carlos / platform Public

console: the fact set names the raw nested directory through internal/layout (TestRawInstancesDirectoryIsNamedOnlyHere); census re-pinned in place

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

claude 1 day ago 4925757526f56e57c622f9167d7cab5878072c63 parent 07f4d4c

3 files changed, +11 −6

internal/console/selfserve_checks.go +2 −1
internal/provision/plan14_root_reads_test.go +5 −2
internal/provision/testdata/plan14-root-reads-self-serve-moves-2.tsv +4 −3

diff --git a/internal/console/selfserve_checks.go b/internal/console/selfserve_checks.go

index 154ece8c3..41bf3fc02 100644

--- a/internal/console/selfserve_checks.go

+++ b/internal/console/selfserve_checks.go

@@ -13,6 +13,7 @@ import (

"sort"

"strings"

+ datalayout "github.com/carlosframework/platform/internal/layout"

"github.com/carlosframework/platform/internal/moves"

"github.com/carlosframework/platform/internal/provision"

)

@@ -120,7 +121,7 @@ func targetDataPaths(host string, reported map[string]moves.Fact) []string {

}

return []string{

provision.InstanceDir(dd, host),

- filepath.Join(dd, ".instances", provision.InstanceID(host)),

+ datalayout.RawInstanceDir(dd, host),

filepath.Join(dd, host),

filepath.Join(dd, host+".env"),

filepath.Join(dd, host+".config.env"),

diff --git a/internal/provision/plan14_root_reads_test.go b/internal/provision/plan14_root_reads_test.go

index 8a8262d4f..06ad5df50 100644

--- a/internal/provision/plan14_root_reads_test.go

+++ b/internal/provision/plan14_root_reads_test.go

@@ -1337,8 +1337,11 @@ func TestPlan14RootReadCensus(t *testing.T) {

// issueSelfServeRequest, which gains the round's deadline), which moves

// it once more. Its fix round 1 re-pins offlineClaimEvidence and

// participantIdentityFor in place (their unreadable refusals are built

- // transient), which moves it again.

- seal = "08d7a469489fb430c28e89770e8a0ca1425230534f1c17b7f67532657442e05e"

+ // transient), which moves it again. A fix on Task 8's branch re-pins

+ // targetDataPaths in place (the raw nested directory named through

+ // internal/layout's RawInstanceDir, TestRawInstancesDirectoryIsNamedOnlyHere),

+ // which moves it again.

+ seal = "a93ef0c9850cb7b9485ba01c108d2d2bbb0a83e66961b8b0e689d34ed5b182cb"

errs := append(compareRootReads(got, inv), checkRootReadLegacy(inv, seal)...)

errs = append(errs, checkRootReadDeclarations(got, inv)...)

if len(errs) > 0 {

diff --git a/internal/provision/testdata/plan14-root-reads-self-serve-moves-2.tsv b/internal/provision/testdata/plan14-root-reads-self-serve-moves-2.tsv

index 5a807e1e0..4cbc91bc0 100644

--- a/internal/provision/testdata/plan14-root-reads-self-serve-moves-2.tsv

+++ b/internal/provision/testdata/plan14-root-reads-self-serve-moves-2.tsv

@@ -23,7 +23,7 @@ internal/console/templates/settings.html external legacy accepted-legacy accepte

internal/provision/offline_move.go offlineBegin legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=root-input (J4, as OfflineStart); the console (cmd/console serve under console.service, user carlos-console): self-serve moves 1 Task 7's body (OfflineStart's, the state a parameter; a direct start advances move_seq and stamps move.seq, refusing ErrLifetimeExhausted at MaxInt64 before any write), and it now also creates the self-serve move in offline-queued for OfflineQueue (queued_at, staged_at and precheck_at at the caller's stamp, move.seq set to the record's move_seq, no advance) and records return_of; a stage and a queue hold nothing; its one site is still rec.ActiveRun.Open(), a method on the record's run state (RunState.Open), not a file read; self-serve moves 2 Task 2 file:Open@208 0a9b432ddf2f39a977c0651e377258b35c1d05635e9979583eeac6253d6c0ec8

@coverage internal/provision 42588b9f64803b41c4463efb31e69fda0fc66573efd5d6a2d6e709682eeca385

# Task 3 (per-box reservations with a legacy projection and a sentinel, the fenced reclaim and the operator doors' bound admission), rev3=PROPOSED-self-serve-moves-2: no root read, class or task is added and no accepted-legacy unit is re-pinned, so the seal does not move. The new units (moves.ParseOfflineActive, moves.OfflineActiveBody, the console's offlinereserve.go, the doors' offlineApplyBound and offlineAdvanceBound) read no file: their reads are the bucket's control/offline-moves/active.json and the instance record through the judged readers and fenceRecord. Envelopes re-pinned in place (Task 2's rows replaced): internal/console (offlinereserve.go, the start and stage doors, the Server's two evidence fields) and internal/moves (the reservation table in offline.go).

-@coverage internal/console fff7fd19c43a8f49c9b173f1a0d54054be9506a5126c8b10b80f2ec47a1f4460

+@coverage internal/console 1faf074150c207d1ee81ae9e8f18fa73a72ae944f7a47f48f69c6fb9c957df29

@coverage internal/moves 6a68b01ef865d9356bb19971f4cd4a61f7694769b63cee1d8234f615d5e9c8ba

# Task 4 (the journal, the events table, the console lease and the pass skeleton), rev3=PROPOSED-self-serve-moves-2: no root read, class or task is added. The console SQLite journal (selfserve_store.go) adds twenty-two units, each frozen accepted-legacy with a reviewed basis (console SQL as carlos-console, no bucket or root action), and the lease's console name adds one crypto/rand read (Server.selfServeConsoleID); serve (in place: the paging arm takes the store, the pass is started), NewServer (the row evidence and the recovery-mode scan) and Store.migrate (migrateSelfServe) are re-pinned. The seal moves. The lease and the pass read control/offline-moves/console.json and active.json from the bucket, not a file. Envelopes re-pinned in place: cmd/console, internal/console and internal/provision (WithWriteGuard in WriteRecord).

@legacy a8dd51a494ab3cd2ad371ded2850b6d78492569729527ea82cd8dd0f2b418a78 internal/console/selfserve_lease.go Server.selfServeConsoleID legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: reads crypto/rand once per process for the random console name the self-serve moves lease carries; randomness grants no root authority file:Read@110 3303b18ec5c77ccaf662064801f94276bfe947c31378cc1ecb8c4fe509d5d4d1

@@ -172,8 +172,8 @@ internal/console/selfserve_estimate.go var estimateDefaults legacy accepted-lega

# Task 7 (the job from requested to ready and its reconciliation), rev3=PROPOSED-self-serve-moves-2: no root read, class or task is added. Nine accepted-legacy units are added: the request nonce's crypto/rand read (newRequestNonce), the fact set's data-path literal (targetDataPaths), the phase deadlines (selfServePhaseDeadline, whose matched Open is the estimate's open term) and six console SQLite units of the journal (AbortSelfServe, AdvanceSelfServeToStep, ConsumeSelfServeMaintenance, ExpireSelfServeRequest, VoidExpiredSelfServeRequest and issueSelfServeRequest). AdvanceSelfServe and IssueSelfServeRequest stay declared with no direct read (their statements moved into AdvanceSelfServeToStep and issueSelfServeRequest; both changed: the advance also stamps staging_started_at and next_maintenance_at, and the issue gains a variant that sets the round's step deadline), so their rows are removed under a proposed H3 disposition. The internal/console envelope is re-pinned in place. The job's record reads go through observeRecord and fenceRecord, judged; its record writes are SetRecordMoveAt (the write census).

@legacy ef59e56ac62104a8e88ee2f25c3507da162d60bcea0517512afa8a0cb30a0711 internal/console/selfserve_apply.go newRequestNonce legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: reads crypto/rand for one self-serve request's random nonce, the receipt the job's record write carries; randomness grants no root authority file:Read@71 bfb07e7090b5d440e80a75ce46953b498406bde7d3c193a1292c9cd0dd8af2b0

internal/console/selfserve_apply.go newRequestNonce legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: reads crypto/rand for one self-serve request's random nonce, the receipt the job's record write carries; randomness grants no root authority file:Read@71 bfb07e7090b5d440e80a75ce46953b498406bde7d3c193a1292c9cd0dd8af2b0

-@legacy faff40689f2db1c15244128406ef4d56ca66901a66d297e1b374509fd3c72688 internal/console/selfserve_checks.go targetDataPaths legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: names the instance's data paths under the data directory a target box's ready report uses (/data when the report names none), the fact set the job requires; reads no file and grants nothing data-literal@84 f5e99416bb54a684961d961f97bd0409ea1dbe7550c1c619073c939b7b933e33

-internal/console/selfserve_checks.go targetDataPaths legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: names the instance's data paths under the data directory a target box's ready report uses (/data when the report names none), the fact set the job requires; reads no file and grants nothing data-literal@84 f5e99416bb54a684961d961f97bd0409ea1dbe7550c1c619073c939b7b933e33

+@legacy dca7be95e740533c0c734911a34b5f4610f132ce9fce18e329504a8da8a1dc59 internal/console/selfserve_checks.go targetDataPaths legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: names the instance's data paths under the data directory a target box's ready report uses (/data when the report names none), the fact set the job requires; reads no file and grants nothing (self-serve moves 2: the raw nested directory is named through internal/layout's RawInstanceDir) data-literal@84 71d187d02044fc424ce3e0022dfe9c3ce57315912de5f55053adab316d5fd577

+internal/console/selfserve_checks.go targetDataPaths legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: names the instance's data paths under the data directory a target box's ready report uses (/data when the report names none), the fact set the job requires; reads no file and grants nothing (self-serve moves 2: the raw nested directory is named through internal/layout's RawInstanceDir) data-literal@84 71d187d02044fc424ce3e0022dfe9c3ce57315912de5f55053adab316d5fd577

@legacy 3e7ecd729f078de5257e5e19082a91c34057267018b7e58abba3940332cdf896 internal/console/selfserve_job.go selfServePhaseDeadline legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: computes a phase's step deadline from the row's estimate terms (the matched Open is est.Open, the open term, a duration); reads no file file:Open@709 defa48814bd678c1ededf52d12176d2ddddc8a9096f91f1fb94153a6f76146f6

internal/console/selfserve_job.go selfServePhaseDeadline legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: computes a phase's step deadline from the row's estimate terms (the matched Open is est.Open, the open term, a duration); reads no file file:Open@709 defa48814bd678c1ededf52d12176d2ddddc8a9096f91f1fb94153a6f76146f6

@legacy 9f0761052e7df8711c17427d8d66fde2ae6a36592d59c11ce95963e774202cdf internal/console/selfserve_store.go Store.AbortSelfServe legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: records the job's own abort decision on one open self-serve row (abort_requested_at, outcome_reason, reason), predicated on no outcome and no abort yet; no bucket or root action file:Exec@207 165d536f9be74472c8f01e9a50b7a97d793c8f5731db091695202fe8eeaa8aeb

@@ -191,3 +191,4 @@ internal/console/selfserve_store.go Store.issueSelfServeRequest legacy accepted-

@removed internal/console/selfserve_store.go Store.AdvanceSelfServe H3 census-ruling-PROPOSED-self-serve-moves-2;rev3=PROPOSED-self-serve-moves-2;basis=remains declared but has no direct read; its statement moved to AdvanceSelfServeToStep, classified below, which AdvanceSelfServe calls with the phase's first substep, and which also stamps staging_started_at entering staging and next_maintenance_at entering ready in the same statement (a changed behaviour of AdvanceSelfServe); proposed removal only

@removed internal/console/selfserve_store.go Store.IssueSelfServeRequest H3 census-ruling-PROPOSED-self-serve-moves-2;rev3=PROPOSED-self-serve-moves-2;basis=remains declared but has no direct read; its statement moved to issueSelfServeRequest, classified below, which IssueSelfServeRequest calls (its UPDATE as before) and IssueSelfServeRequestWithDeadline calls with the round's step deadline set in the same statement; proposed removal only

# Task 7 fix round 1, rev3=PROPOSED-self-serve-moves-2: offlineClaimEvidence and participantIdentityFor are re-pinned in place (their unreadable refusals are built transient, a typed field of offlineRefusal; the doors' answers are unchanged), read sites unchanged, offsets moved; the internal/console envelope is re-pinned in place. The two Task 7 removals' bases now say how the moved statements changed.

+# Task 8 also fixed, rev3=PROPOSED-self-serve-moves-2: targetDataPaths names the raw nested directory through internal/layout (layout.RawInstanceDir, the same path), so internal/layout's TestRawInstancesDirectoryIsNamedOnlyHere holds; the row and its frozen declaration are re-pinned in place, the internal/console envelope is re-pinned in place.