of `on`, and that marker, not judge availability, is a box's authority for any slot mutation; purge **excludes instance-record keys from its sweep** whenever a retire hook is installed; the console's purge **voids the app's pending allocations durably** (`purged_at`) and retires their slots before touching records, and recovery treats a purged pending row as `void`; the box's purge needs **no migration, no journal and no cross-process lock**: it retires by CAS alone (slot CAS to `retired`, then `DeleteIfMatch` on the observed record ETag; a marked record is skipped; any CAS loss returns an error and the next pass retries idempotently), and before the on-marker it deletes only by `DeleteIfMatch` on the listed ETag after re-reading the marker. Rev 12's review (`selfserve-plan1-review11.md`, findings 1 to 7) is answered: the storage settle is anchored **after the last `before` unit released admission** (and after the process start on a restart), so a legacy request that was fully received before its client timed out has completed before activation; activation requires a **validated marker read** (`markerSeen`), never uncertainty alone; app purge is **lifetime-aware** on every path (browser, expiry pass, box auto-purge) through a retirement core in `provision` that `release.PurgeApp` calls for every instance record before its sweep; an in-scope valid own record defeats only the record-gone reason and still reaches the app-trash decision; the dispatch of create, delete, detach and `readDeletedRecord` is stated per admitted unit; both detached continuations (`runImportUpload`, `createFrom → runFrom`) are wired; the Task 3 witness no longer says draining reads are legacy; `claimAliasUnbacked` is named in the audit. Rev 11, 2026-10-22. Rev 10's review (`selfserve-plan1-review10.md`, findings 1 to 4) is answered: the cutover gains an **admission gate**: every claims-off unit of record work (a request's handler, a detached continuation, a worker iteration) is admitted under a counted gate while the state is `before`; the cutover door closes admission synchronously, refuses new work with 503, **waits for the admitted count to reach zero**, then starts the storage settle, then activates; so no unit admitted before the marker ever runs beside the lifetime protocol, and a unit never changes mode mid-flight. `on` is **latched**: once observed it is never left; at startup the state is `unknown` until the first successful marker read and every claims-off record door (reads and mutations) answers 503 until then, so a marker-read failure never restores legacy interpretation. The removal rule separates lifetime validity from placement eligibility: a valid own record that is **in this pass's scope** protects the legacy collision; a valid own record **outside** the scope follows today's removal rules (`KeepParticipant`, the app-trash rule), so offline finishing removes the source row as today; absence or staleness authorises the new path. One worker lifecycle (start once, loop, check the state each iteration), one migration interval, one context contract (`recordCtx`), the CLI command, the retry error, the three root constructions and the copy inventory are stated. Rev 10, 2026-10-22. Rev 9's review (`selfserve-plan1-review9.md`, findings 1 to 5) is answered: the cutover is a **mode** with a drain: from the marker's time until the window ends the console refuses every claims-off record mutation (503), so no legacy write can be admitted into the window, and the gate, the judge's installation, the recovery pass and the marker's failure modes are one contract with an implementation task for the operator door; the removal loop decides from the row's **own** record (observed by its own key), so a valid legacy owner in a hostname collision is kept as today and only an established absent or stale own record retires the row, with the keep view bypassed on that evidence and replacement stated as two passes; `fenceRecord` returns a classification so an own tombstone or marker that won resumes the operation instead of terminating it; the audit's allowlist names the two remaining claims-on callers of `hostops.ReadRecord` and is pinned both ways; and the remaining contracts are settled (the detach sentence, cleanup recovery through C2, corrupt index candidates, the root restart readers' judge). Rev 8's review (`selfserve-plan1-review8.md`, findings 1 to 5) is answered: the rollout guarantee becomes an **enforced cutover** (an operator marker written after the old console has stopped, plus the settle window, with the storage assumption stated) rather than a timer alone; quarantine copies the corrupt bytes and **never deletes under a live slot**: the retirement converts durably to the cleanup kind and retires the slot first, and a conditional-delete conflict re-classifies instead of counting as absence; a provisioned row owned by another record key than the hostname's current record is retired as "record gone" so a cross-owner recreation cannot leave a lagging box serving the predecessor; `RecordIndex.Find` judges its candidate keys before deciding ambiguity; and the remaining contradictions are resolved (the root scope sentence, one detach chain, the locked retirement's callers, reconcile's one sequence, the audit's enumerated list, the fence witness split). Rev 7's review (`selfserve-plan1-review7.md`, findings 1 to 6) is answered: a stated rollout guarantee closes the late legacy delete (one console per deployment, a settle window before any termination, old consoles never reintroduced over lifetimes records); the first-route attach, its rollback and detach run **inside** the hostname exclusion from the claim write to the record write, through locked variants of the create and retirement helpers; root's proof and restart record readers take the box's judge (the scope statement is corrected: only `ClaimRootHTTP`'s claims-on readers are slot-free); a corrupt body is quarantined (its bytes kept under `control/quarantine/`, the key removed conditionally) so the retirement or migration proceeds as for absence instead of promising a fence that cannot parse it; `provision.WithLifetimes` is the one context helper that carries the judge and enables sequencing, the runs worker wraps its detached execution context, the audit distinguishes approved judged wrappers from raw readers, the fence witnesses state their timing, exhaustion is witnessed at every transition, and the sibling undo has one dispatch path. Earlier reviews: rev 1 (`after236/selfserve-plan1-review.md`, 16 findings), rev 2 (F1 to F12), rev 3 (R1 to R10), rev 4 (1 to 9), rev 5 (1 to 6), rev 6 (`selfserve-plan1-review6.md`, findings 1 to 5). Rev 7 answers rev 6's five: every claims-off record write runs with `WithRecordSequence`, so `record_seq` exists after a record's first write and an ETag never recurs, and recovery writes a **fence** (a sequencing rewrite) before it terminates an operation on evidence of a changed record; one migration dispatcher classifies the observation at every entry, so a resume can never supersede its own marker; the attach door's claim rollback runs inside the hostname exclusion and never releases a claim a pending operation or a valid record needs; the judge reaches every mutation context (the console's top-level handler wraps every request, browser and API alike; the seed callback wraps its own context; the full-record updater's re-read is judged; `RecordIndex.Find` and `FindRecordByHost` take the judge from the context), and the audit is by AST; the remaining contracts (the running N1 table, a slot-retirement helper, one expectation type, listed-key absence, exhaustion at read, the import witness's state, the producer-state publication tests) are answered. Rev 5 removed the slot cache (every judgement reads the slot fresh, after the record, in bounded rounds) and made a successor lifetime's hold one row write. Rev 6 answers rev 5's six: a retirement persists its **kind** (normal, orphan, cleanup) and each kind has its own steps and recovery table; a migration's marker-CAS conflict is classified by a re-read for both the bound and the unbound form, so an own marker that landed is resumed, never superseded; every `retireInstanceRecord` caller states its expectation (the sibling undo names the lifetime it created; detach deletes what is current; the attach door never asks for a record rollback over a lifetime failure); a judge carried on the context makes `updateRecordSeeding`, and so every `SetRecord*` writer, refuse a stale record, and every box reader (Phase 1's included) and the import journal's readers go through the judge; the provenance mark is dropped (the fold compares pairs between unstamped entries, a pair-less entry is `(0, 0)` and equal pairs fall to the existing rule, exactly §6.4); the remaining interface gaps are answered. |
| +Rev 17, 2026-10-22. Rev 16's review (`selfserve-plan1-review16.md`: 5, 10, 17, 18, 19 narrowed; 20, 21, 22 new) is answered: the create protocol checks the app's lifecycle **under the app lock** (present, not trashed, the same `lifetime` the door read) before allocating (5); a box purge re-reads the cutover marker **immediately before every conditional delete** and abandons the purge when more than 30 s passed since that check, so a sweep paused across the cutover deletes nothing numbered (10); cancellation writes the orphan retirement row and the allocation's `void` in **one SQLite transaction** and the retirement names the allocation it cancels, so no two pending rows block each other (17); the app lifetime is a non-repeating `apps.lifetime` id captured by `BeginAllocation` (18); the stale-body promise is narrowed to the same key and the create's step 5 also deletes a stale body under the retired slot's owner key (19); a **lock table** states what every wrapper acquires and every `Locked` helper assumes, and the attach door takes the app lock outside its hostname exclusion (20); the purge's absent-record branch acts only on a slot **owned by the purged app** (21); `settleApp` and `MaterializeApps` count only judged-valid instance records as restore evidence (22). Rev 15's review (`selfserve-plan1-review15.md`: 13, 14, 15, 16 closed; 5, 10, 17, 18, 19 open) is answered with **one lock order** instead of a snapshot: the create protocol, allocation recovery and the console's purge all take `s.lockApp(acct, app)` and then `withHostname(host)`, so a purge and a create or recovery of the same app never interleave, and the purge observes and retires each instance **inside** the same locked step (no delayed callback can see a successor; a legacy record is retired by **ETag**); an allocation is bound to the **app lifetime** that authorised it (`app_lifetime` = the apps row's `created_at`), so a reused name never replays an old allocation; **boxes stop auto-purging once the cutover marker exists** and the console's expiry pass runs the trash sweep under the app lock, so after the cutover the only purger is the one that can see pending allocations; a slot-bound orphan entry point (`retireSlotOrphanLocked`) exists and the void path's cleanup is stated honestly (a late stale body stays until the next create of the hostname removes it in step 5; a late slot PUT leaves a live orphan the orphan rule reclaims). Rev 14's review (`selfserve-plan1-review14.md`: 9, 11, 12 closed; 5, 10, 13, 14, 15, 16 the purge protocol) is answered by **removing the purge protocol**: four rounds of a lifetime-aware purge each found the next race (snapshot vs recovery, in-flight box sweeps, legacy incarnation 0, the app lock, guard ordering, the schema), so purge goes back to **today's sweep** with one conditional step (an instance record is deleted by `DeleteIfMatch` on an ETag a `Get` captured just before), on the console under the existing `s.lockApp` mutex its callers already hold, on the box as today; and the lifetime protocol **absorbs the consequences** with two rules it already nearly had: a live slot whose record is absent and for which this console holds no pending operation is an **orphan**, retired as kind `orphan` by the next create that meets it (so a purged app's slots never block a hostname); and allocation recovery **never replays a create for a trashed or purged app** (it retires the slot, and anything that landed at its incarnation, as `orphan`, and voids the row), so a late record or slot PUT of a purged app's allocation is cleaned by the same recovery. No generation table, no slot fence, no on-marker, no console trash sweep. Rev 13's review (`selfserve-plan1-review13.md`: findings 1 and 8 closed; 5, 9, 10, 11, 12 the purge) is answered by **taking boxes out of purging once lifetimes are on**: a box that has seen `lifetimes-on.json` never purges an app again (the console's expiry pass gains the store-driven trash sweep the box runs today), so no purger exists that cannot see the console's pending allocations; before the on-marker a box purge deletes an instance record only by `DeleteIfMatch` on an ETag it captured **before** its final marker check. The console's purge runs under the app mutation lock, records the **generation** it observed for every host (slot incarnation or record ETag) before any destructive step, and every retirement states that expectation (never `retireAny`), so a delayed callback cannot touch a successor; a pending allocation is terminalised by **fencing its slot** (a CAS write of a retired slot at its incarnation, against absence or the predecessor's ETag) so an outstanding allocation PUT can never land, then `void`; the purge calls the **locked** retirement under its own `withHostname`; the box has no retirement code at all; the witnesses are split into console and box expectations with their real terminal states. Rev 12's review (`selfserve-plan1-review12.md`: findings 2, 3, 4, 6, 7 closed; 1 a witness contradiction; 5, 8, 9 the purge) is answered: the restart witness no longer activates "at once"; the console writes a durable **`control/lifetimes-on.json`** as the first act of `on`, and that marker, not judge availability, is a box's authority for any slot mutation; purge **excludes instance-record keys from its sweep** whenever a retire hook is installed; the console's purge **voids the app's pending allocations durably** (`purged_at`) and retires their slots before touching records, and recovery treats a purged pending row as `void`; the box's purge needs **no migration, no journal and no cross-process lock**: it retires by CAS alone (slot CAS to `retired`, then `DeleteIfMatch` on the observed record ETag; a marked record is skipped; any CAS loss returns an error and the next pass retries idempotently), and before the on-marker it deletes only by `DeleteIfMatch` on the listed ETag after re-reading the marker. Rev 12's review (`selfserve-plan1-review11.md`, findings 1 to 7) is answered: the storage settle is anchored **after the last `before` unit released admission** (and after the process start on a restart), so a legacy request that was fully received before its client timed out has completed before activation; activation requires a **validated marker read** (`markerSeen`), never uncertainty alone; app purge is **lifetime-aware** on every path (browser, expiry pass, box auto-purge) through a retirement core in `provision` that `release.PurgeApp` calls for every instance record before its sweep; an in-scope valid own record defeats only the record-gone reason and still reaches the app-trash decision; the dispatch of create, delete, detach and `readDeletedRecord` is stated per admitted unit; both detached continuations (`runImportUpload`, `createFrom → runFrom`) are wired; the Task 3 witness no longer says draining reads are legacy; `claimAliasUnbacked` is named in the audit. Rev 11, 2026-10-22. Rev 10's review (`selfserve-plan1-review10.md`, findings 1 to 4) is answered: the cutover gains an **admission gate**: every claims-off unit of record work (a request's handler, a detached continuation, a worker iteration) is admitted under a counted gate while the state is `before`; the cutover door closes admission synchronously, refuses new work with 503, **waits for the admitted count to reach zero**, then starts the storage settle, then activates; so no unit admitted before the marker ever runs beside the lifetime protocol, and a unit never changes mode mid-flight. `on` is **latched**: once observed it is never left; at startup the state is `unknown` until the first successful marker read and every claims-off record door (reads and mutations) answers 503 until then, so a marker-read failure never restores legacy interpretation. The removal rule separates lifetime validity from placement eligibility: a valid own record that is **in this pass's scope** protects the legacy collision; a valid own record **outside** the scope follows today's removal rules (`KeepParticipant`, the app-trash rule), so offline finishing removes the source row as today; absence or staleness authorises the new path. One worker lifecycle (start once, loop, check the state each iteration), one migration interval, one context contract (`recordCtx`), the CLI command, the retry error, the three root constructions and the copy inventory are stated. Rev 10, 2026-10-22. Rev 9's review (`selfserve-plan1-review9.md`, findings 1 to 5) is answered: the cutover is a **mode** with a drain: from the marker's time until the window ends the console refuses every claims-off record mutation (503), so no legacy write can be admitted into the window, and the gate, the judge's installation, the recovery pass and the marker's failure modes are one contract with an implementation task for the operator door; the removal loop decides from the row's **own** record (observed by its own key), so a valid legacy owner in a hostname collision is kept as today and only an established absent or stale own record retires the row, with the keep view bypassed on that evidence and replacement stated as two passes; `fenceRecord` returns a classification so an own tombstone or marker that won resumes the operation instead of terminating it; the audit's allowlist names the two remaining claims-on callers of `hostops.ReadRecord` and is pinned both ways; and the remaining contracts are settled (the detach sentence, cleanup recovery through C2, corrupt index candidates, the root restart readers' judge). Rev 8's review (`selfserve-plan1-review8.md`, findings 1 to 5) is answered: the rollout guarantee becomes an **enforced cutover** (an operator marker written after the old console has stopped, plus the settle window, with the storage assumption stated) rather than a timer alone; quarantine copies the corrupt bytes and **never deletes under a live slot**: the retirement converts durably to the cleanup kind and retires the slot first, and a conditional-delete conflict re-classifies instead of counting as absence; a provisioned row owned by another record key than the hostname's current record is retired as "record gone" so a cross-owner recreation cannot leave a lagging box serving the predecessor; `RecordIndex.Find` judges its candidate keys before deciding ambiguity; and the remaining contradictions are resolved (the root scope sentence, one detach chain, the locked retirement's callers, reconcile's one sequence, the audit's enumerated list, the fence witness split). Rev 7's review (`selfserve-plan1-review7.md`, findings 1 to 6) is answered: a stated rollout guarantee closes the late legacy delete (one console per deployment, a settle window before any termination, old consoles never reintroduced over lifetimes records); the first-route attach, its rollback and detach run **inside** the hostname exclusion from the claim write to the record write, through locked variants of the create and retirement helpers; root's proof and restart record readers take the box's judge (the scope statement is corrected: only `ClaimRootHTTP`'s claims-on readers are slot-free); a corrupt body is quarantined (its bytes kept under `control/quarantine/`, the key removed conditionally) so the retirement or migration proceeds as for absence instead of promising a fence that cannot parse it; `provision.WithLifetimes` is the one context helper that carries the judge and enables sequencing, the runs worker wraps its detached execution context, the audit distinguishes approved judged wrappers from raw readers, the fence witnesses state their timing, exhaustion is witnessed at every transition, and the sibling undo has one dispatch path. Earlier reviews: rev 1 (`after236/selfserve-plan1-review.md`, 16 findings), rev 2 (F1 to F12), rev 3 (R1 to R10), rev 4 (1 to 9), rev 5 (1 to 6), rev 6 (`selfserve-plan1-review6.md`, findings 1 to 5). Rev 7 answers rev 6's five: every claims-off record write runs with `WithRecordSequence`, so `record_seq` exists after a record's first write and an ETag never recurs, and recovery writes a **fence** (a sequencing rewrite) before it terminates an operation on evidence of a changed record; one migration dispatcher classifies the observation at every entry, so a resume can never supersede its own marker; the attach door's claim rollback runs inside the hostname exclusion and never releases a claim a pending operation or a valid record needs; the judge reaches every mutation context (the console's top-level handler wraps every request, browser and API alike; the seed callback wraps its own context; the full-record updater's re-read is judged; `RecordIndex.Find` and `FindRecordByHost` take the judge from the context), and the audit is by AST; the remaining contracts (the running N1 table, a slot-retirement helper, one expectation type, listed-key absence, exhaustion at read, the import witness's state, the producer-state publication tests) are answered. Rev 5 removed the slot cache (every judgement reads the slot fresh, after the record, in bounded rounds) and made a successor lifetime's hold one row write. Rev 6 answers rev 5's six: a retirement persists its **kind** (normal, orphan, cleanup) and each kind has its own steps and recovery table; a migration's marker-CAS conflict is classified by a re-read for both the bound and the unbound form, so an own marker that landed is resumed, never superseded; every `retireInstanceRecord` caller states its expectation (the sibling undo names the lifetime it created; detach deletes what is current; the attach door never asks for a record rollback over a lifetime failure); a judge carried on the context makes `updateRecordSeeding`, and so every `SetRecord*` writer, refuse a stale record, and every box reader (Phase 1's included) and the import journal's readers go through the judge; the provenance mark is dropped (the fold compares pairs between unstamped entries, a pair-less entry is `(0, 0)` and equal pairs fall to the existing rule, exactly §6.4); the remaining interface gaps are answered. |
| **Goal:** Give every claims-off instance record a durable lifetime (the host incarnation slot) and every served row a serving order `(incarnation, serving_seq)` that boxes publish and edges honour, with crash-safe create, retirement and migration, so a later plan's holding pages and moves can never be out-ordered by a stale publication. |
| @@ -104,7 +104,7 @@ The verdict, exactly, with `owned := slot != nil && slot.Account == rec.Account |
| **Interfaces:** |
| - Tables (`account` is the sqid): |
| - - `host_allocations (op_id TEXT PRIMARY KEY, account TEXT, app TEXT, host TEXT, incarnation INTEGER, state TEXT, body BLOB, predecessor_etag TEXT, stale_etag TEXT, app_lifetime INTEGER, created_at INTEGER)` (`app_lifetime` is the apps row's `created_at` at allocation time: the lifetime of the app that authorised the create; a purge and a recreate under the same name give a new value) |
| + - `host_allocations (op_id TEXT PRIMARY KEY, account TEXT, app TEXT, host TEXT, incarnation INTEGER, state TEXT, body BLOB, predecessor_etag TEXT, stale_etag TEXT, app_lifetime INTEGER, created_at INTEGER)` (`app_lifetime TEXT`: the apps row's **`lifetime`** at allocation time, a new column `apps.lifetime TEXT NOT NULL DEFAULT ''` set to a random 16-hex id by `CreateAppInRegion`, kept by trash and restore, and backfilled once at store open for rows with `''` (so an old app has one stable value); a purge removes the row and a recreate mints a new id, so equal values mean the same app lifetime; `created_at` is seconds and is not used for this) |
| - `record_retirements (op_id TEXT PRIMARY KEY, kind TEXT, account TEXT, app TEXT, host TEXT, incarnation INTEGER, record_etag TEXT, slot_etag TEXT, slot_intent TEXT, state TEXT, created_at INTEGER)` (`kind` is `normal`, `orphan` or `cleanup`) |
| - `record_migrations (op_id TEXT PRIMARY KEY, account TEXT, app TEXT, host TEXT, expect_etag TEXT, marked_etag TEXT, state TEXT, created_at INTEGER)` |
| - Classification in `claimSQLTables`: `{Sqid: "account", App: "app"}` for all three. |
| @@ -129,24 +129,24 @@ The verdict, exactly, with `owned := slot != nil && slot.Account == rec.Account |
| - Consumes: Tasks 1 and 2; Task 6's `provision.LifetimeJudge` (its `Observe`) for `classifyLocked`. |
| - Produces: |
| - `lifetimesOn()` is Task 0's. |
| - - `func (s *Server) withHostname(host string, fn func() error) error` (a `sync.Map` of `*sync.Mutex`; not reentrant; every exported helper below takes it, every `...Locked` helper assumes it). |
| + - `func (s *Server) withHostname(host string, fn func() error) error` (a `sync.Map` of `*sync.Mutex`; not reentrant). **The lock table** (neither mutex is reentrant; the order is always account lock (where a door already holds one) → `s.lockApp` → `withHostname`): the create, seed and import doors' `createRecordWithLifetime` acquires `s.lockApp` then `withHostname`; `createRecordWithLifetimeLocked` assumes **both**; the attach door acquires `s.lockApp` **before** entering its hostname exclusion and `attachFirstRouteLocked` assumes both; detach and rollback run inside the hostname exclusion (their door acquires the app lock first) and call `Locked` helpers that acquire nothing; `retireRecordWithLifetime` acquires `s.lockApp` then `withHostname`, `retireRecordWithLifetimeLocked` and `retireSlotOrphanLocked` assume both; allocation, retirement and migration recovery acquire `s.lockApp` then `withHostname` per row; the purge's callers hold `s.lockApp` and `purgeAppWithLifetimes` acquires `withHostname` per host; trash, restore, keep and ttl hold `s.lockApp` and acquire no hostname lock; `TestLockOrderIsRespected` runs every caller under a lock-order checker (a test hook on both mutexes) and fails on an inversion (every exported helper below takes the locks its row says, every `...Locked` helper assumes them). |
| - `func (s *Server) admit(host, ownOpID string) error`: `errLifetimeSettling` when `PendingForHost(host, ownOpID) > 0`. |
| - `func (s *Server) classifyLocked(ctx context.Context, acct, app, host string) (provision.Observation, error)`: `s.judge.Observe(ctx, s.cfg.Releases, acct, app, host)` (Task 6: record first, slot after, bounded rounds); the error is non-nil only with `Verdict == LifetimeUnreadable`. |
| - `func (s *Server) createRecordWithLifetime(ctx context.Context, rec provision.Record) (*provision.Record, error)` (takes `withHostname`) and `func (s *Server) createRecordWithLifetimeLocked(ctx context.Context, rec provision.Record) (*provision.Record, error)` (assumes it): the one protocol every claims-off creation path runs; the create, seed and import doors call the locking form; the attach door calls the locked form inside its own exclusion (below). Returns the record as written. Errors: `release.ErrCASConflict` (a valid record under this key), `*hostHeldError` (`errors.As`; carries `*apexHold` for `hostHeldSentence`: a live slot owned by another key gives `&apexHold{Holder: slot.App, OtherAccount: slot.Account if ≠ rec.Account}`), `errLifetimeSettling`, `errLifetimePending`, or a read error from step 2 (nothing persisted). |
| - - `func (s *Server) fenceRecord(ctx context.Context, acct, app, host string, op fenceOwner) (res fenceResult, obs provision.Observation, err error)` with `type fenceOwner struct { Tombstone bool; MarkerID string }` (what this operation's own outstanding write would look like) and `fenceResult` one of `fenced` (a body that is neither this operation's tombstone nor its marker was rewritten with its sequence introduced or advanced: the caller terminates on `obs`), `ownWriteWon` (the re-read found this operation's tombstone, or a record marked with `MarkerID`: the caller does **not** terminate; it dispatches again from `obs` and the operation resumes, retirement at N2, migration through its dispatcher), `absent` (nothing to fence: the slot is the fence for an absent key), or an error after 3 CAS retries (the caller leaves its operation pending). Every recovery branch below and in Tasks 4 and 5 that would mark an operation `refused`, `void` or `superseded` because the record is not what the operation captured calls `fenceRecord` first and acts on its result. **An allocation is replayed only for the app lifetime that authorised it**: recovery, holding `s.lockApp` then `withHostname`, reads the apps row (`AppLife(acct, app)`: absent, or `created_at != row.app_lifetime`, or trashed) and the store's app tombstone marker; any of those → the row's slot, when it is `{N, live, this key, "create " + OpID}`, is retired through `retireSlotOrphanLocked` (any body at N under the key deleted on its ETag) and the row becomes `void`; a slot already superseded → `void`; a slot absent → `void` without a slot write (an outstanding slot PUT that lands later leaves a **live orphan slot**, which the orphan rule reclaims on the next create; an outstanding record PUT that lands after O1 leaves a **stale body under a retired slot**, which §6.4 tolerates and the next create of the hostname deletes in step 5 (`StaleETag`): recovery does not revisit terminal rows, and the plan claims no more than that); `TestAllocationBoundToAppLifetime` pins it (a live slot and no record; a slot and a record that landed late; no slot; the app purged and recreated under the same name before the pass; a record PUT after the void → stale, removed by the next create). |
| + - `func (s *Server) fenceRecord(ctx context.Context, acct, app, host string, op fenceOwner) (res fenceResult, obs provision.Observation, err error)` with `type fenceOwner struct { Tombstone bool; MarkerID string }` (what this operation's own outstanding write would look like) and `fenceResult` one of `fenced` (a body that is neither this operation's tombstone nor its marker was rewritten with its sequence introduced or advanced: the caller terminates on `obs`), `ownWriteWon` (the re-read found this operation's tombstone, or a record marked with `MarkerID`: the caller does **not** terminate; it dispatches again from `obs` and the operation resumes, retirement at N2, migration through its dispatcher), `absent` (nothing to fence: the slot is the fence for an absent key), or an error after 3 CAS retries (the caller leaves its operation pending). Every recovery branch below and in Tasks 4 and 5 that would mark an operation `refused`, `void` or `superseded` because the record is not what the operation captured calls `fenceRecord` first and acts on its result. **An allocation is replayed only for the app lifetime that authorised it**: recovery, holding `s.lockApp` then `withHostname`, reads the apps row (`AppLife(acct, app)`: absent, or `created_at != row.app_lifetime`, or trashed) and the store's app tombstone marker; any of those → the row's slot, when it is `{N, live, this key, "create " + OpID}`, is retired through `retireSlotOrphanLocked` **cancelling this allocation**: the retirement row (`record_retirements` with `kind: orphan`, `cancels: OpID`) and the allocation's `void` are written in **one SQLite transaction**, so there is never a moment with both pending; `admit(host, R)` for the retirement then has nothing to exclude, and O1 proceeds (any body at N under the key deleted on its ETag); a retirement row with `cancels` set is recovered before any allocation row of its host; a slot already superseded → `void`; a slot absent → `void` without a slot write (an outstanding slot PUT that lands later leaves a **live orphan slot**, which the orphan rule reclaims on the next create; an outstanding record PUT that lands after O1 leaves a **stale body under a retired slot**, which §6.4 tolerates: the next create of the hostname deletes it in step 5 whatever key it is under (step 2 records `StaleETag` for a stale body under this create's key **and** `OwnerStaleETag`/key for a stale body under the retired slot's owner key when that differs); recovery does not revisit terminal rows, and the plan claims no more than that); `TestAllocationBoundToAppLifetime` pins it (a live slot and no record; a slot and a record that landed late; no slot; the app purged and recreated under the same name before the pass; a record PUT after the void → stale, removed by the next create). |
| - `func (s *Server) recoverLifetimes(ctx context.Context) error`, `func (s *Server) StartLifetimeRecoveryPass(ctx context.Context)` (Task 0's worker lifecycle: started once, loops every 60 s for the life of the process, each iteration admitted as a mutating unit and doing work only in `on`). |
| The protocol, inside `withHostname(host)`: |
| -0. `s.lockApp(acct.Sqid, app)` (the lifecycle mutex every app transition takes; **lock order everywhere in this plan: the app lock, then the hostname lock**; recovery and the purge follow the same order), then `withHostname(host)`. |
| +0. `s.lockApp(acct.Sqid, app)` (the lifecycle mutex every app transition takes; **lock order everywhere in this plan: the app lock, then the hostname lock**; recovery and the purge follow the same order), then **the app's lifecycle under that lock**: `life, err := s.store.AppLife(acct.Sqid, app)`: absent → 404 (the app is gone), trashed → 409 "the app is in the trash", `life.Lifetime != the lifetime the door read before taking the lock` → 409 "the app changed. try again" (a purge and a recreate under the same name happened meanwhile); then `withHostname(host)`. |
| 1. `admit(host, "")`. |
| 2. `classifyLocked`. Unreadable → the error. Valid record under this key → `ErrCASConflict`; the slot is untouched. **The orphan rule**: a live slot (this key or another) with **no record under its key** and `PendingForHost(host, "") == 0` is an orphan (a purge deleted the record, or a durable allocation row was lost, which this plan treats as outside its guarantees and states so): `retireSlotOrphanLocked(ctx, host, slot)` runs first (the slot-bound entry: persists a `record_retirements` row of kind `orphan` with `SlotETag`, then O1: the slot by CAS from that ETag, then any body under the key deleted on its ETag), and the create continues from the retired slot; a live slot owned by another key **with** a record, or with a pending operation, → `*hostHeldError`. Then `acct, err := s.store.AccountBySqid(rec.Account)`: an error, or `acct == nil`, is a read error (502, nothing persisted); then `s.hostHolder(ctx, acct, host, app)` under the lock (the pre-lock call at `apiinstances.go:1164` stays): a holder → `*hostHeldError`. A stale or corrupt present record under this key is remembered: `StaleETag` (its ETag, never empty for a present body). |
| -3. `N = max(LastIncarnation(host), slot.Incarnation) + 1`; `rec.Incarnation = N`; `body = json.Marshal(rec)`; `BeginAllocation({OpID, Account, App, Host, N, pending, body, PredecessorETag: slot's ETag or "", StaleETag})`. A SQLite failure here → the error (nothing durable). |
| +3. `N = max(LastIncarnation(host), slot.Incarnation) + 1`; `rec.Incarnation = N`; `body = json.Marshal(rec)`; `BeginAllocation({OpID, Account, App, Host, N, pending, body, PredecessorETag: slot's ETag or "", StaleETag, AppLifetime: life.Lifetime})` (`Allocation.AppLifetime string`). A SQLite failure here → the error (nothing durable). |
| 4. `WriteHostIncarnation({N, live, rec.Account, rec.App, "create " + OpID}, PredecessorETag)`. On `ErrCASConflict`: re-read the slot (unreadable → `pending`, `errLifetimePending`); `{N, live, this key, "create " + OpID}` → continue at 5; a slot at an incarnation > N, or at N owned by another key, or at N and this key with another intent → `superseded`, `errLifetimeSettling`; the predecessor again → `pending`, `errLifetimePending`. Any other error → `pending`, `errLifetimePending`. |
| -5. If `StaleETag != ""`: `DeleteIfMatch` the record on it; any error (conflict included) → `pending`, `errLifetimePending`. |
| +5. If `StaleETag != ""`: `DeleteIfMatch` the record on it; if `OwnerStaleETag != ""`: `DeleteIfMatch` the stale body under the retired slot's owner key on it; any error (conflict included) → `pending`, `errLifetimePending`. |
| 6. `WriteRecord(WithRecordSequence(ctx), s, key, []byte("{}"), body, "")` (the record lands with `record_seq: 1`). Success → 7. `ErrCASConflict` → re-read raw (unreadable → pending): a record at N under this key → 7 (a replay landed); otherwise `pending`, `errLifetimePending`. Any other error → `pending`, `errLifetimePending`. |
| 7. `SetAllocationState(committed)`; a SQLite failure → `errLifetimePending` (the record stands; recovery marks it committed). Return the written record. |
| -Recovery (`recoverLifetimes`), per pending allocation, inside `withHostname` with `admit(host, OpID)`, after `classifyLocked`, the first matching branch: |
| +Recovery (`recoverLifetimes`), per pending allocation, inside `s.lockApp` then `withHostname` with `admit(host, OpID)` (a cancelled allocation, one named by a retirement row's `cancels`, is already `void` by the cancelling transaction and never reaches here), after `classifyLocked`, the first matching branch: |
| - unreadable → leave pending; |
| - slot at an incarnation > N, or at N owned by another key, or at N and this key with an intent other than `"create " + OpID` → `superseded`; |
| - the app lifetime check above fails (absent, recreated, trashed, or the tombstone marker present) → `retireSlotOrphanLocked` when the slot is this allocation's, then `void`; |
| @@ -157,7 +157,7 @@ Recovery (`recoverLifetimes`), per pending allocation, inside `withHostname` wit |
| - anything else → leave pending and log once per hour. |
| Then the retirements (Task 4) and the migrations (Task 5), in that order. |
| -Door mappings: the create door: `*hostHeldError` → 409 `hostHeldSentence(host, hold)`; `errLifetimeSettling` → 409 settling; `errLifetimePending` → 502 "could not create the instance — try again", no undo; the **sibling undo** at line 1684 (the apex was claimed mid-create) calls `retireInstanceRecord(ctx, acct.Sqid, app, host, principal, incarnation, provision.RetireExpectation{Incarnation: created.Incarnation})` with the record the create returned (the one dispatch path: `retireHostRecord` → the claims-off branch → the locking `retireRecordWithLifetime`; the claims-on branch ignores the expectation as today): it retires exactly the lifetime this create made and nothing else (Task 4). Seed and import: the same three onto their existing failure sentences; on `errLifetimePending` the door writes nothing further and the record recovery completes carries the seed state the body had, which the existing seed sweep then owns. Attach (claims-off): the **first-route path runs inside `withHostname(host)` from the claim to the record**: `attachFirstRouteLocked(ctx, acct, app, host, ...)` = `attachDomainClaim` (the claim write or reuse) → `createRecordWithLifetimeLocked` → on success the audit and bump; on `ErrCASConflict` today's adoption branch; on any other lifetime failure its sentence (`errLifetimePending` the ambiguous one; `errLifetimeSettling` 409 settling; `*hostHeldError` 409 held; a step-2 read error the ambiguous one) and `rollbackAttachLocked(ctx, acct, app, host, created)`, which never retires a record and releases the claim **only** when this call minted it, `admit(host, "") == nil`, and `classifyLocked` finds no valid record under this key. Because the claim write, every competing attach's claim reuse and lifetime create, every rollback and every detach of the hostname all run under the one exclusion, no attach can reuse a claim that another attach is about to release, and no release can happen while another attach is between its claim and its record. The claims-off detach (`domainattach.go:349`, `apidomains.go:989`) is `detachFirstRouteLocked(ctx, ...)` inside `withHostname(host)`: `retireRecordWithLifetimeLocked(..., retireAny)` then the claim release, record before claim as today. The claims-on attach, rollback and detach are untouched. A test pins that no claims-off attach failure calls retirement. |
| +Door mappings: the create door: `*hostHeldError` → 409 `hostHeldSentence(host, hold)`; `errLifetimeSettling` → 409 settling; `errLifetimePending` → 502 "could not create the instance — try again", no undo; the **sibling undo** at line 1684 (the apex was claimed mid-create) calls `retireInstanceRecord(ctx, acct.Sqid, app, host, principal, incarnation, provision.RetireExpectation{Incarnation: created.Incarnation})` with the record the create returned (the one dispatch path: `retireHostRecord` → the claims-off branch → the locking `retireRecordWithLifetime`; the claims-on branch ignores the expectation as today): it retires exactly the lifetime this create made and nothing else (Task 4). Seed and import: the same three onto their existing failure sentences; on `errLifetimePending` the door writes nothing further and the record recovery completes carries the seed state the body had, which the existing seed sweep then owns. Attach (claims-off): the **first-route path runs inside `s.lockApp(acct, app)` and then `withHostname(host)` from the claim to the record** (the app lock taken outside the hostname exclusion, never inside it): `attachFirstRouteLocked(ctx, acct, app, host, ...)` = `attachDomainClaim` (the claim write or reuse) → `createRecordWithLifetimeLocked` → on success the audit and bump; on `ErrCASConflict` today's adoption branch; on any other lifetime failure its sentence (`errLifetimePending` the ambiguous one; `errLifetimeSettling` 409 settling; `*hostHeldError` 409 held; a step-2 read error the ambiguous one) and `rollbackAttachLocked(ctx, acct, app, host, created)`, which never retires a record and releases the claim **only** when this call minted it, `admit(host, "") == nil`, and `classifyLocked` finds no valid record under this key. Because the claim write, every competing attach's claim reuse and lifetime create, every rollback and every detach of the hostname all run under the one exclusion, no attach can reuse a claim that another attach is about to release, and no release can happen while another attach is between its claim and its record. The claims-off detach (`domainattach.go:349`, `apidomains.go:989`) is `detachFirstRouteLocked(ctx, ...)` inside `withHostname(host)`: `retireRecordWithLifetimeLocked(..., retireAny)` then the claim release, record before claim as today. The claims-on attach, rollback and detach are untouched. A test pins that no claims-off attach failure calls retirement. |
| - [ ] **Step 1: Write the failing tests** against an in-process console with `release.NewDirStore` and `HostClaim` off: |
| - `TestCreateAllocatesSlotThenRecord`, `TestCreateAfterRetirementGetsNextIncarnation`, `TestCreateReplacesStaleRecord`, `TestCreateOfALiveInstanceIsTheExistingConflict`, `TestCreateRefusesWhileAnOperationIsPending`, `TestCreateRefusesALiveSlotOfAnotherApp`, `TestCreateRefusesWhenTheAccountIsUnknown` (`AccountBySqid` nil → 502, nothing persisted), `TestTwoAppsCreatingOneHostnameSerialise`. |
| @@ -179,7 +179,7 @@ Door mappings: the create door: `*hostHeldError` → 409 `hostHeldSentence(host, |
| **Files:** |
| - Create: `internal/console/lifetimes_retire.go` |
| -- **App purge.** Two regimes, split by the cutover marker. **A box** (`domains.Reconcile` 1d) auto-purges only while it has **not** read `control/lifetimes-cutover.json` (read each pass; latched once seen; an unreadable marker → skip purging this pass, log once an hour; `cfg.CutoverSeen func(ctx) (bool, error)` wired by the agent); its purge is today's `PurgeApp` with instance-record keys deleted by `Get` → `DeleteIfMatch` (a conflict aborts before any other deletion; the next pass retries); the listing-to-`Get` window is exactly today's two-purger race on `main` and is not widened (no slot exists before the cutover). **The console** (`handlePurgeApp`, `purgeOne`, and a new hourly `release.ExpiredTrashApps(ctx, s, now)` sweep in `StartExpiryPass` that runs whether or not the pass has rows, so headless apps are purged once boxes stop; `HostClaim` deployments keep `RequestClaimAutoPurge` unchanged) purges through `s.purgeAppWithLifetimes(ctx, acct, app, want deletedAt, now)`, every caller already holding or taking **`s.lockApp(acct, app)`**: (1) **the guards first**: `release.PurgeAppGuards(ctx, s, pub, acct, app, want, now)` (the marker, its clock, the production flag and the store-estate guard exactly as `PurgeAppIfTrashedAt` applies them today, factored out so they run before any lifetime step; a refusal ends the purge with today's sentence); (2) **per instance key** under the app prefix, and per pending allocation of the app (`PendingLifetimesForApp(acct, app)`), under `withHostname(host)`: observe (`classifyLocked`); a pending allocation of this app → the lifetime check of Task 3 fails by construction (the app is trashed) → `retireSlotOrphanLocked` when the slot is the allocation's, `void`; a present record → `retireRecordWithLifetimeLocked(ctx, acct, app, host, normal, RetireExpectation{Incarnation: obs.Rec.Incarnation})` when numbered, `RetireExpectation{ETag: obs.ETag}` when legacy (never `retireAny`; the observation and the retirement are one locked step, so nothing can be observed stale); absent with a live slot → `retireSlotOrphanLocked`; absent with no slot → nothing; any `errLifetimePending` → the purge stops here and re-runs later (every step idempotent); (3) `purgeApp`'s sweep with instance keys **excluded** (the retire hook is the no-op marker that the keys were handled), then the trash marker. Because create, recovery and purge all take the app lock before the hostname lock, no create or recovery of this app runs while the purge does, and the app name is released (the marker deleted, the apps row removed) only after every instance of this app lifetime is retired, so a successor under the same name starts with no slot or record of its predecessor to collide with. |
| +- **App purge.** Two regimes, split by the cutover marker. **A box** (`domains.Reconcile` 1d) auto-purges only while it has **not** read `control/lifetimes-cutover.json` (read each pass; latched once seen; an unreadable marker → skip purging this pass, log once an hour; `cfg.CutoverSeen func(ctx) (bool, error)` wired by the agent); its purge is today's `PurgeApp` with instance-record keys deleted by `Get` → `DeleteIfMatch`, where **the marker is re-read immediately before each `Get`** (present → the purge aborts with nothing further deleted; the console owns the app from here) and the pair runs under a clock guard (more than 30 s since that marker read before the `DeleteIfMatch` → abort and retry next pass); because the console's activation is at least `lifetimeSettle` (60 s) after the marker appears, a box that read the marker absent cannot delete a numbered record (none exists until 60 s later and its own window is 30 s), and a sweep paused across the cutover sees the marker and stops; a conflict aborts before any other deletion; the next pass retries; within those bounds the listing-to-`Get` window is today's two-purger race on `main` and is not widened. **The console** (`handlePurgeApp`, `purgeOne`, and a new hourly `release.ExpiredTrashApps(ctx, s, now)` sweep in `StartExpiryPass` that runs whether or not the pass has rows, so headless apps are purged once boxes stop; `HostClaim` deployments keep `RequestClaimAutoPurge` unchanged) purges through `s.purgeAppWithLifetimes(ctx, acct, app, want deletedAt, now)`, every caller already holding or taking **`s.lockApp(acct, app)`**: (1) **the guards first**: `release.PurgeAppGuards(ctx, s, pub, acct, app, want, now)` (the marker, its clock, the production flag and the store-estate guard exactly as `PurgeAppIfTrashedAt` applies them today, factored out so they run before any lifetime step; a refusal ends the purge with today's sentence); (2) **per instance key** under the app prefix, and per pending allocation of the app (`PendingLifetimesForApp(acct, app)`), under `withHostname(host)`: observe (`classifyLocked`); a pending allocation of this app → the lifetime check of Task 3 fails by construction (the app is trashed) → `retireSlotOrphanLocked` when the slot is the allocation's, `void`; a present record → `retireRecordWithLifetimeLocked(ctx, acct, app, host, normal, RetireExpectation{Incarnation: obs.Rec.Incarnation})` when numbered, `RetireExpectation{ETag: obs.ETag}` when legacy (never `retireAny`; the observation and the retirement are one locked step, so nothing can be observed stale); absent with a live slot **owned by this app** (`slot.Account == acct && slot.App == app`) → `retireSlotOrphanLocked`; absent with a live slot owned by **another** key → nothing (a foreign slot is never purge's; whether it is an orphan is the create rule's question, asked against the slot owner's own key); absent with no slot → nothing; any `errLifetimePending` → the purge stops here and re-runs later (every step idempotent); (3) `purgeApp`'s sweep with instance keys **excluded** (the retire hook is the no-op marker that the keys were handled), then the trash marker. Because create, recovery and purge all take the app lock before the hostname lock, no create or recovery of this app runs while the purge does, and the app name is released (the marker deleted, the apps row removed) only after every instance of this app lifetime is retired, so a successor under the same name starts with no slot or record of its predecessor to collide with. **Restore evidence**: `settleApp` and `MaterializeApps` today count any object under the app prefix as evidence the app lives; in lifetimes mode an instance-record key counts only when the judge classifies it **valid** (`ListRecordsJudged`), so a stale body left under a retired slot never turns a finished purge into a restore; `TestStaleBodyIsNotRestoreEvidence` pins it (a purge whose `PurgeAppRow` write failed, a stale body under the prefix: `settleApp` releases the name instead of restoring). |
| - Modify: `internal/console/hostclaimops.go` (claims-off `ref.Family == "instance"` → `retireRecordWithLifetime(ctx, ref.Account, ref.App, ref.Host, ref.Expect)`; `provision.RetireRef` gains `Expect retireExpectation`-shaped fields through a new `provision.RetireExpectation{Absent bool; ETag string; Incarnation uint64}` so each caller states its own), `internal/console/claim_retire.go` (`retireInstanceRecord(ctx, account, app, host, by, incarnation string, expect provision.RetireExpectation)`; its claims-off callers: `apiinstances.go:1684` (the sibling undo) with `{Incarnation: created.Incarnation}` through the locking `retireRecordWithLifetime`; **detach does not go through it on the claims-off path**: `apidomains.go:989` and `domainattach.go:349` call Task 3's `detachFirstRouteLocked`, which calls `retireRecordWithLifetimeLocked(..., retireAny)` inside the exclusion it already holds; the claims-on detach keeps today's `retireInstanceRecord` chain; `domainattach.go:557` (`rollbackAttach`) never retires on the claims-off path; `apiinstances.go:2245` is not reached on claims-off: `importDeleteRule` answers every claims-off delete), `internal/console/apiinstanceimport.go` (`readDeletedRecord` returns `(provision.Observation, error)` through `s.judge.Observe`; `importDeleteRule`: `!obs.Present` → `retireRecordWithLifetime(..., retireExpectAbsent)`; `obs.Verdict` stale or corrupt → `deleteRead(..., retireExpectETag(obs.ETag))`; valid → the import logic as today, and its ordinary delete `deleteRead(..., retireExpectETag(obs.ETag))`; `deleteRead` passes the expectation through: `ErrCASConflict` keeps the `again` re-decision; `errLifetimeSettling` → 409 settling; `errRetireRefused` → 409 its sentence), `internal/console/seedfinish.go` (`finishSeedOnce`'s final delete → `retireRecordWithLifetime(ctx, sqid, app, host, retireExpectETag(etag))`), `internal/console/apiinstances.go` (`handleAPIInstanceDelete`: `errRetireRefused`, `errLifetimeSettling` → 409), `internal/console/domainattach.go` and `internal/console/apidomains.go` (detach: `errLifetimeSettling` → 409 `claimDetachInProgressMsg`; `errRetireRefused` → 409 its sentence), `internal/console/lifetimes_recovery.go` |
| - Test: `internal/console/lifetimes_retire_test.go` |
| @@ -209,7 +209,7 @@ Inside `withHostname(host)`: `admit(host, "")`; `obs := classifyLocked` (unreada |
| - kind **orphan**, `pred`: absent or any present body → O1 (the slot, then the body if present), `committed`. |
| - kind **cleanup**, `pred`: any observation (absent, corrupt, stale, or a valid body at N: the DELETE this operation answers was for this lifetime, and under the retired slot every body is stale) → C1 then C2 on the current body's ETag when present, `committed`. |
| -- [ ] **Step 1: Write the failing tests** through the real doors and the function: `TestConsolePurgeRetiresEveryLifetime` (browser purge, the expiry pass's row purge and its hourly store sweep (an app with no console row), all holding `s.lockApp`: the guards run before any lifetime step and a refused purge retires nothing; every record ends absent with a retired slot (numbered by incarnation, legacy by ETag); a pending allocation with a live slot and no record is voided and its slot retired; one with no slot is voided; a create of the same app blocked on the app lock during the purge finds the app trashed and refuses; a recovery pass blocked on the app lock finds the lifetime mismatch and voids; the hostname is then created by another app at N+1; an `errLifetimePending` mid-purge leaves the marker and the re-run completes); `TestBoxPurgeStopsAtTheCutoverMarker` (a box that has read the marker leaves every trashed app alone; an unreadable marker → skip and log; before the marker its instance deletes are conditional and a record changed after the `Get` survives); `TestOrphanSlotReclaimedByTheNextCreate` (a live slot with no record and no pending op, from a lost allocation row, is retired as `orphan` and the create allocates N+1; with a pending op it is `*hostHeldError`); |
| +- [ ] **Step 1: Write the failing tests** through the real doors and the function: `TestConsolePurgeRetiresEveryLifetime` (browser purge, the expiry pass's row purge and its hourly store sweep (an app with no console row), all holding `s.lockApp`: the guards run before any lifetime step and a refused purge retires nothing; every record ends absent with a retired slot (numbered by incarnation, legacy by ETag); a pending allocation with a live slot and no record is voided and its slot retired; one with no slot is voided; a create of the same app blocked on the app lock during the purge finds the app trashed and refuses; a recovery pass blocked on the app lock finds the lifetime mismatch and voids; the hostname is then created by another app at N+1; an `errLifetimePending` mid-purge leaves the marker and the re-run completes); `TestBoxPurgeStopsAtTheCutoverMarker` (a box that has read the marker leaves every trashed app alone; an unreadable marker → skip and log; before the marker its instance deletes are conditional and a record changed after the `Get` survives); `TestOrphanSlotReclaimedByTheNextCreate` (a live slot with no record and no pending op, from a lost allocation row, is retired as `orphan` and the create allocates N+1; with a pending op it is `*hostHeldError`; a stale body under the owner key is deleted in step 5 by a create under another key); `TestCreateChecksTheAppUnderTheLock` (a create that read a live app, blocked on the app lock across a trash → 409 trash; across a purge → 404; across a purge and a recreate under the same name → 409 changed, nothing allocated); `TestCancellationIsOneTransaction` (a crash anywhere between the void and O1 leaves exactly one pending row, the retirement, which completes); `TestBoxPurgeAbandonsAcrossTheCutover` (a box paused between its listing and its `Get` while the marker appears and the console activates and recreates the host: the re-read marker stops the purge, nothing deleted; the 30 s clock guard likewise); |
| - `TestDeleteDoorRetiresThroughTheTombstone`; `TestSlotRetiresBeforeTheKeyIsAbsent`. |
| - `TestDeleteDoorAbsentPathAdmitsAndRetiresOrphans` (initial absence; absence found on the judge's re-read; a record created since is untouched and the door still answers "deleted"). |
| - `TestStaleCleanupRetiresALiveOwnedSlotFirst` (a fieldless late body beside `{1, live, this key}`: the slot is `{1, retired}` before the body is removed; a blocked incarnation-1 create-only write released afterwards lands stale; the same for a corrupt body). |
diff --git a/docs/superpowers/plans/2026-10-22-self-serve-moves-2-door-token-job.md b/docs/superpowers/plans/2026-10-22-self-serve-moves-2-door-token-job.md| index 7151908cd..885459d36 100644 |
| --- a/docs/superpowers/plans/2026-10-22-self-serve-moves-2-door-token-job.md |
| +++ b/docs/superpowers/plans/2026-10-22-self-serve-moves-2-door-token-job.md |
| @@ -2,7 +2,7 @@ |
| > **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking. |
| -Rev 8, 2026-10-22. Rev 7's review (`selfserve-plan2-review7.md`: N1, N2, N3, N5 closed) is answered: a phase with several writes has a durable **substep** (`phase_step`), advanced atomically with the consumption that ends the previous substep, and the phase function dispatches on it (item 10); confirmation is the **receipt alone** (no state predicate), phase progress is reconciliation's business (item 10); issuance refused with no outstanding request is its own result (`errRequestRefused`) (item 10); a confirmed request whose wait will never be satisfied is **abandoned** (consumed without its wait) by abort, expiry and operator supersession, and the finaliser consumes a confirmed clearing request in the transaction that records the outcome (item 13); `maintain` updates the stage identity like `stage` (N4); the cut's `MarkSelfServeCut` retires the ready deadline in the same UPDATE and ready expiry is conditional on no accepted cut (N6); return reports are **immutable per request key** (item 21); an id-less forward keeps `BoxID` membership and drops only the instance comparison (item 8); one untagged bridge file with the complete helper closure (item 20). Rev 6's review (`selfserve-plan2-review6.md`: items 1, 6, 17 closed) is answered: the request lifecycle is a complete state machine (`issued → confirmed → consumed`, or `voided`) with a **resume** path for a confirmed-unconsumed request, a standalone consume for same-phase sequences (start then seal, finish gate 1 then finish, round after round, estimate), issuance that returns the existing request so a caller of another kind or phase stops instead of interpreting it, and no-op-free receipts (a request-bearing mutation always writes its receipt) (item 10); the bound write checks **incarnation and sequence** (`provision.Expect{Incarnation, Seq}`) for the job and the operator doors (N5, item 13); every finalisation requires no outstanding request after a fence (item 13); the expiry branch classifies the fenced observation (N3); the cut is a **handoff**: the door marks `cut_requested_at` and the job turns the outstanding maintenance round into the first cut round (N4); event delivery marks `emitted` inside the transaction before delivering and the terminal event is inserted with the outcome (N1); per-box FIFO is stated (N2); the open intent is prepared before the request is issued so adoption and the persisted proposal agree, return requests carry a full identity ordered deterministically, reports name the request key, and acceptance binds the report to the reverse move's selected target (item 21); `Expect`'s real fields, `Load`'s absence distinction and one id-less rule (item 8); the fixtures move to an untagged `linux` file so today's tests keep compiling, `CopyEvent` carries its completion fields, the saved book is validated before seeding, `DiskFreeBytes` is numeric (item 20). Rev 5's review (`selfserve-plan2-review5.md`: items 2, 3, 4, 5, 7, 9, 11, 12, 14, 15, 16, 18, 19 closed) is answered: every job and operator record write is **predecessor-bound** (`provision.SetRecordMoveAt(ctx, s, acct, app, host, expectSeq, mut)`: one CAS write against the record whose `record_seq` equals the persisted expectation, no fresh-read retry), so a voided request can never land and an operator door never rebuilds a write after a reclaim fence (items 10, 13); every self-serve mutation stamps a **nonce receipt** on the record (`SelfServe.LastRequest`, or `LastMove.Request` for a clearing write), so confirmation is exact for every transition and distinct from an operator's reconciliation (item 10); confirm and advance require an unconsumed, unvoided request, so a stale worker cannot confirm a voided one (item 10); "pending" means **no confirmed request for the phase's write**, so the interval before issuance is compatible with the predecessor state (item 10); an expired uncommitted open is fenced and aborted, never replayed (N1); the stage book is reconciled against each complete successful round so deleted keys leave it (item 6); identity records are loaded by `boxid.Key(BoxID)` and `Verified` is narrowed to what `Enroll` proves (item 8); the gate's exception for an authorised malformed hostname and plan 1's outer 503 are declared (item 1); the view joins row id, move id, self-serve id and incarnation (item 17); the open record adopts an existing complete intent, return discovery and acceptance compare `InstanceID`, incarnation is re-checked at the door and in the guarded write, and `Layout` comes from the source's `stopped` report so every operator move has it (item 21); a maintenance restage in `ready` has its own kind and keeps the confirmation deadline (N2); the gate types, `StagedRequest`, failed diagnostics, the request argument to `confirmed`, and the bridge's compile rule are stated (item 20). Reviews: rev 1 (`after236/selfserve-plan2-review.md`, 20 findings), rev 2 (`selfserve-plan2-review2.md`, 21), rev 3 (`selfserve-plan2-review3.md`, 21 items), rev 4 (`selfserve-plan2-review4.md`, 21 items, 9 closed). Rev 5 is **self-contained** (nothing is "as rev N"; every schema, phase, predicate, sentence and test list is in this document) and answers rev 4's open items: the gate orders authentication, host shape and the capability check before the limiter and the no-bucket rail (item 1); operator moves keep today's admission (nil or stale metrics, no identity record) and only the self-serve path requires fresh identity; `BootID` is dropped (items 4, 8); the evidence reader takes the move and a freshness table is stated (item 5); the staged inventory is a **move-bound book** built from every copy event the mirror reports, including same-ETag and deferred copies, through a new observer hook that leaves ordinary mirroring unchanged (item 6); a participant is identified by `BoxID` **and** `InstanceID` in the resolver, in report validation and at every gate, and abort never requires the target (item 8); every request persists its **nonce, expected sequence and proposed stamp before the write**, confirmation is conditional on the record carrying that exact stamp, replay is idempotent, and consumption and the phase advance are one UPDATE predicated on the nonce (item 10); compatible sets include the predecessor state while a phase's write is pending (item 10); expiry is bound to its phase and cleared on reconciliation into another phase, with the health rule taking precedence (item 12); abandonment is conditional on the fenced observation and persisted before release, and every reclaim fences first, operator reservations included (item 13); own retries are accepted only for a complete expected selection after the whole table validates (item 14); the status view joins rows regardless of the mode (item 17); events carry a per-row sequence and are delivered inside the caller's transaction, the harness is an exported bridge **inside package host** behind the `e2e` tag with the CI step named, the Go declarations are complete, and queue ordering is stated (item 20); the open record is written **before** the open transition with the proposed open time, return requests have unique durable identities, the report path is named, acceptance is bound to the lifetime and the forward's participants, and leftovers are judged by the forward's layout (item 21). |
| +Rev 9, 2026-10-22. Rev 8's review (`selfserve-plan2-review8.md`: 21, N4 closed) is answered: reconciliation maps the record to a **phase and substep** (the first substep whose transition the record has not made), so an operator's progress never makes the job repeat a refused transition (item 10); abandonment is only for **leaving** a wait (abort, cancel, operator supersession), never for a page-and-retain expiry, with the phase table stated (item 13); the confirmation-deadline expiry commits only against `cut_requested_at = 0` and the deadline it saw, and the cut's copy expiry is a different decision (N6); the cut handoff persists which continuation it chose as a `restage` substep (`adopted` or `issue`) in the advancing transaction (N7); acceptance and discovery share one participant predicate (item 8); the superseded tag arrangement is deleted (item 20). Rev 7's review (`selfserve-plan2-review7.md`: N1, N2, N3, N5 closed) is answered: a phase with several writes has a durable **substep** (`phase_step`), advanced atomically with the consumption that ends the previous substep, and the phase function dispatches on it (item 10); confirmation is the **receipt alone** (no state predicate), phase progress is reconciliation's business (item 10); issuance refused with no outstanding request is its own result (`errRequestRefused`) (item 10); a confirmed request whose wait will never be satisfied is **abandoned** (consumed without its wait) by abort, expiry and operator supersession, and the finaliser consumes a confirmed clearing request in the transaction that records the outcome (item 13); `maintain` updates the stage identity like `stage` (N4); the cut's `MarkSelfServeCut` retires the ready deadline in the same UPDATE and ready expiry is conditional on no accepted cut (N6); return reports are **immutable per request key** (item 21); an id-less forward keeps `BoxID` membership and drops only the instance comparison (item 8); one untagged bridge file with the complete helper closure (item 20). Rev 6's review (`selfserve-plan2-review6.md`: items 1, 6, 17 closed) is answered: the request lifecycle is a complete state machine (`issued → confirmed → consumed`, or `voided`) with a **resume** path for a confirmed-unconsumed request, a standalone consume for same-phase sequences (start then seal, finish gate 1 then finish, round after round, estimate), issuance that returns the existing request so a caller of another kind or phase stops instead of interpreting it, and no-op-free receipts (a request-bearing mutation always writes its receipt) (item 10); the bound write checks **incarnation and sequence** (`provision.Expect{Incarnation, Seq}`) for the job and the operator doors (N5, item 13); every finalisation requires no outstanding request after a fence (item 13); the expiry branch classifies the fenced observation (N3); the cut is a **handoff**: the door marks `cut_requested_at` and the job turns the outstanding maintenance round into the first cut round (N4); event delivery marks `emitted` inside the transaction before delivering and the terminal event is inserted with the outcome (N1); per-box FIFO is stated (N2); the open intent is prepared before the request is issued so adoption and the persisted proposal agree, return requests carry a full identity ordered deterministically, reports name the request key, and acceptance binds the report to the reverse move's selected target (item 21); `Expect`'s real fields, `Load`'s absence distinction and one id-less rule (item 8); the fixtures move to an untagged `linux` file so today's tests keep compiling, `CopyEvent` carries its completion fields, the saved book is validated before seeding, `DiskFreeBytes` is numeric (item 20). Rev 5's review (`selfserve-plan2-review5.md`: items 2, 3, 4, 5, 7, 9, 11, 12, 14, 15, 16, 18, 19 closed) is answered: every job and operator record write is **predecessor-bound** (`provision.SetRecordMoveAt(ctx, s, acct, app, host, expectSeq, mut)`: one CAS write against the record whose `record_seq` equals the persisted expectation, no fresh-read retry), so a voided request can never land and an operator door never rebuilds a write after a reclaim fence (items 10, 13); every self-serve mutation stamps a **nonce receipt** on the record (`SelfServe.LastRequest`, or `LastMove.Request` for a clearing write), so confirmation is exact for every transition and distinct from an operator's reconciliation (item 10); confirm and advance require an unconsumed, unvoided request, so a stale worker cannot confirm a voided one (item 10); "pending" means **no confirmed request for the phase's write**, so the interval before issuance is compatible with the predecessor state (item 10); an expired uncommitted open is fenced and aborted, never replayed (N1); the stage book is reconciled against each complete successful round so deleted keys leave it (item 6); identity records are loaded by `boxid.Key(BoxID)` and `Verified` is narrowed to what `Enroll` proves (item 8); the gate's exception for an authorised malformed hostname and plan 1's outer 503 are declared (item 1); the view joins row id, move id, self-serve id and incarnation (item 17); the open record adopts an existing complete intent, return discovery and acceptance compare `InstanceID`, incarnation is re-checked at the door and in the guarded write, and `Layout` comes from the source's `stopped` report so every operator move has it (item 21); a maintenance restage in `ready` has its own kind and keeps the confirmation deadline (N2); the gate types, `StagedRequest`, failed diagnostics, the request argument to `confirmed`, and the bridge's compile rule are stated (item 20). Reviews: rev 1 (`after236/selfserve-plan2-review.md`, 20 findings), rev 2 (`selfserve-plan2-review2.md`, 21), rev 3 (`selfserve-plan2-review3.md`, 21 items), rev 4 (`selfserve-plan2-review4.md`, 21 items, 9 closed). Rev 5 is **self-contained** (nothing is "as rev N"; every schema, phase, predicate, sentence and test list is in this document) and answers rev 4's open items: the gate orders authentication, host shape and the capability check before the limiter and the no-bucket rail (item 1); operator moves keep today's admission (nil or stale metrics, no identity record) and only the self-serve path requires fresh identity; `BootID` is dropped (items 4, 8); the evidence reader takes the move and a freshness table is stated (item 5); the staged inventory is a **move-bound book** built from every copy event the mirror reports, including same-ETag and deferred copies, through a new observer hook that leaves ordinary mirroring unchanged (item 6); a participant is identified by `BoxID` **and** `InstanceID` in the resolver, in report validation and at every gate, and abort never requires the target (item 8); every request persists its **nonce, expected sequence and proposed stamp before the write**, confirmation is conditional on the record carrying that exact stamp, replay is idempotent, and consumption and the phase advance are one UPDATE predicated on the nonce (item 10); compatible sets include the predecessor state while a phase's write is pending (item 10); expiry is bound to its phase and cleared on reconciliation into another phase, with the health rule taking precedence (item 12); abandonment is conditional on the fenced observation and persisted before release, and every reclaim fences first, operator reservations included (item 13); own retries are accepted only for a complete expected selection after the whole table validates (item 14); the status view joins rows regardless of the mode (item 17); events carry a per-row sequence and are delivered inside the caller's transaction, the harness is an exported bridge **inside package host** behind the `e2e` tag with the CI step named, the Go declarations are complete, and queue ordering is stated (item 20); the open record is written **before** the open transition with the proposed open time, return requests have unique durable identities, the report path is named, acceptance is bound to the lifetime and the forward's participants, and leftovers are judged by the forward's layout (item 21). |
| Builds on plan 1 (`2026-10-22-self-serve-moves-1-lifetimes-and-order.md`, rev 13): records carry a lifetime, `record_seq` and `move_seq`, rows carry the pair, readers and writers are judged, `fenceRecord(ctx, acct, app, host, op fenceOwner) (fenceResult, Observation, error)` exists, the console runs behind the lifetimes cutover. This plan adds everything a Tito customer's request needs up to a finished move except the holding page, the edge probe mode and cleanup (plans 3 and 4). |
| @@ -104,10 +104,10 @@ Builds on plan 1 (`2026-10-22-self-serve-moves-1-lifetimes-and-order.md`, rev 13 |
| **Interfaces:** |
| - Table `self_serve_moves (id TEXT PRIMARY KEY, account TEXT, app TEXT, host TEXT, incarnation INTEGER, from_region TEXT, to_region TEXT, participants TEXT, display_name TEXT, requested_by TEXT, phase TEXT, phase_started_at INTEGER, step_deadline INTEGER, window_deadline INTEGER, expiry_pending INTEGER, expiry_phase TEXT, staging_started_at INTEGER, request_issued INTEGER, request_kind TEXT, request_phase TEXT, request_nonce TEXT, request_expect_seq INTEGER, request_proposed INTEGER, request_confirmed INTEGER, request_consumed INTEGER, request_voided INTEGER, request_abandoned INTEGER, request_expect_inc INTEGER, cut_requested_at INTEGER, phase_step TEXT, stage_request INTEGER, precheck_request INTEGER, rounds INTEGER, estimate_seconds INTEGER, estimate_terms TEXT, reason TEXT, health_attempts INTEGER, health_consecutive_ok INTEGER, health_first_ok_at INTEGER, health_last_probe_at INTEGER, health_last_error TEXT, finish_gate TEXT, notified_seq INTEGER, event_seq INTEGER, outcome TEXT, outcome_reason TEXT, warning TEXT, abort_requested_at INTEGER, source_reopened_at INTEGER, abort_finished_at INTEGER, effects_done INTEGER, release_pending INTEGER, open_record_pending INTEGER, created_at INTEGER, updated_at INTEGER)`; `CREATE UNIQUE INDEX IF NOT EXISTS self_serve_moves_open ON self_serve_moves(account, app, host) WHERE outcome = ''`. |
| - **The request lifecycle** (one request at a time per row): `IssueSelfServeRequest(id, kind, phase string, pr persistedRequest, now time.Time) (issued bool, existing *persistedRequest, err error)` (`WHERE phase = ? AND outcome = '' AND (request_consumed <> 0 OR request_issued = 0)`: sets `request_issued = now, request_kind, request_phase, request_nonce, request_expect_inc, request_expect_seq, request_proposed, request_confirmed = 0, request_consumed = 0, request_voided = 0`; not issued → `existing` is the outstanding request, whatever its kind and phase); `ConsumeSelfServeRequest(id, nonce, nextStep string) (bool, error)` (`WHERE request_nonce = ? AND request_confirmed <> 0 AND request_consumed = 0`: `request_consumed = 1, phase_step = nextStep` in one statement; the standalone consume for a same-phase sequence: the substep advances exactly when the previous request is consumed, so a crash between them cannot lose the position); `AbandonSelfServeRequest(id, nonce string) (bool, error)` (`WHERE request_nonce = ? AND request_confirmed <> 0 AND request_consumed = 0`: `request_consumed = 1, request_abandoned = 1`; only abort, an expiry action and operator supersession call it: the request's write committed but its wait will never be satisfied, so the phase gives it up and proceeds); `ConfirmSelfServeRequest(id, nonce string, now time.Time) (bool, error)` (`WHERE request_nonce = ? AND request_consumed = 0 AND request_voided = 0 AND request_confirmed = 0`: `request_confirmed = now`; false → the caller re-reads the row: confirmed already → **resume** (success), voided or consumed → stop; for kinds `stage` **and `maintain`** also `stage_request = request_proposed`, for `precheck` also `precheck_request = request_proposed`); `VoidSelfServeRequest(id, nonce string) error` (`WHERE request_nonce = ? AND request_consumed = 0 AND request_confirmed = 0`: `request_consumed = 1, request_voided = 1`; a confirmed request is never voided; the phase function decides again); `AdvanceSelfServe(id, from, to, reason string, step, window time.Time, nonce string, now time.Time) (bool, error)`: one UPDATE with the predicate `phase = ? AND (abort_requested_at = 0 OR ? IN ('reverting','done','opened','health','finishing')) AND (? = '' OR request_nonce = ?)` that sets the phase, `phase_started_at`, the deadlines, `expiry_pending = 0, expiry_phase = ''` when `to <> expiry_phase`, and, when a nonce is given, additionally requires `request_nonce = ? AND request_confirmed <> 0 AND request_consumed = 0` and sets `request_consumed = 1` (**consumption and the advance are one statement**), and inserts the phase event in the same transaction (`event_seq = event_seq + 1`); a stale worker holding another nonce, or the same nonce after a void, cannot confirm or consume. |
| -- Other store methods: `AdmitSelfServeMove(m SelfServeMove) (admitted bool, open *SelfServeMove, err error)`; `SelfServeMove(id string) (*SelfServeMove, error)`; `SelfServeMoveForHost(acct, app, host string) (open, terminal *SelfServeMove, err error)` (the open row, and the newest terminal row); `OpenSelfServeMoves() ([]SelfServeMove, error)` (`outcome = '' OR release_pending = 1 OR effects_done = 0 OR open_record_pending = 1`, **ordered by `created_at, id`**: the pass steps rows in that order; **per-box FIFO**: a row in `reserving` may reserve only when no older open row (by `created_at, id`) that shares any participant `BoxID` is still in `requested` or `reserving`; otherwise it waits with `reason` "waiting for an earlier move on this box"; rows with disjoint participants never wait on each other); `MarkSelfServeCut(id string, now time.Time, copyDeadline time.Time) (bool, error)` (`WHERE phase = 'ready' AND abort_requested_at = 0 AND cut_requested_at = 0`: sets `cut_requested_at = now`, **`window_deadline = 0`** (the confirmation deadline is retired by the cut that won) and `step_deadline = copyDeadline` (the cut's copy wait) in the same UPDATE; the cut door's only write); the `ready` expiry rule applies only while `cut_requested_at = 0`; `SetSelfServeEstimate`, `RecordSelfServeHealth(id string, probeAt time.Time, ok bool, errText string) error` (`health_attempts + 1`; `consecutive_ok = CASE ok THEN consecutive_ok + 1 ELSE 0`; `first_ok_at` kept once set), `SetSelfServeFinishGate`, `SetSelfServeWarning`, `SetSelfServeNotifiedSeq(id string, seq uint64) error`, `SetSelfServeExpiry(id, phase string, pending bool) error`, `RequestSelfServeAbort(id string, phases []string, now time.Time) (bool, error)` (`WHERE phase IN (...) AND abort_requested_at = 0`), `SetSelfServeReopened`, `SetSelfServeAbortFinished`, `FinishSelfServeMove(id, outcome, reason, warning string, now time.Time) error` (`release_pending = 1`, `effects_done = 0`), `SetSelfServeEffectsDone(id string) error`, `ClearSelfServeRelease(id string) error`, `SetSelfServeOpenRecordPending(id string, pending bool) error`. |
| +- Other store methods: `AdmitSelfServeMove(m SelfServeMove) (admitted bool, open *SelfServeMove, err error)`; `SelfServeMove(id string) (*SelfServeMove, error)`; `SelfServeMoveForHost(acct, app, host string) (open, terminal *SelfServeMove, err error)` (the open row, and the newest terminal row); `OpenSelfServeMoves() ([]SelfServeMove, error)` (`outcome = '' OR release_pending = 1 OR effects_done = 0 OR open_record_pending = 1`, **ordered by `created_at, id`**: the pass steps rows in that order; **per-box FIFO**: a row in `reserving` may reserve only when no older open row (by `created_at, id`) that shares any participant `BoxID` is still in `requested` or `reserving`; otherwise it waits with `reason` "waiting for an earlier move on this box"; rows with disjoint participants never wait on each other); `MarkSelfServeCut(id string, now time.Time, copyDeadline time.Time) (bool, error)` (`WHERE phase = 'ready' AND abort_requested_at = 0 AND cut_requested_at = 0`: sets `cut_requested_at = now`, **`window_deadline = 0`** (the confirmation deadline is retired by the cut that won) and `step_deadline = copyDeadline` (the cut's copy wait) in the same UPDATE; the cut door's only write); the `ready` expiry rule applies only while `cut_requested_at = 0`; `SetSelfServeEstimate`, `RecordSelfServeHealth(id string, probeAt time.Time, ok bool, errText string) error` (`health_attempts + 1`; `consecutive_ok = CASE ok THEN consecutive_ok + 1 ELSE 0`; `first_ok_at` kept once set), `SetSelfServeFinishGate`, `SetSelfServeWarning`, `SetSelfServeNotifiedSeq(id string, seq uint64) error`, `SetSelfServeExpiry(id, phase string, kind string, sawDeadline time.Time, pending bool) (bool, error)` (`kind` is `window` or `step`; the UPDATE's predicate is `phase = ? AND (window_deadline = ? for window, step_deadline = ? for step) AND (kind <> 'window' OR cut_requested_at = 0)`, so a worker whose snapshot predates a successful cut cannot record the obsolete confirmation expiry (`TestStaleExpiryLosesToTheCut`: a worker paused across the cut at T-1 resumes at T+1 and its `window` expiry is refused; the copy's `step` expiry after the cut is accepted); `SetSelfServeExpiry` returning false → the worker re-reads the row and decides again`, `RequestSelfServeAbort(id string, phases []string, now time.Time) (bool, error)` (`WHERE phase IN (...) AND abort_requested_at = 0`), `SetSelfServeReopened`, `SetSelfServeAbortFinished`, `FinishSelfServeMove(id, outcome, reason, warning string, now time.Time) error` (`release_pending = 1`, `effects_done = 0`), `SetSelfServeEffectsDone(id string) error`, `ClearSelfServeRelease(id string) error`, `SetSelfServeOpenRecordPending(id string, pending bool) error`. |
| - Table `self_serve_events (id TEXT, seq INTEGER, phase TEXT, account TEXT, app TEXT, host TEXT, at INTEGER, reason TEXT, detail TEXT, emitted INTEGER, PRIMARY KEY (id, seq))`: `InsertSelfServeEventTx(tx *sql.Tx, e SelfServeEvent) error` (allocates `seq` from the row's `event_seq` in the same transaction; used by `AdvanceSelfServe` and by every refusal, fact decision, lane probe, health probe and timing); `UnemittedSelfServeEvents(limit int) ([]SelfServeEvent, error)`; `DeliverSelfServeEvent(ctx context.Context, e SelfServeEvent, deliver func(tx *sql.Tx) error) error` (one transaction: first `UPDATE self_serve_events SET emitted = 1 WHERE id = ? AND seq = ? AND emitted = 0`; zero rows → commit nothing and return (another worker delivered it); else `deliver(tx)` inserts the audit row through `auditActivityTx(tx, ...)`; a failure rolls both back). The terminal event is inserted by `FinishSelfServeMove` in the transaction that sets the outcome, so a crash between finalisation steps never allocates a second terminal event. Table `self_serve_timings (id TEXT, mark TEXT, account TEXT, app TEXT, host TEXT, at INTEGER, bytes INTEGER, PRIMARY KEY (id, mark))`. |
| - Phases: `requested`, `reserving`, `queued`, `reports`, `staging`, `prechecks`, `ready`, `restage`, `barrier`, `stopping`, `sealing`, `landing`, `landed`, `open-uncertain`, `opened`, `health`, `finishing`, `reverting`, `done`. |
| -- **Compatible sets** (Task 7's reconciliation; "pending" = the row has **no confirmed request** for that phase's write, whether none was issued yet, or one is issued and unconfirmed): `offline-queued` ↔ {queued, reports, staging(pending)}; `offline-staging` ↔ {staging, prechecks, ready, restage, barrier, stopping(pending)}; `offline-stopping` ↔ {stopping, sealing(pending)}; `offline-sealing` ↔ {sealing}; `offline-sealed` ↔ {sealing, landing(pending)}; `offline-landing` ↔ {landing}; `offline-landed` ↔ {landed, open-uncertain, opened(pending)}; `offline-open` ↔ {opened, health, finishing}; `offline-finishing` ↔ {finishing}; `offline-reverting` ↔ {reverting}; cleared with `LastMove.ID == id` ↔ {done, finishing(gate-2 pending), reverting(finish pending)}; no move and no `LastMove` for the id ↔ {requested, reserving, queued(pending)}. Reconciliation moves the row **forward** to the first phase of the record's set only when the row's phase is not in that set. |
| +- **Compatible sets** (Task 7's reconciliation; "pending" = the row has **no confirmed request** for that phase's write, whether none was issued yet, or one is issued and unconfirmed): `offline-queued` ↔ {queued, reports, staging(pending)}; `offline-staging` ↔ {staging, prechecks, ready, restage, barrier, stopping(pending)}; `offline-stopping` ↔ {stopping, sealing(pending)}; `offline-sealing` ↔ {sealing}; `offline-sealed` ↔ {sealing, landing(pending)}; `offline-landing` ↔ {landing}; `offline-landed` ↔ {landed, open-uncertain, opened(pending)}; `offline-open` ↔ {opened, health, finishing}; `offline-finishing` ↔ {finishing}; `offline-reverting` ↔ {reverting}; cleared with `LastMove.ID == id` ↔ {done, finishing(gate-2 pending), reverting(finish pending)}; no move and no `LastMove` for the id ↔ {requested, reserving, queued(pending)}. Reconciliation moves the row **forward** to the first phase of the record's set only when the row's phase is not in that set, **entering the first substep whose transition the record has not yet made**: `offline-stopping` → `stopping/seal` (the start is done; the stopped reports are awaited, then seal); `offline-sealing` → `sealing`; `offline-sealed` → `landing/flip`; `offline-landing` → `landing/wait`; `offline-landed` → `landed/open`; `offline-open` → `opened` when the row was before it, else untouched; `offline-finishing` → `finishing/gate2` (gate 1 is done; the sources' `gone` is awaited); `offline-reverting` → `reverting/finish` (the abort is done; the reopen facts are awaited); and **within an already-compatible phase** the same mapping advances the substep when the record shows the operator made the substep's transition (`stopping/start` with `offline-stopping` → `seal`; `finishing/gate1` with `offline-finishing` → `gate2`), abandoning the superseded request first; a job request that was written for the transition the operator made is confirmed by its receipt as usual and the mapping simply agrees (`TestOperatorProgressEntersTheRightSubstep`: an operator start while the row is pre-cut → the job awaits stopped reports then seals, never re-issues start; an operator gate 1 during `health` → the job enters `gate2`). |
| - Lease: `const selfServeLeaseKey = "control/offline-moves/console.json"`; `type consoleLease struct { Console string; Until time.Time }`; `acquireSelfServeLease(ctx, now) (*leaseToken, bool, error)`; `leaseToken.renew(ctx, now)` (every 20 s during a tick); `leaseToken.valid(now) bool`; `leaseToken.deadline() time.Time`; `selfServeApply` derives `ctx, cancel := context.WithDeadline(ctx, t.deadline())` for the record write and re-checks `t.valid(now)` before each retry through `provision.WithWriteGuard(ctx, func() error)`, a hook `WriteRecord` calls immediately before every `Put`. A cancelled context does **not** prove the write cannot commit; that is why every write is a persisted request (Task 7). |
| - `StartSelfServeMovesPass`: runs while `selfServeMode()`; a failing startup read of rows, events or `active.json` → the pass runs (fail closed) and retries the reads each tick, logging; `selfServeTick`: renew the lease, the reservation scan, `drainSelfServeEvents`, then one step per open row in order. |
| @@ -163,7 +163,7 @@ Builds on plan 1 (`2026-10-22-self-serve-moves-1-lifetimes-and-order.md`, rev 13 |
| **Interfaces:** |
| - `type persistedRequest struct { Kind, Phase, Nonce string; ExpectInc, ExpectSeq uint64; Proposed time.Time; Confirmed, Consumed, Voided bool }`; `func (s *Server) selfServeApply(ctx context.Context, t *leaseToken, row *SelfServeMove, req request, proposed *time.Time, mut func(at time.Time, rc provision.Receipt) func(*provision.Record) error) (*provision.Record, error)` with `type request struct { Kind, Phase string }`: (1) the judged record → `pr.ExpectInc = rec.Incarnation`, `pr.ExpectSeq = rec.RecordSeq`; `pr.Proposed = *proposed` when given (the open intent) else `max(now, latest stamp on the record + 1 ns)`; `pr.Nonce = random`; `IssueSelfServeRequest(id, kind, phase, pr, now)`: not issued and `existing == nil` → `errRequestRefused` (the row left the phase or ended; the step ends); `existing.Kind != req.Kind || existing.Phase != req.Phase` → return `errRequestForeign` (this caller never interprets another request; the step ends and reconciliation decides next tick); `existing.Confirmed && !existing.Consumed` → **resume**: return the record (the caller continues its wait and the notification catch-up); otherwise `pr = *existing` and go to (3); (2) `provision.SetRecordMoveAt(ctx', s, acct, app, host, provision.Expect{Incarnation: pr.ExpectInc, Seq: pr.ExpectSeq}, mut(pr.Proposed, Receipt{pr.Nonce}))` with the lease-bounded context and the write guard: **one CAS attempt against the record at that incarnation and sequence; no fresh-read retry inside**; (3) **confirmation** from a fresh judged read, whatever (2) returned: `rec` carries the receipt (`SelfServe.LastRequest == pr.Nonce`, or `LastMove.Request == pr.Nonce` for a clearing write) → `ConfirmSelfServeRequest(id, nonce, now)` (**the receipt alone confirms**; a box that has already advanced the record past the written state (seal → sealed, flip → landed) does not change that; the `confirmed` callback is dropped and phase progress is reconciliation's business) (false → re-read: already confirmed → resume; voided → stop); else `rec.Incarnation == pr.ExpectInc && rec.RecordSeq == pr.ExpectSeq` (unchanged) → the write did not land: repeat (2) (idempotent replay of the same bound write; bounded by the lease); else (the record advanced without the receipt: another writer, an operator) → `VoidSelfServeRequest(id, nonce)` and return `errRequestVoided`; the bound write makes this safe: a PUT transmitted against `ExpectSeq` cannot commit on a record that has moved past it; after a confirmed write: `bumpSerialErr` and, on success, `SetSelfServeNotifiedSeq(id, rec.RecordSeq)`; a failed bump leaves `notified_seq` behind and every later tick bumps again while `rec.RecordSeq != notified_seq`. A crash anywhere resumes at (3) on the next tick from the persisted request. |
| - `type provision.Expect struct { Incarnation, Seq uint64 }`; `provision.SetRecordMoveAt(ctx, s, acct, app, host string, expect Expect, mut) (*provision.Record, error)`: reads the judged record; `rec.Incarnation != expect.Incarnation || rec.RecordSeq != expect.Seq` → `ErrCASConflict` without writing; otherwise one `WriteRecord` against the observed ETag; a CAS conflict → `ErrCASConflict` (no retry). `SetRecordMove` (today's, with its retry) is no longer used by any self-serve or operator move writer. |
| -- `selfServeStep`: (1) the row's deadlines: an expired `StepDeadline`, or an expired `WindowDeadline` while `cut_requested_at = 0`, → `SetSelfServeExpiry(id, phase, true)` (no action yet); (2) the judged record; (3) **reconcile forward** by the compatible sets (Task 4): an unconfirmed request → step (3) of `selfServeApply` first, **except** when `expiry_pending` is set for the issuing phase and the record is at or before `offline-landed`: then the record is observed once; the receipt present → confirmed (the write won before the expiry, the expiry is post-write); absent → `fenceRecord` (plan 1; so the outstanding bound PUT can never land) and **the fenced observation is classified**: the receipt present in it → the write won during the fence: confirm and proceed forward (an open that committed is reconciled as opened, never aborted); absent → `VoidSelfServeRequest` and the expiry action runs (abort), **never a replay** (`TestExpiredOpenIsNeverReplayed`); then the row's phase not in the record's set → `AdvanceSelfServe` to the set's first phase (without the abort predicate for `opened`), which clears a foreign expiry; (4) the expiry action for an `expiry_pending` whose `expiry_phase == phase`: the record at or before `offline-landed` → abort; committed open → the blocked action (page); unreadable → `open-uncertain`; `health` → warning, page, `finishing`; (5) the abort step when requested and the record at or before `offline-landed`; (6) the phase function. Every wait for a report is for `Request`/`StagedRequest == request_proposed` of the **confirmed** request; the report is consumed by the `AdvanceSelfServe` that leaves the waiting phase, with the nonce, **or**, inside a phase that writes more than once (`stopping`: start then seal; `finishing`: gate 1 then gate 2; `staging`: round after round; `prechecks`: the precheck then the estimate; `ready`: each maintenance round), by `ConsumeSelfServeRequest(id, nonce)` once its wait is satisfied, immediately before the next request is issued, and **the phase function dispatches on `phase_step`**: `stopping` = `start` → `seal`; `finishing` = `gate1` → `gate2`; `prechecks` = `precheck` → `estimate`; `reverting` = `abort` → `finish`; `staging` and `ready` = `round` (repeated); a phase entered by `AdvanceSelfServe` starts at its first substep (`phase_step` set by the advance); a restart resumes the substep recorded, never the phase's first write (`TestSubstepsResumeAfterEveryCrash`: a crash after consuming start and before issuing seal re-enters at `seal`; a crash with the estimate request outstanding re-enters at `estimate` and resumes it; the same for gate 1 → gate 2 and abort → finish). **Abandonment**: when abort is requested, an expiry action fires, or an operator transition supersedes the phase, a confirmed request whose wait is unsatisfied is `AbandonSelfServeRequest`ed before the abort or the reconciliation step issues its own request (`TestAbandonedRequestsNeverStrandAbort`: a confirmed stage request whose copy never reports, then cancel → the abort request issues; a confirmed precheck whose box died, then the deadline → abort issues). **Clearing requests**: `OfflineFinish`, `OfflineAbortAt` and the abort path's finish are confirmed from `LastMove.Request`; the finaliser's `FinishSelfServeMove` consumes that confirmed request in the same transaction as the outcome, so a crash between confirmation and finalisation resumes at the finaliser, not at a re-issue. |
| +- `selfServeStep`: (1) the row's deadlines: an expired `StepDeadline`, or an expired `WindowDeadline` while `cut_requested_at = 0`, → `SetSelfServeExpiry(id, phase, true)` (no action yet); (2) the judged record; (3) **reconcile forward** by the compatible sets (Task 4): an unconfirmed request → step (3) of `selfServeApply` first, **except** when `expiry_pending` is set for the issuing phase and the record is at or before `offline-landed`: then the record is observed once; the receipt present → confirmed (the write won before the expiry, the expiry is post-write); absent → `fenceRecord` (plan 1; so the outstanding bound PUT can never land) and **the fenced observation is classified**: the receipt present in it → the write won during the fence: confirm and proceed forward (an open that committed is reconciled as opened, never aborted); absent → `VoidSelfServeRequest` and the expiry action runs (abort), **never a replay** (`TestExpiredOpenIsNeverReplayed`); then the row's phase not in the record's set → `AdvanceSelfServe` to the set's first phase (without the abort predicate for `opened`), which clears a foreign expiry; (4) the expiry action for an `expiry_pending` whose `expiry_phase == phase`: the record at or before `offline-landed` → abort; committed open → the blocked action (page); unreadable → `open-uncertain`; `health` → warning, page, `finishing`; (5) the abort step when requested and the record at or before `offline-landed`; (6) the phase function. Every wait for a report is for `Request`/`StagedRequest == request_proposed` of the **confirmed** request; the report is consumed by the `AdvanceSelfServe` that leaves the waiting phase, with the nonce, **or**, inside a phase that writes more than once (`stopping`: start then seal; `finishing`: gate 1 then gate 2; `staging`: round after round; `prechecks`: the precheck then the estimate; `ready`: each maintenance round), by `ConsumeSelfServeRequest(id, nonce)` once its wait is satisfied, immediately before the next request is issued, and **the phase function dispatches on `phase_step`**: `stopping` = `start` → `seal`; `finishing` = `gate1` → `gate2`; `prechecks` = `precheck` → `estimate`; `reverting` = `abort` → `finish`; `staging` and `ready` = `round` (repeated); a phase entered by `AdvanceSelfServe` from the **job's own** progression starts at its first substep (`phase_step` set by the advance); a phase entered by **reconciliation** starts at the substep the record dictates (below); a restart resumes the substep recorded, never the phase's first write (`TestSubstepsResumeAfterEveryCrash`: a crash after consuming start and before issuing seal re-enters at `seal`; a crash with the estimate request outstanding re-enters at `estimate` and resumes it; the same for gate 1 → gate 2 and abort → finish). **Abandonment** is for **leaving a wait**, never for retaining it: when abort is requested, when an expiry whose action is **abort** fires, or when an operator transition supersedes the phase, a confirmed request whose wait is unsatisfied is `AbandonSelfServeRequest`ed before the abort or the reconciliation step issues its own request; an expiry whose action is page-and-retain (`opened`, `finishing`, `reverting`, `open-uncertain`) or warn-and-finish (`health`) abandons nothing and the wait continues (`TestPageOnlyExpiriesKeepTheWait`: the open request confirmed, `opened` missing at the deadline, the page sent, then the target reports opened and the nonce-bearing advance succeeds). By phase: `requested`/`reserving` resolve or fence an issued queue request before finalising or releasing; `queued`/`reports` abandon a superseded wait, a queued abort clears and finalises atomically; `staging`/`prechecks`/`ready` may abandon on cancel or aborting expiry; `restage`/`barrier`/`stopping`/`sealing`/`landing`/pre-open `landed` may abandon on aborting expiry after resolving the uncertain write; `open-uncertain` abandons nothing; a confirmed clearing write is consumed with the terminal outcome (`TestAbandonedRequestsNeverStrandAbort`: a confirmed stage request whose copy never reports, then cancel → the abort request issues; a confirmed precheck whose box died, then the deadline → abort issues). **Clearing requests**: `OfflineFinish`, `OfflineAbortAt` and the abort path's finish are confirmed from `LastMove.Request`; the finaliser's `FinishSelfServeMove` consumes that confirmed request in the same transaction as the outcome, so a crash between confirmation and finalisation resumes at the finaliser, not at a re-issue. |
| - **Reconciliation and recovery table** (the record is the truth): |
| | row phase | record | action | |
| @@ -186,7 +186,7 @@ Builds on plan 1 (`2026-10-22-self-serve-moves-1-lifetimes-and-order.md`, rev 13 |
| - `reports`: the `lane` (`OK`), the source `precheck` and the target `ready` with `Request == PrecheckAt`, each from the pinned participant; `targetReadyDecision` and `sourcePrecheckDecision` (the console enumerates the required path set and fact set itself: a missing entry or `!Known` → "could not determine <fact> on <label>"; not OK → the fact's sentence: "the target box already has a route for <host>", "the target box has timers for <host>", "the target box has a stale live link for <host> naming <build>", "the target box's programs file names <build>", "the target box already holds data for <host>: <path>", "the target box's park directory is not clean", "the target box has too little free disk for <host>" (`!Known` or `< 2 × replica`), "the target bucket already holds objects for <host>", "the target bucket holds a lock for <host> (<owner>)", "<host> has a stray entry beside its files directory: <path>", "<host>'s files cannot be archived: <detail>"; before staging both prefixes must be `Known` and empty); both pass → `selfServeApply(stage, OfflineQueuedToStaging)`, `StagingStartedAt = now`, → `staging`; 5 min → abort. |
| - `staging`: the stager report with `StagedRequest == row.StageRequest`: the ready rule `Rounds >= 2 && RoundCopiedBytes + RoundDeferredBytes < 16 MiB` → `prechecks`; else `selfServeApply(stage, OfflineRestage)` → a new wait; a `failed` report → abort with its `Detail`; a round past `max(10 min, 3 × est.Copy)` → abort; `now - StagingStartedAt > 30 min` or `Rounds >= 10` → `prechecks` from the last completed round. |
| - `prechecks`: `selfServeApply(precheck, OfflinePrecheck)`; both participants' reports answering it; the staged-ownership comparison (Task 6); `InstancesPrefix` known and empty; both pass → `ready`, `WindowDeadline = now + 24 h`, the estimate refined and `OfflineSetEstimate` (a later disagreement resolves towards the row); 5 min → abort. |
| - - `ready`: every 10 min a **maintenance restage** (request kind `maintain`: `selfServeApply(maintain, OfflineRestage)`, the matching `staged` report consumed by `ConsumeSelfServeRequest`; the row stays `ready`, `WindowDeadline` is **not** touched, no prechecks run); `WindowDeadline` → abort "the move was not confirmed in time"; **the cut handoff**: when `cut_requested_at` is set: an outstanding `maintain` request → it becomes the first cut round: its report is awaited (deadline `max(5 min, 2 × est.Copy)` from `cut_requested_at`; expiry → abort) and consumed by `AdvanceSelfServe(ready, restage, ..., nonce)`, after which `restage` issues nothing new and goes straight to `barrier`; no outstanding request → `AdvanceSelfServe(ready, restage, ..., "")` and `restage` issues its own round. The view shows `cutting` from `cut_requested_at`. |
| + - `ready`: every 10 min a **maintenance restage** (request kind `maintain`: `selfServeApply(maintain, OfflineRestage)`, the matching `staged` report consumed by `ConsumeSelfServeRequest`; the row stays `ready`, `WindowDeadline` is **not** touched, no prechecks run); `WindowDeadline` → abort "the move was not confirmed in time"; **the cut handoff**: when `cut_requested_at` is set: an outstanding `maintain` request → it becomes the first cut round: its report is awaited (deadline `max(5 min, 2 × est.Copy)` from `cut_requested_at`; expiry → abort) and consumed by `AdvanceSelfServe(ready, restage, ..., nonce)` **which sets `phase_step = adopted`**, after which `restage` issues nothing new and goes straight to `barrier`; no outstanding request → `AdvanceSelfServe(ready, restage, ..., "")` **which sets `phase_step = issue`** and `restage` issues its own round; the substep is written in the advancing transaction, so a crash after either advance resumes the continuation that was chosen (`TestCutHandoffSurvivesACrash`: a crash right after each branch and another during its recovery). The view shows `cutting` from `cut_requested_at`. |
| - The pre-offline abort (requested, reserving, queued, staging): **no row is finalised while a request is outstanding**: an outstanding request is resolved first (confirmed → the record carries the move, so this is not the no-move branch; unconfirmed → `fenceRecord`, classify the fenced observation, void if the receipt is absent); then no record move → the finaliser (`aborted`; `source_reopened_at = abort_requested_at`); queued → `selfServeApply(abort, OfflineAbortAt, )`; staging → `OfflineAbort` → the stager's `reverted` → `OfflineFinish`; then the finaliser. |
| - [ ] **Step 1: Write the failing tests** on the bridge of Task 10: `TestEveryBoundaryRecovers` (Review Focus 1: for every write, a crash before the write with the request persisted, a lost response, a crash before confirmation, a crash before the bump, a second crash during recovery, SQLite reopened each time; a fake store that **commits after the context was cancelled**: the replay sees the proposed stamp and confirms, no second write; one request per wait, one bump per landed write; ordinary multi-tick progression through start and flip); `TestReconcileForwardNeverRegresses` (every row of the table; `stopping` with no request issued yet and the record still `offline-staging` stays; `stopping(pending)` likewise; `landing` with no request yet and `offline-sealed` stays; health and finishing survive ticks at `offline-open`); `TestRequestsAreNeverReissuedWhileUnconsumed`; `TestStaleEvidenceNeverSatisfiesANewRequest` (an issued-but-unwritten restage: the previous round's report does not satisfy it; after the crash the replay lands the proposed stamp and only a report carrying it does); `TestAbandonedAdmissionIsFencedAndConditional` (a queue PUT committing after a negative re-read: the fence observes the move and the job continues as `queued`; a PUT that never lands: the fence succeeds, the row is voided durably before the release); `TestReplacedParticipantAtEveryGate`; `TestReservingWaitsThenAborts`; `TestEligibilityRechecksBeforeQueue`; `TestReportsDecideFromFacts`; `TestStagingReadyRule`; `TestPrechecksCompareTheBook`; `TestReadyRestagesAndExpires` (the maintenance restage keeps the row in `ready`, keeps `WindowDeadline`, never enters `restage`/`barrier`, and the cut still needs its door); `TestExpiredOpenIsNeverReplayed` (an open request persisted, the PUT never sent, a restart after the landed deadline: the record is fenced, the request voided, the move aborts; the same with the PUT committed before the crash → confirmed, the move proceeds as opened; **the PUT committing between the observation and the fence** → the fenced observation carries the receipt, the move proceeds as opened); `TestConfirmedRequestResumesAfterACrash` (start confirmed, crash before consume → the next tick resumes the wait, no re-issue, one bump); `TestSamePhaseSequencesConsume` (start then seal, gate 1 then gate 2, two staging rounds, the estimate after the precheck); `TestForeignRequestStopsTheCaller`; `TestNoOpMutationsStillConfirm` (an equal estimate, a repeated abort on a reverting record); `TestCutHandoffWithAnOutstandingMaintenanceRound` (cut requested while a maintain request is outstanding: its report becomes the first cut round; cut requested with none outstanding: restage issues; cancel after cut → 409); `TestBoundWritesNeverLandAfterAVoid` (another writer advances the record after a request was issued: the bound write fails, the request is voided, no later commit appears; a delete and recreate whose new record has the same sequence → refused on incarnation); `TestDeadlinesEvaluateBeforeEvidence`; `TestAbortBeforeOfflineIsLossless`; `TestQueueOrderAndDisjointProgress` (three rows: two on one box in order, a third on disjoint boxes advances while the second waits). |
| @@ -201,9 +201,9 @@ Builds on plan 1 (`2026-10-22-self-serve-moves-1-lifetimes-and-order.md`, rev 13 |
| - Test: `internal/e2e/selfserve/cut_test.go`, `internal/console/offlinereturn_test.go` |
| **Interfaces:** |
| -- Phases and deadlines (`est` the row's terms): `restage`: `selfServeApply(stage, OfflineRestage)`; the matching `staged`; `max(5 min, 2 × est.Copy)`; expiry → abort → `barrier`. `barrier`: `selfServeApply(precheck, OfflinePrecheck)`; both participants' reports passing the decisions and the book comparison with zero deferrals; `max(5 min, 2 × est.Copy)`; a failed fact or expiry → abort → `stopping`. `stopping`: `offlineRecordChecks` + `offlineRegionChecks(..., stage: false, requireIDs: true, "")` on the fresh record, then `selfServeApply(start, OfflineStartStaged, )`; then the seal check with participants → `selfServeApply(seal, OfflineSeal, )`; `max(5 min, 2 × est.Stop)`; expiry → abort. `sealing`: the sealer's `sealed`; `max(10 min, 3 × est.Copy)`; expiry → abort. `landing`: `offlineFlipCheck` → `selfServeApply(flip, OfflineFlip, )`; the pinned target's `landed`; `max(10 min, 3 × est.Land)`; expiry → abort. `landed`: `offlineOpenCheck` → write the open record (create-only, `OpenedAt = proposed`; `open_record_pending = 1` until it exists) → `selfServeApply(open, OfflineOpenTransition, )`; a refusal or `max(3 min, 2 × est.Open)` **while the record is `offline-landed`** → abort; an unconfirmable write (the record unreadable) → `open-uncertain`. `open-uncertain`: re-read each tick: `offline-open` → `opened`; `offline-landed` → `landed` (the deadline continues); 5 min unreadable → page, stay. `opened`: the target's `opened`; `max(3 min, 2 × est.Open)`; expiry → blocked: page, retry. `health`: a probe when `now - HealthLastProbeAt >= 30 s` (`probeTarget`: the target box's `EIP` from its edges file, TLS with the host as SNI and `Host`, `GET <ReadyPathOrDefault>?carlos-probe=<random>`, `Cache-Control: no-cache`, no redirects, 30 s; OK when 2xx and `x-carlos-version` equals the sealer report's `Release`; plan 3 adds `X-Carlos-Probe`/`X-Carlos-Served-By`); `RecordSelfServeHealth`; `HealthConsecutiveOK >= 2` → `finishing`; expiry `max(3 min, 2 × est.Promote) + 30 s` → `SetSelfServeWarning("the account did not answer on <region> within <n> minutes")`, page, `finishing`. `finishing`: gate 1 (`offlineFinishCheck` opened + every pinned source parked) → `selfServeApply(finish1, OfflineFinishingTransition)`, `FinishGate = lifted`; gate 2 (lifted + every pinned source gone) → `selfServeApply(finish, OfflineFinish, )`; 10 min each → blocked: page, retry. `reverting`: `OfflineAbort` once (or `OfflineAbortAt` from queued); `SourceReopenedAt` when (no tombstone, or the sealer's `reverting`/`reverted` with `TombstoneLifted`) **and** every pinned source's `reverted`; `AbortFinishedAt` when `offlineStepFor` at `offline-reverting` passes → `OfflineFinish`; **the target is never required**: a target that stopped reporting after landing does not block the source's reopening; the abort's `Detail` records "target <label> did not report; its staged copy is left for cleanup"; 10 min → blocked: page, retry. |
| +- Phases and deadlines (`est` the row's terms): `restage`: substep `issue` → `selfServeApply(stage, OfflineRestage)` then the matching `staged`; substep `adopted` → straight to `barrier`; `max(5 min, 2 × est.Copy)`; expiry → abort → `barrier`. `barrier`: `selfServeApply(precheck, OfflinePrecheck)`; both participants' reports passing the decisions and the book comparison with zero deferrals; `max(5 min, 2 × est.Copy)`; a failed fact or expiry → abort → `stopping`. `stopping`: `offlineRecordChecks` + `offlineRegionChecks(..., stage: false, requireIDs: true, "")` on the fresh record, then `selfServeApply(start, OfflineStartStaged, )`; then the seal check with participants → `selfServeApply(seal, OfflineSeal, )`; `max(5 min, 2 × est.Stop)`; expiry → abort. `sealing`: the sealer's `sealed`; `max(10 min, 3 × est.Copy)`; expiry → abort. `landing`: `offlineFlipCheck` → `selfServeApply(flip, OfflineFlip, )`; the pinned target's `landed`; `max(10 min, 3 × est.Land)`; expiry → abort. `landed`: `offlineOpenCheck` → write the open record (create-only, `OpenedAt = proposed`; `open_record_pending = 1` until it exists) → `selfServeApply(open, OfflineOpenTransition, )`; a refusal or `max(3 min, 2 × est.Open)` **while the record is `offline-landed`** → abort; an unconfirmable write (the record unreadable) → `open-uncertain`. `open-uncertain`: re-read each tick: `offline-open` → `opened`; `offline-landed` → `landed` (the deadline continues); 5 min unreadable → page, stay. `opened`: the target's `opened`; `max(3 min, 2 × est.Open)`; expiry → blocked: page, retry. `health`: a probe when `now - HealthLastProbeAt >= 30 s` (`probeTarget`: the target box's `EIP` from its edges file, TLS with the host as SNI and `Host`, `GET <ReadyPathOrDefault>?carlos-probe=<random>`, `Cache-Control: no-cache`, no redirects, 30 s; OK when 2xx and `x-carlos-version` equals the sealer report's `Release`; plan 3 adds `X-Carlos-Probe`/`X-Carlos-Served-By`); `RecordSelfServeHealth`; `HealthConsecutiveOK >= 2` → `finishing`; expiry `max(3 min, 2 × est.Promote) + 30 s` → `SetSelfServeWarning("the account did not answer on <region> within <n> minutes")`, page, `finishing`. `finishing`: gate 1 (`offlineFinishCheck` opened + every pinned source parked) → `selfServeApply(finish1, OfflineFinishingTransition)`, `FinishGate = lifted`; gate 2 (lifted + every pinned source gone) → `selfServeApply(finish, OfflineFinish, )`; 10 min each → blocked: page, retry. `reverting`: `OfflineAbort` once (or `OfflineAbortAt` from queued); `SourceReopenedAt` when (no tombstone, or the sealer's `reverting`/`reverted` with `TombstoneLifted`) **and** every pinned source's `reverted`; `AbortFinishedAt` when `offlineStepFor` at `offline-reverting` passes → `OfflineFinish`; **the target is never required**: a target that stopped reporting after landing does not block the source's reopening; the abort's `Detail` records "target <label> did not report; its staged copy is left for cleanup"; 10 min → blocked: page, retry. |
| - **The finaliser** `selfServeFinalise(ctx, t, row, outcome, reason, warning)`: (1) `FinishSelfServeMove` (outcome; `release_pending = 1`, `effects_done = 0`; consumes a confirmed clearing request and inserts the terminal event, one transaction); (2) the terminal effects: the timings (Task 9), the terminal event, `bumpSerialErr`; `SetSelfServeEffectsDone`; (3) `releaseBoxes(move, row.ID)`; (4) `ClearSelfServeRelease`. A crash between any two leaves the row in `OpenSelfServeMoves` and the next tick resumes at the first unfinished step. The operator doors that clear a self-serve move's record route through it. |
| -- **The operator return handshake (§7.5):** (1) `POST .../move/offline/return {"region", "return_of"}` (operator-only, `offlineGate`): the open record at `OpenRecordKey(host, return_of)` must exist with `To == rec.Region`, `From == region`, `Incarnation == rec.Incarnation`, and the record carries no move; else 409 "no completed move <id> from <region> to <rec.Region> for this instance"; writes `control/offline-moves/<host>/<return_of>/return/<requested_at unix nanos>-<console id>-<8 random hex>.json` `{"requested_at", "region", "console", "key"}` create-only (the **request key** is the request's identity; a new call makes a new request; the current request is the key that sorts **last** by `(requested_at, key)`; older ones are ignored) and answers 202 "return requested; the target box will report its leftovers". (2) The moves pass of every box in `region` lists `control/offline-moves/<host>/*/return/` for hosts whose open record names `From == its region` and, when the open record carries `Participants`, whose `Source` includes its own `BoxID` **and** (when pinned) its own `InstanceID` (an id-less forward keeps **`BoxID` membership**: the box must be a forward source participant by `BoxID`, only the instance comparison is dropped; the region rule applies solely to a forward **without** `Participants`); a box whose `BoxID` matches but whose `InstanceID` differs does nothing; it reads the newest request, fills `Leftovers` against the open record (`OpenedAt`, `Layout`, `MoveID`) and writes `control/offline-moves/<host>/<return_of>/reports/return-ready-<box id>-<request key>.json` **create-only** (an immutable report per request: `Op = return_of`, role `target`, phase `ready`, `Request = requested_at`, `RequestKey = <the request key>` (a new `OfflineReport` field), `BoxID/InstanceID`), without touching the record; a create-only conflict means this request was already answered; a newer request gets its own report; nothing is ever overwritten, so no ordering between writers matters. (3) The operator's `stage` (or `start`) door with `return_of`: `readReturnReport(ctx, host, returnOf)` reads the report keyed by the current request's key for the selected target box, which must exist, within 10 minutes, from a box whose `BoxID` **and `InstanceID`** match a forward source participant (or in `From` for an id-less forward) **and** equal the target `offlineSelect` chose for the return (the report authorises returning onto that box alone; a report from another forward source does not); the open record's `Incarnation` must equal the current record's **again here** and inside the guarded write (`OfflineStage`/`OfflineStart` with `returnOf` refuse with `ErrMoveConflict` "the instance was recreated since that move" when `rec.Incarnation != open.Incarnation`, the open record being passed to the mutation); then `targetReadyDecision` in return mode accepts **exactly**: `Lock` present with owner `moves.TombstoneOwner(return_of)` and lifted; `InstancesPrefix.Objects` (current versions, `lock.json` excluded) all with `LastModified < OpenedAt` (any newer → `NewerObjects`, refused); `DataPaths["/data/instances/<host>"]` absent or present-and-empty; for `Layout == nested` also `DataPaths["/data/.instances/<host>"]` absent or present-and-empty, and the mount view likewise; for `flat` the nested pair must be absent; park directories: each present one must be `<return_of>/source/` or `<return_of>/sealer/` (absence allowed: cleanup may have removed them; any other → refused); `LiveLink`/`ProgramsFile` naming the channel build; anything else → the ordinary refusal. Then `OfflineStage(..., returnOf)`/`OfflineStart(..., returnOf)` carry it on the record. `type moves.ReturnLeftovers struct { ForwardID string \`json:"forward_id"\`; LockOwner string \`json:"lock_owner"\`; LockLifted bool \`json:"lock_lifted"\`; ParkDirs []string \`json:"park_dirs"\`; EmptyNested []string \`json:"empty_nested"\`; NewerObjects []string \`json:"newer_objects,omitempty"\`; Layout string \`json:"layout"\` }`. |
| +- **The operator return handshake (§7.5):** (1) `POST .../move/offline/return {"region", "return_of"}` (operator-only, `offlineGate`): the open record at `OpenRecordKey(host, return_of)` must exist with `To == rec.Region`, `From == region`, `Incarnation == rec.Incarnation`, and the record carries no move; else 409 "no completed move <id> from <region> to <rec.Region> for this instance"; writes `control/offline-moves/<host>/<return_of>/return/<requested_at unix nanos>-<console id>-<8 random hex>.json` `{"requested_at", "region", "console", "key"}` create-only (the **request key** is the request's identity; a new call makes a new request; the current request is the key that sorts **last** by `(requested_at, key)`; older ones are ignored) and answers 202 "return requested; the target box will report its leftovers". (2) The moves pass of every box in `region` lists `control/offline-moves/<host>/*/return/` for hosts whose open record names `From == its region` and, when the open record carries `Participants`, whose `Source` includes its own `BoxID` **and** (when pinned) its own `InstanceID` (an id-less forward keeps **`BoxID` membership**: the box must be a forward source participant by `BoxID`, only the instance comparison is dropped; the region rule applies solely to a forward **without** `Participants`); a box whose `BoxID` matches but whose `InstanceID` differs does nothing; it reads the newest request, fills `Leftovers` against the open record (`OpenedAt`, `Layout`, `MoveID`) and writes `control/offline-moves/<host>/<return_of>/reports/return-ready-<box id>-<request key>.json` **create-only** (an immutable report per request: `Op = return_of`, role `target`, phase `ready`, `Request = requested_at`, `RequestKey = <the request key>` (a new `OfflineReport` field), `BoxID/InstanceID`), without touching the record; a create-only conflict means this request was already answered; a newer request gets its own report; nothing is ever overwritten, so no ordering between writers matters. (3) The operator's `stage` (or `start`) door with `return_of`: `readReturnReport(ctx, host, returnOf)` reads the report keyed by the current request's key for the selected target box, which must exist, within 10 minutes, from a box whose `BoxID` **and `InstanceID`** match a forward source participant (or, **only for a forward without `Participants`**, a box in `From`; with `Participants` the predicate is `participantMatches(p, report)`: `p.BoxID == report.BoxID && (p.InstanceID == "" || p.InstanceID == report.InstanceID)`, the same function discovery uses) **and** equal the target `offlineSelect` chose for the return (the report authorises returning onto that box alone; a report from another forward source does not); the open record's `Incarnation` must equal the current record's **again here** and inside the guarded write (`OfflineStage`/`OfflineStart` with `returnOf` refuse with `ErrMoveConflict` "the instance was recreated since that move" when `rec.Incarnation != open.Incarnation`, the open record being passed to the mutation); then `targetReadyDecision` in return mode accepts **exactly**: `Lock` present with owner `moves.TombstoneOwner(return_of)` and lifted; `InstancesPrefix.Objects` (current versions, `lock.json` excluded) all with `LastModified < OpenedAt` (any newer → `NewerObjects`, refused); `DataPaths["/data/instances/<host>"]` absent or present-and-empty; for `Layout == nested` also `DataPaths["/data/.instances/<host>"]` absent or present-and-empty, and the mount view likewise; for `flat` the nested pair must be absent; park directories: each present one must be `<return_of>/source/` or `<return_of>/sealer/` (absence allowed: cleanup may have removed them; any other → refused); `LiveLink`/`ProgramsFile` naming the channel build; anything else → the ordinary refusal. Then `OfflineStage(..., returnOf)`/`OfflineStart(..., returnOf)` carry it on the record. `type moves.ReturnLeftovers struct { ForwardID string \`json:"forward_id"\`; LockOwner string \`json:"lock_owner"\`; LockLifted bool \`json:"lock_lifted"\`; ParkDirs []string \`json:"park_dirs"\`; EmptyNested []string \`json:"empty_nested"\`; NewerObjects []string \`json:"newer_objects,omitempty"\`; Layout string \`json:"layout"\` }`. |
| - Paging: `alerting.Page` through `MovePageAttempt`/`SetMovePageAttempt` (seconds encoding, unchanged) with keys `selfserve:<id>:<condition>` every 10 minutes for: `opened` past its deadline; a health failure; `finishing`/`reverting` past 10 minutes; `open-uncertain` unreadable past 5 minutes; an open record still pending after 5 minutes; a reservation the reclaim rule cannot reclaim older than the grace period (the per-tick scan, also at start); a lane probe failing on a configured pair; the attempt is recorded **before** the page is sent, as the existing paging does. |
| - Copy rows: "the account did not answer on <region> within <n> minutes"; "the move was not started in time"; "the move was not confirmed in time"; "another move is in flight"; "box <label> was replaced"; "the move could not be started"; "the instance was recreated"; "target <label> did not report; its staged copy is left for cleanup"; "no completed move <id> from <region> to <rec.Region> for this instance"; "return requested; the target box will report its leftovers"; the fact refusals of Task 7. |
| @@ -230,7 +230,7 @@ Builds on plan 1 (`2026-10-22-self-serve-moves-1-lifetimes-and-order.md`, rev 13 |
| ### Task 10: The exported bridge and the end-to-end witnesses |
| **Files:** |
| -- Create: `internal/host/e2e_bridge.go` (**in package `host`**, `//go:build e2e`: `type E2E struct { ... }` with `func NewE2E(t testing.TB, store release.Store) *E2E`, `(*E2E).Pass(ctx)` (one moves pass on every box), `(*E2E).Serial(ctx)` (passes until the serial is consumed), `(*E2E).Clock() *fakeClock`, `(*E2E).Fault(point string, f func())` (the fault points the tests name), `(*E2E).Box(label) BoxHandle` exposing the box id, instance id, registry, data bucket and the worker's `armOffline`/`reconcileSerializedWith` through methods; it reaches `movesWorker`, `moveCfg`, `newMovesWorker`, `armOffline`, `reconcileSerializedWith` directly because it is in the package, so nothing private moves and no import cycle arises; the Linux-only fixtures stay behind `//go:build linux && e2e` with a stub that skips), The bridge and the fixtures it exports live in **one untagged file** `internal/host/e2e_bridge.go` (the worlds are portable: `movesoffline_test.go` uses them without a tag), containing the **complete transitive closure** of what the worlds call: `offWorld`/`offBox` and `restart`, `sealWorld`, `landWorld` and `arm`, `fakeWakeBackend`, `shipVersion`, `mustJSON`, the two-box store and registries, the fake clock and the pass driver, plus whatever `go vet ./internal/host/` reports missing once they move (the extraction is complete when `go vet` and `go test ./internal/host -run 'Offline|Seal|Land' -count=1` pass on linux and the cross-builds pass); the moved identifiers keep their names (exported wrappers `E2E`, `NewE2E` are added, not renamed); linux-only pieces that the closure reaches keep a `_linux.go` split with a `!linux` stub; the exported API is dead code in a production binary (stated and accepted); only the `internal/e2e/selfserve` test files carry `//go:build e2e`, `internal/console/testhooks.go` (`//go:build e2e`: `console.TestHooks{Tick func(now time.Time); Fault func(point string, f func())}`), `internal/e2e/selfserve/*_test.go` (`//go:build e2e`), `.amadan/test-gate.sh` (new steps `go vet -tags e2e ./internal/e2e/...` and `go test -tags e2e ./internal/e2e/...` after the ordinary suite, plus `go test -tags e2e -list . ./internal/e2e/selfserve | grep -q '^Test'` so an empty discovery fails the gate) |
| +- Create: `internal/host/e2e_bridge.go` (**in package `host`**, **untagged**: `type E2E struct { ... }` with `func NewE2E(t testing.TB, store release.Store) *E2E`, `(*E2E).Pass(ctx)` (one moves pass on every box), `(*E2E).Serial(ctx)` (passes until the serial is consumed), `(*E2E).Clock() *fakeClock`, `(*E2E).Fault(point string, f func())` (the fault points the tests name), `(*E2E).Box(label) BoxHandle` exposing the box id, instance id, registry, data bucket and the worker's `armOffline`/`reconcileSerializedWith` through methods; it reaches `movesWorker`, `moveCfg`, `newMovesWorker`, `armOffline`, `reconcileSerializedWith` directly because it is in the package, so nothing private moves and no import cycle arises; the Linux-only pieces the closure reaches keep a `_linux.go` split with a `!linux` stub), The bridge and the fixtures it exports live in **one untagged file** `internal/host/e2e_bridge.go` (the worlds are portable: `movesoffline_test.go` uses them without a tag), containing the **complete transitive closure** of what the worlds call: `offWorld`/`offBox` and `restart`, `sealWorld`, `landWorld` and `arm`, `fakeWakeBackend`, `shipVersion`, `mustJSON`, the two-box store and registries, the fake clock and the pass driver, plus whatever `go vet ./internal/host/` reports missing once they move (the extraction is complete when `go vet` and `go test ./internal/host -run 'Offline|Seal|Land' -count=1` pass on linux and the cross-builds pass); the moved identifiers keep their names (exported wrappers `E2E`, `NewE2E` are added, not renamed); linux-only pieces that the closure reaches keep a `_linux.go` split with a `!linux` stub; the exported API is dead code in a production binary (stated and accepted); only the `internal/e2e/selfserve` test files carry `//go:build e2e`, `internal/console/testhooks.go` (`//go:build e2e`: `console.TestHooks{Tick func(now time.Time); Fault func(point string, f func())}`), `internal/e2e/selfserve/*_test.go` (`//go:build e2e`), `.amadan/test-gate.sh` (new steps `go vet -tags e2e ./internal/e2e/...` and `go test -tags e2e ./internal/e2e/...` after the ordinary suite, plus `go test -tags e2e -list . ./internal/e2e/selfserve | grep -q '^Test'` so an empty discovery fails the gate) |
| - Test: the witnesses of Tasks 7 and 8, plus `TestSelfServeForwardMove`; `TestSelfServeCancelInReady`; `TestSelfServeAbortByFailedPrecheck`; `TestSelfServeAbortByStopDeadline`; `TestSelfServeAbortByLandingFailure`; `TestSelfServeAbortByOpenCheckRefusal`; `TestSelfServePostOpenFailureIsDoneWithAWarning`; `TestSelfServeCutNamingAStaleID`; `TestSelfServeRecreatedBetweenRowAndRecord`; `TestSelfServeTwoMovesDisjointAndQueued`; `TestSelfServeReservationReclaimOnlyOnEvidence`; `TestSelfServeOperatorDoorsUnchangedOnTheBridge`; `TestSelfServeThenOperatorReturn`; `TestClaimsOffInstanceIDIsPublished` (the agent's status tick carries `InstanceID` and `BoxID` on a claims-off box). |
| - [ ] **Step 1: Write the bridge and the tests.** **Step 2: Run them with `-tags e2e`; fix what they find within this plan's scope.** **Step 3: Both census tests and the cross-builds**; write `docs/superpowers/notes/census-proposal-self-serve-moves-2.md` (the overlay's loader block, the changed envelopes, the new writers incl. the return request, the open record, the console lease and `active.json`'s table form). **Step 4: Commit** `self-serve moves: an exported two-box bridge inside package host and the end-to-end witnesses, run by the gate`; push. |
| @@ -241,5 +241,5 @@ Builds on plan 1 (`2026-10-22-self-serve-moves-1-lifetimes-and-order.md`, rev 13 |
| - Spec coverage: §5 (T1), §6.1 (T5), §6.2 (T7), §6.3 (T9, T5, T6), §7 admission and recovery (T7's table), §7.1 (T3), §7.2 and the three facts with the sealer's durable lift (T6, T8), §7.3 (T6, T7, T8's barrier), §7.4 without the probe mode (T8), §7.5 the no-return boundary and the operator return (T2's open record, T8), §7.7 (T5), §8 pages, log and member stream (T8, T9), §9 (T3's rollout). Deferred: §6.4 holding page and the probe headers (plan 3); §7.6 cleanup (plan 4), whose status contract the reclaim rule names (`RetirementsComplete`, a terminal state, `RootRequest == ""`, `ReleasePending == false`, `Metrics.BoxID`). |
| - Dependencies for plan 3: `SelfServeMove{DisplayName, OfflineAt, EstimateSeconds}`, `Participants.Target.BoxID`, `moveCfg.BoxID`, `probeTarget`; for plan 4: the status `Retirements` contract and the open record. |
| -- Names used across tasks: `selfServeGate`, `instanceRails(w, r, acct, noun, c)`, `moveCapable`, `Principal.Moves/TokenID`, `selfServeMode`, `selfServeAdmits`, `recordEligibility`, `offlineRecordChecks`, `offlineRegionChecks`, `offlineSelection`, `OfflineQueued`, `OfflineQueue`, `OfflineQueuedToStaging`, `OfflinePrecheck`, `OfflineSetEstimate`, `OfflineAbortAt`, `provision.SelfServeMove`, `Participant{BoxID, Label, InstanceID, Verified}`, `Participants`, `moves.OpenRecord{..., Layout}`, `OpenRecordKey`, `moves.ParticipantRole`, `moves.ParticipantStillPresent`, `moves.OfflineReservation`, `reserveBoxes`, `releaseBoxes`, `selfServeTick`, `selfServeStep`, `selfServeApply`, `request`, `persistedRequest`, `provision.Receipt`, `provision.Expect`, `ConsumeSelfServeRequest(id, nonce, nextStep)`, `AbandonSelfServeRequest`, `phase_step`, `errRequestRefused`, `MarkSelfServeCut`/`cut_requested_at`, `errRequestForeign`, `OfflineReport.RequestKey`, `DiskFreeBytes`, `OfflineReservation.ExpectIncarnation`, `SelfServeMove.LastRequest`, `LastMove.Request`, `provision.SetRecordMoveAt`, `OfflineReservation.ExpectSeq`, `moves.FailedDetail`, `OfflineReport.Layout`, `errRequestVoided`, `selfServeFinalise`, `leaseToken`, `provision.WithWriteGuard`, `IssueSelfServeRequest`, `ConfirmSelfServeRequest`, `VoidSelfServeRequest`, `request_voided`, `AdvanceSelfServe(..., nonce)`, `SetSelfServeExpiry`, `SetSelfServeNotifiedSeq`, `SetSelfServeOpenRecordPending`, `InsertSelfServeEventTx`, `DeliverSelfServeEvent`, `selfServeMoveView`, `selfServeAbortView`, `selfServeLast`, `moves.Fact`, `PrefixFacts`, `PrefixObject`, `StagedObject{Size, ETag, VersionID, Deferred}`, `LaneReport`, `TargetReadyReport`, `SourcePrecheck{..., Layout}`, `StrayEntry`, `StraysFact`, `ReturnLeftovers`, `ValidateOfflineReportFor`, `readOfflineEvidence(ctx, host, id, m)`, `readReturnReport`, `lease.CopyEvent`, `lease.MirrorPrefixKeepObserved`, `stageBook`, `status.HostFacts`, `BoxMetrics.Hosts/Lanes/BoxID/InstanceID`, `measureFiles`, `targetReadyDecision`, `sourcePrecheckDecision`, `probeTarget`, `estimateTerms`, `MarkSelfServeTiming`, `SelfServeEvent`, `host.E2E`/`NewE2E`, `console.TestHooks`. |
| +- Names used across tasks: `selfServeGate`, `instanceRails(w, r, acct, noun, c)`, `moveCapable`, `Principal.Moves/TokenID`, `selfServeMode`, `selfServeAdmits`, `recordEligibility`, `offlineRecordChecks`, `offlineRegionChecks`, `offlineSelection`, `OfflineQueued`, `OfflineQueue`, `OfflineQueuedToStaging`, `OfflinePrecheck`, `OfflineSetEstimate`, `OfflineAbortAt`, `provision.SelfServeMove`, `Participant{BoxID, Label, InstanceID, Verified}`, `Participants`, `moves.OpenRecord{..., Layout}`, `OpenRecordKey`, `moves.ParticipantRole`, `moves.ParticipantStillPresent`, `moves.OfflineReservation`, `reserveBoxes`, `releaseBoxes`, `selfServeTick`, `selfServeStep`, `selfServeApply`, `request`, `persistedRequest`, `provision.Receipt`, `provision.Expect`, `ConsumeSelfServeRequest(id, nonce, nextStep)`, `AbandonSelfServeRequest`, `phase_step` (`adopted`/`issue` in `restage`), `participantMatches`, `SetSelfServeExpiry(id, phase, kind, sawDeadline, pending)`, `errRequestRefused`, `MarkSelfServeCut`/`cut_requested_at`, `errRequestForeign`, `OfflineReport.RequestKey`, `DiskFreeBytes`, `OfflineReservation.ExpectIncarnation`, `SelfServeMove.LastRequest`, `LastMove.Request`, `provision.SetRecordMoveAt`, `OfflineReservation.ExpectSeq`, `moves.FailedDetail`, `OfflineReport.Layout`, `errRequestVoided`, `selfServeFinalise`, `leaseToken`, `provision.WithWriteGuard`, `IssueSelfServeRequest`, `ConfirmSelfServeRequest`, `VoidSelfServeRequest`, `request_voided`, `AdvanceSelfServe(..., nonce)`, `SetSelfServeExpiry`, `SetSelfServeNotifiedSeq`, `SetSelfServeOpenRecordPending`, `InsertSelfServeEventTx`, `DeliverSelfServeEvent`, `selfServeMoveView`, `selfServeAbortView`, `selfServeLast`, `moves.Fact`, `PrefixFacts`, `PrefixObject`, `StagedObject{Size, ETag, VersionID, Deferred}`, `LaneReport`, `TargetReadyReport`, `SourcePrecheck{..., Layout}`, `StrayEntry`, `StraysFact`, `ReturnLeftovers`, `ValidateOfflineReportFor`, `readOfflineEvidence(ctx, host, id, m)`, `readReturnReport`, `lease.CopyEvent`, `lease.MirrorPrefixKeepObserved`, `stageBook`, `status.HostFacts`, `BoxMetrics.Hosts/Lanes/BoxID/InstanceID`, `measureFiles`, `targetReadyDecision`, `sourcePrecheckDecision`, `probeTarget`, `estimateTerms`, `MarkSelfServeTiming`, `SelfServeEvent`, `host.E2E`/`NewE2E`, `console.TestHooks`. |
| - Review Focus 1 to 5 are pinned by T7, T3, T8, T5, T1. |