carlos / platform Public

provision: census rows for Task 5 (PROPOSED-self-serve-moves-2)

Six new accepted-legacy console units that read no file (the roster read
for identity checks, the estimate's query, a method and a field named
Open); the poll door and offlineClaimEvidence re-pinned in new rows,
AdmitSelfServeMove and RequestSelfServeAbort in place; the internal/console
envelope re-pinned; the seal moves. The note gains a Task 5 paragraph.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

claude 2 days ago 4c4ba15564faaa89d9dc5afa742a8e18282b67b4 parent b47c371

3 files changed, +30 −7

docs/superpowers/notes/census-proposal-self-serve-moves-2.md +2 −0
internal/provision/plan14_root_reads_test.go +6 −2
internal/provision/testdata/plan14-root-reads-self-serve-moves-2.tsv +22 −5

diff --git a/docs/superpowers/notes/census-proposal-self-serve-moves-2.md b/docs/superpowers/notes/census-proposal-self-serve-moves-2.md

index 094880e09..a2f92c842 100644

--- a/docs/superpowers/notes/census-proposal-self-serve-moves-2.md

+++ b/docs/superpowers/notes/census-proposal-self-serve-moves-2.md

@@ -23,3 +23,5 @@ Task 10a (the exported end-to-end bridge) moves the offline move tests' two-box

In the record-write inventory Task 10a adds six units of `e2e_bridge.go`, none raw. `offWorld.create` and `offWorld.createAt` are record-writers (`key:CreateRecord`, create-only, the fixture's one instance record; `createLifetime` writes the host's incarnation slot through `WriteHostIncarnation` first and then calls `createAt`). `newTwoBoxWorld` is nonrecord (`sel:Put`): its only direct write is the account manifest, create-only when absent. `landWorld.bundle` is nonrecord (`sel:PutReplace`): the app's config bundle under `appconfig.Key`. `sealWorld.arm` is testsupport (`sel:Put`): its carry stand-in writes `build-state.json` into the loopback fake data bucket's model, not the deployment store. `const sealPrefix` is a reference (`lit:instances`): the data buckets' hibernate prefix, never a record key. Since fix round 1 it is its own declaration, so the census names it stably rather than by its position among the file's const blocks. The bridge reads no instance record, so `TestNoUnjudgedRecordReads` has nothing new to judge.

Task 10a fix round 1 adds two test seams to the agent's own code and re-pins three root-read rows. `statusTick` becomes `statusTickAt` at the wall clock, so the bridge can stamp a box snapshot at its own clock. `statusTick` stays declared with no direct read. Its row is removed under a proposed H3 disposition (`census-ruling-PROPOSED-self-serve-moves-2`, as plan 1 removed `CreateAppInRegion`'s). `statusTickAt` carries the body with its read sites unchanged, frozen accepted-legacy. `E2E.status` is re-pinned in place because it now calls `statusTickAt`. The stager's new `"round-start"` call of `moveCfg.stageFault` (nil in production) adds no read or write site. The seal moves to `4cccf647…`, and the internal/host envelope is refreshed in place. In the record-write inventory `const#1` becomes `const sealPrefix`, with the same class and kinds and a new digest.

+Task 5 (record eligibility, the split start validation, participant pinning, the self-serve door bodies and the view) adds no root read class or task. Six console units are new, each frozen accepted-legacy with a reviewed basis, and none reads a file; the scanner names them for sites that only look like reads. `Server.participantIdentityFor` reads the signed host roster (`hostactors.Directory.Read`: `control/host-actors.json` in the deployment bucket, verified under the release key) so a self-serve participant's identity record is checked against it; an absent roster is no entries, any other failure refuses. `Server.selfServeEstimate` reads the request's URL query. `selfServeBusy`'s one site is `rec.ActiveRun.Open()`, a method of the record already read, as `offlineBegin`'s is. `Server.estimate`, `type estimateTerms` and `var estimateDefaults` are the estimate's arithmetic and its terms: their sites are the `Open` term, a struct field named `Open` (Task 9's shape). Four units are re-pinned: `Server.handleAPIInstanceMoveStatus` (with Phase 1 off on a claims-off console the poll joins the instance's self-serve rows from the console SQLite store and answers `?estimate=1` while the switch admits; its sites are unchanged in kind) and `Server.offlineClaimEvidence` (the census-ruling-moves-offline body unchanged, its inputs passed as account, app, host and record) in new Task 5 rows; `Store.AdmitSelfServeMove` (the row also stores the estimate) and `Store.RequestSelfServeAbort` (its predicate also requires `cut_requested_at = 0`) in place in their Task 4 rows. The door's other new reads are bucket objects read with the console's deployment credentials, which the scanner names no site for: the boxes' status reports (`status/boxes/<label>.json`, through `readOfflineFleet`, now with each report's time for pinning) and the boxes' identity records (`boxid.Load`, `control/boxes/<box id>.json`, keyed by the edges file's box id and never the label). The operator doors pin an instance id from a current status report and read no identity record. The seal moves to `6f975f90…`, and the internal/console envelope is re-pinned in place. In the record-write inventory nothing is added or changed: the request door's one write is the console SQLite row (`AdmitSelfServeMove`), the cut and cancel doors' are `MarkSelfServeCut` and `RequestSelfServeAbort`, and the record's queue write is the job's (Task 7). The operator start and stage doors' record writes are unchanged (`offlineBegin`, `offlineAdvanceBound`). Paul's ruling is still outstanding.

diff --git a/internal/provision/plan14_root_reads_test.go b/internal/provision/plan14_root_reads_test.go

index 625e1cc22..b42977095 100644

--- a/internal/provision/plan14_root_reads_test.go

+++ b/internal/provision/plan14_root_reads_test.go

@@ -1322,8 +1322,12 @@ func TestPlan14RootReadCensus(t *testing.T) {

// tests' world moved out of their _test.go files, tests only, which moves

// it once more. Its fix round 1 re-pins E2E.status in place and adds

// statusTickAt (statusTick's body, its row removed under a proposed H3

- // disposition), which moves it again.

- seal = "4cccf647b75b46597998c443bcff351aa24fd4e4b0c7f82e98946ebe430890d7"

+ // disposition), which moves it again. Task 5 (record eligibility, the

+ // split start validation, participant pinning and the door bodies)

+ // adds six accepted-legacy console units that read no file and

+ // re-pins four (the poll door, offlineClaimEvidence and two journal

+ // methods), which moves it once more.

+ seal = "6f975f90eccdfb2d05fd383caf38ee5f00bbc982a12f34b2626142f8f58c3cf8"

errs := append(compareRootReads(got, inv), checkRootReadLegacy(inv, seal)...)

errs = append(errs, checkRootReadDeclarations(got, inv)...)

if len(errs) > 0 {

diff --git a/internal/provision/testdata/plan14-root-reads-self-serve-moves-2.tsv b/internal/provision/testdata/plan14-root-reads-self-serve-moves-2.tsv

index 08aea55e3..e602d4b42 100644

--- a/internal/provision/testdata/plan14-root-reads-self-serve-moves-2.tsv

+++ b/internal/provision/testdata/plan14-root-reads-self-serve-moves-2.tsv

@@ -23,7 +23,7 @@ internal/console/templates/settings.html external legacy accepted-legacy accepte

internal/provision/offline_move.go offlineBegin legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=root-input (J4, as OfflineStart); the console (cmd/console serve under console.service, user carlos-console): self-serve moves 1 Task 7's body (OfflineStart's, the state a parameter; a direct start advances move_seq and stamps move.seq, refusing ErrLifetimeExhausted at MaxInt64 before any write), and it now also creates the self-serve move in offline-queued for OfflineQueue (queued_at, staged_at and precheck_at at the caller's stamp, move.seq set to the record's move_seq, no advance) and records return_of; a stage and a queue hold nothing; its one site is still rec.ActiveRun.Open(), a method on the record's run state (RunState.Open), not a file read; self-serve moves 2 Task 2 file:Open@208 0a9b432ddf2f39a977c0651e377258b35c1d05635e9979583eeac6253d6c0ec8

@coverage internal/provision 42588b9f64803b41c4463efb31e69fda0fc66573efd5d6a2d6e709682eeca385

# Task 3 (per-box reservations with a legacy projection and a sentinel, the fenced reclaim and the operator doors' bound admission), rev3=PROPOSED-self-serve-moves-2: no root read, class or task is added and no accepted-legacy unit is re-pinned, so the seal does not move. The new units (moves.ParseOfflineActive, moves.OfflineActiveBody, the console's offlinereserve.go, the doors' offlineApplyBound and offlineAdvanceBound) read no file: their reads are the bucket's control/offline-moves/active.json and the instance record through the judged readers and fenceRecord. Envelopes re-pinned in place (Task 2's rows replaced): internal/console (offlinereserve.go, the start and stage doors, the Server's two evidence fields) and internal/moves (the reservation table in offline.go).

-@coverage internal/console 1f822bfe7af0fb43574bb50053474a3ef533f693cef7210434e1766c2c97ec06

+@coverage internal/console 13634a4f70f926d2a4040f0d66401a85438f782a6e6ef7408a27b5d47b476adc

@coverage internal/moves 6a68b01ef865d9356bb19971f4cd4a61f7694769b63cee1d8234f615d5e9c8ba

# Task 4 (the journal, the events table, the console lease and the pass skeleton), rev3=PROPOSED-self-serve-moves-2: no root read, class or task is added. The console SQLite journal (selfserve_store.go) adds twenty-two units, each frozen accepted-legacy with a reviewed basis (console SQL as carlos-console, no bucket or root action), and the lease's console name adds one crypto/rand read (Server.selfServeConsoleID); serve (in place: the paging arm takes the store, the pass is started), NewServer (the row evidence and the recovery-mode scan) and Store.migrate (migrateSelfServe) are re-pinned. The seal moves. The lease and the pass read control/offline-moves/console.json and active.json from the bucket, not a file. Envelopes re-pinned in place: cmd/console, internal/console and internal/provision (WithWriteGuard in WriteRecord).

@legacy a8dd51a494ab3cd2ad371ded2850b6d78492569729527ea82cd8dd0f2b418a78 internal/console/selfserve_lease.go Server.selfServeConsoleID legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: reads crypto/rand once per process for the random console name the self-serve moves lease carries; randomness grants no root authority file:Read@110 3303b18ec5c77ccaf662064801f94276bfe947c31378cc1ecb8c4fe509d5d4d1

@@ -32,8 +32,8 @@ internal/console/selfserve_lease.go Server.selfServeConsoleID legacy accepted-le

internal/console/selfserve_store.go InsertSelfServeEventTx legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: allocates a self-serve row's next event seq and inserts the event inside the caller's SQLite transaction; no bucket or root action file:Exec@473,file:Exec@79,file:QueryRow@295 7a4026a7b9c7d66811f3cdd8524e626d75943685dc01ea620344b1beb32a4b0a

@legacy 5609b7244aff708a4bf14eaa46171a863287670f4f268763d026c7b2b73b1c22 internal/console/selfserve_store.go Store.AbandonSelfServeRequest legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: abandons a confirmed self-serve request with the next deadline, predicated on its nonce; no bucket or root action file:Exec@112 457a13c673d462a5a9f448156d5018b60272cfaec5eb00304171369695635c94

internal/console/selfserve_store.go Store.AbandonSelfServeRequest legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: abandons a confirmed self-serve request with the next deadline, predicated on its nonce; no bucket or root action file:Exec@112 457a13c673d462a5a9f448156d5018b60272cfaec5eb00304171369695635c94

-@legacy d11a9d367edfc25b752df39e2f77721789134ecf156e6eb1c210323d818318c6 internal/console/selfserve_store.go Store.AdmitSelfServeMove legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: inserts one self-serve move row and its first phase event in one SQLite transaction, or reads the instance's open row back; no bucket or root action file:Exec@808,file:QueryRow@1501 b7efbed05c6a80a85258a561188c9a112d6ce2f3a5a0fca0463adc0d36221845

-internal/console/selfserve_store.go Store.AdmitSelfServeMove legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: inserts one self-serve move row and its first phase event in one SQLite transaction, or reads the instance's open row back; no bucket or root action file:Exec@808,file:QueryRow@1501 b7efbed05c6a80a85258a561188c9a112d6ce2f3a5a0fca0463adc0d36221845

+@legacy 9d1653197c79a78622db26b8520c63ab1754ce9d8086a8b7db7b0c8ac6a33470 internal/console/selfserve_store.go Store.AdmitSelfServeMove legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: inserts one self-serve move row and its first phase event in one SQLite transaction, or reads the instance's open row back; no bucket or root action; self-serve moves 2 Task 5: the row also stores the estimate (estimate_seconds, estimate_terms) the request door computed file:Exec@808,file:QueryRow@1580 121e398e82839b2894fd7a3db441b554269196c57af943b0502ce8552c07671d

+internal/console/selfserve_store.go Store.AdmitSelfServeMove legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: inserts one self-serve move row and its first phase event in one SQLite transaction, or reads the instance's open row back; no bucket or root action; self-serve moves 2 Task 5: the row also stores the estimate (estimate_seconds, estimate_terms) the request door computed file:Exec@808,file:QueryRow@1580 121e398e82839b2894fd7a3db441b554269196c57af943b0502ce8552c07671d

@legacy c2e1ad98b9e02efa012eee032c98c16b38efbc62b4ba9ff1b52bfb0822762cd2 internal/console/selfserve_store.go Store.AdvanceSelfServe legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: advances one self-serve row's phase, predicated on the phase, the abort flag and an optional confirmed nonce it consumes, with the phase event in one SQLite transaction; no bucket or root action file:Exec@230 79b0ec7f50cf599f0661de8fbb273db6e20faf7adb95d9f6dd8e459c5a1de41e

internal/console/selfserve_store.go Store.AdvanceSelfServe legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: advances one self-serve row's phase, predicated on the phase, the abort flag and an optional confirmed nonce it consumes, with the phase event in one SQLite transaction; no bucket or root action file:Exec@230 79b0ec7f50cf599f0661de8fbb273db6e20faf7adb95d9f6dd8e459c5a1de41e

@legacy bb4226610c6d82f9c7ca9a79e6e4132ad0150bfa1841fa8db3364c4793c97fbb internal/console/selfserve_store.go Store.ConfirmSelfServeRequest legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: marks a self-serve request confirmed, predicated on its nonce and unconsumed, unvoided, unconfirmed flags; no bucket or root action file:Exec@221 811edad437cdf69f10bd91c33daa7330bfdf92934ef10c9b7e61ba01b62e4f94

@@ -50,8 +50,8 @@ internal/console/selfserve_store.go Store.IssueSelfServeRequest legacy accepted-

internal/console/selfserve_store.go Store.MarkSelfServeCut legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: the cut door's one write: marks a ready self-serve row cut, predicated on no abort, cut or expiry; no bucket or root action file:Exec@222 d887f36b2630a505cad973beb413d26c6234a54ef18a1671c313387de766141f

@legacy 5eb8d1adda16992f46c5e9ff1e029e266ecdb7f3adc147a90f737c5c1f936dd5 internal/console/selfserve_store.go Store.MoveTerminalOrAbsent legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: reads one self-serve row's outcome and release flag for the reservation reclaim rule; no bucket or root action file:QueryRow@111 7d2f7eacc22eeb69b8a95ef146a472a915dc3c1a143d75fb4eb87e11786f6a13

internal/console/selfserve_store.go Store.MoveTerminalOrAbsent legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: reads one self-serve row's outcome and release flag for the reservation reclaim rule; no bucket or root action file:QueryRow@111 7d2f7eacc22eeb69b8a95ef146a472a915dc3c1a143d75fb4eb87e11786f6a13

-@legacy eb87ab1c91a9120514bc2a0b6fb7e56f8d44006684ae3d3922dac93f5bc31213 internal/console/selfserve_store.go Store.RequestSelfServeAbort legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: marks an abort requested on a self-serve row in one of the given phases; no bucket or root action file:Exec@372 89bb4c26a83a01c46ffce17e91382182c1356a24aa02f0eb0584f4ec2a0178d7

-internal/console/selfserve_store.go Store.RequestSelfServeAbort legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: marks an abort requested on a self-serve row in one of the given phases; no bucket or root action file:Exec@372 89bb4c26a83a01c46ffce17e91382182c1356a24aa02f0eb0584f4ec2a0178d7

+@legacy fcc710c062f090e26f26ad3e91ddbeee32f7741f4ce45b000531793cb09b3ae1 internal/console/selfserve_store.go Store.RequestSelfServeAbort legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: marks an abort requested on a self-serve row in one of the given phases; no bucket or root action; self-serve moves 2 Task 5: the predicate also requires cut_requested_at = 0, so a cancel never lands after a cut file:Exec@372 91993864428e5e973cd658994504ee6414aa65f2f9f7bdc6cf28b2c2691b7db2

+internal/console/selfserve_store.go Store.RequestSelfServeAbort legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: marks an abort requested on a self-serve row in one of the given phases; no bucket or root action; self-serve moves 2 Task 5: the predicate also requires cut_requested_at = 0, so a cancel never lands after a cut file:Exec@372 91993864428e5e973cd658994504ee6414aa65f2f9f7bdc6cf28b2c2691b7db2

@legacy 44c2b0be5f7e536d50699223225b253a8b805c834a35138f44232ca9a83dea34 internal/console/selfserve_store.go Store.SelfServeMove legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: reads one self-serve move row from the console SQLite store; no bucket or root action file:QueryRow@96 607827d36fccc1f64607427fce954cf9f6f1e2a5e005e50f72bed50d1944152d

internal/console/selfserve_store.go Store.SelfServeMove legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: reads one self-serve move row from the console SQLite store; no bucket or root action file:QueryRow@96 607827d36fccc1f64607427fce954cf9f6f1e2a5e005e50f72bed50d1944152d

@legacy 20dc8f1831efbb9568fbc0c6cf830c21aaa6a0df1d996c3404823e81c53a57f9 internal/console/selfserve_store.go Store.SelfServeRecoveryPending legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: counts the self-serve rows and undelivered events the pass still owes, for recovery mode; no bucket or root action file:QueryRow@78 2f1f0f6502aead50b7e0ae48179b7babd36bca3a1537b09aa7bd6fe59fd3be31

@@ -152,3 +152,20 @@ internal/host/e2e_bridge.go withAgentEnv legacy accepted-legacy accepted-legacy;

@removed internal/host/agent.go statusTick H3 census-ruling-PROPOSED-self-serve-moves-2;rev3=PROPOSED-self-serve-moves-2;basis=remains declared but has no direct read; the snapshot's reads (Registry.List and ListAliases) moved unchanged to statusTickAt, classified below, which statusTick calls at the wall clock; proposed removal only

@legacy 9b4e405fc22afb56c5b00ccfbe35147dc2e1107bafaeefb4703ce16724ed5efb internal/host/agent.go statusTickAt legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=root-route (J1, as statusTick's was): the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): statusTick's body unchanged (the rows and the alias rows of the box's own registry into CollectBox, the box snapshot, the fleet publication when it holds the lease), the snapshot stamped at the given reading, which the agent's statusTick passes as time.Now(); self-serve moves 2 Task 10a fix round 1 whole:Route@1275,whole:Route@836,whole:RouteAlias@788,whole:RouteAlias@798 9fded9b50b63e931688dc4dcc31a704331d539a28c6122b93784cf86d6b79dc8

internal/host/agent.go statusTickAt legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=root-route (J1, as statusTick's was): the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): statusTick's body unchanged (the rows and the alias rows of the box's own registry into CollectBox, the box snapshot, the fleet publication when it holds the lease), the snapshot stamped at the given reading, which the agent's statusTick passes as time.Now(); self-serve moves 2 Task 10a fix round 1 whole:Route@1275,whole:Route@836,whole:RouteAlias@788,whole:RouteAlias@798 9fded9b50b63e931688dc4dcc31a704331d539a28c6122b93784cf86d6b79dc8

+# Task 5 (record eligibility, the split start validation, participant pinning, the self-serve door bodies and the view), rev3=PROPOSED-self-serve-moves-2: no root read class or task is added beyond accepted-legacy. Six units are new, each frozen accepted-legacy with a reviewed basis; none reads a file: the scanner's sites are a URL query, a method or struct field named Open, and the signed host roster read from the deployment bucket. handleAPIInstanceMoveStatus and offlineClaimEvidence are re-pinned here; AdmitSelfServeMove and RequestSelfServeAbort are re-pinned in place in their Task 4 rows. The status reports (status/boxes/<label>.json, through readOfflineFleet) and the identity records (boxid.Load under control/boxes/<box id>.json) the door reads are bucket objects read with the console's deployment credentials; the scanner names no site for them. The seal moves. The internal/console envelope is re-pinned in place.

+@legacy 48698cf2605e14127b843f2d79a937c084afc93a626b68de22e32b7c9e23fcdb internal/console/apiinstancemove.go Server.handleAPIInstanceMoveStatus legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=root-input (J4); the console (cmd/console serve under console.service, user carlos-console): the poll door, unchanged with Phase 1 on; with it off on a claims-off console it joins the instance's self-serve rows from the console SQLite store (selfServeViewOf; no row is the flat view byte for byte, a failed read is a 502) and, while the switch admits, answers ?estimate=1 through selfServeEstimate; its sites are URL queries and the host claim read, unchanged in kind, offsets moved file:Query@1084,file:Query@577,file:Read@1316 78a6cd92507895a1b961903947249df4b49adf14b05a8fc5480d6bfbcad5738c

+internal/console/apiinstancemove.go Server.handleAPIInstanceMoveStatus legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=root-input (J4); the console (cmd/console serve under console.service, user carlos-console): the poll door, unchanged with Phase 1 on; with it off on a claims-off console it joins the instance's self-serve rows from the console SQLite store (selfServeViewOf; no row is the flat view byte for byte, a failed read is a 502) and, while the switch admits, answers ?estimate=1 through selfServeEstimate; its sites are URL queries and the host claim read, unchanged in kind, offsets moved file:Query@1084,file:Query@577,file:Read@1316 78a6cd92507895a1b961903947249df4b49adf14b05a8fc5480d6bfbcad5738c

+@legacy b11acd284e3e378504ad7f2d9e318a1e51f7b04acc5aa533357e5e3d0a638e1b internal/console/apiinstancemove_offline.go Server.offlineClaimEvidence legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=root-input (J4, as main's moves units); the console (cmd/console serve under console.service, user carlos-console): the census-ruling-moves-offline body unchanged, its inputs passed as account, app, host and record (offlineRecordChecks) rather than the door; reads the host claim, the record's acquisition, a domains claim and the app's admission only to refuse a start; a failed read refuses with a 502; deny-only file:Read@427 25b39bcacda912c8e03ea7e08e96cf54ffedbc36bbcc44e046dbced9cec33200

+internal/console/apiinstancemove_offline.go Server.offlineClaimEvidence legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=root-input (J4, as main's moves units); the console (cmd/console serve under console.service, user carlos-console): the census-ruling-moves-offline body unchanged, its inputs passed as account, app, host and record (offlineRecordChecks) rather than the door; reads the host claim, the record's acquisition, a domains claim and the app's admission only to refuse a start; a failed read refuses with a 502; deny-only file:Read@427 25b39bcacda912c8e03ea7e08e96cf54ffedbc36bbcc44e046dbced9cec33200

+@legacy 3e683da1dbcecefbcde3ade6601940eacbe80c746b9f290311133b3e1bad2c79 internal/console/apiinstancemove_offline.go Server.participantIdentityFor legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: reads the signed host roster (hostactors.Directory.Read, control/host-actors.json in the deployment bucket, verified under the release key) so a self-serve participant's identity record is checked against it; absent is no entries, any other failure refuses; no file read, no root action file:Read@478 5c91228191471a4415aa57a541861dbd20b6b2324f1d05f2610e98deba4c8e30

+internal/console/apiinstancemove_offline.go Server.participantIdentityFor legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: reads the signed host roster (hostactors.Directory.Read, control/host-actors.json in the deployment bucket, verified under the release key) so a self-serve participant's identity record is checked against it; absent is no entries, any other failure refuses; no file read, no root action file:Read@478 5c91228191471a4415aa57a541861dbd20b6b2324f1d05f2610e98deba4c8e30

+@legacy 93dde944d11470f04e70d6da7f91e7754c696110638ac021ae3d01d2bd445573 internal/console/selfserve_door.go Server.selfServeEstimate legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: the estimate of a self-serve move not yet requested: reads the request's URL query (region), the console SQLite rows and the prepare's bucket evidence, writes nothing; no file read, no root action file:Query@545 89cc1535c414f2566006b5bfa6abc336811ffa6e652f341453f80db5c98816ce

+internal/console/selfserve_door.go Server.selfServeEstimate legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: the estimate of a self-serve move not yet requested: reads the request's URL query (region), the console SQLite rows and the prepare's bucket evidence, writes nothing; no file read, no root action file:Query@545 89cc1535c414f2566006b5bfa6abc336811ffa6e652f341453f80db5c98816ce

+@legacy 76c5268aa5a7316bfe99a7f66cd4903f206e5bad554a6e6f325975d7b2c00821 internal/console/selfserve_door.go selfServeBusy legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: the prepare's record checks; its one site is rec.ActiveRun.Open(), a method of the record already read; no file read, no root action file:Open@165 c427659ee29d7245a254cc212a00457d0c8431c1ea0b86b2c73c8703dbdba902

+internal/console/selfserve_door.go selfServeBusy legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: the prepare's record checks; its one site is rec.ActiveRun.Open(), a method of the record already read; no file read, no root action file:Open@165 c427659ee29d7245a254cc212a00457d0c8431c1ea0b86b2c73c8703dbdba902

+@legacy c2b468656ad27a5c0d554d7505e736deb1fe015d9b1e383240f447622f5f16a7 internal/console/selfserve_estimate.go Server.estimate legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: pure arithmetic over byte counts and the default terms; its sites are the estimate's Open term (a struct field named Open); no file read, no root action file:Open@259,file:Open@268,file:Open@356 9ce9332e764cb63574f16926dabf050a1429ceb10ff44b12c02447c08c0e5e09

+internal/console/selfserve_estimate.go Server.estimate legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: pure arithmetic over byte counts and the default terms; its sites are the estimate's Open term (a struct field named Open); no file read, no root action file:Open@259,file:Open@268,file:Open@356 9ce9332e764cb63574f16926dabf050a1429ceb10ff44b12c02447c08c0e5e09

+@legacy bbf40550e574bbb95012d6a817c3b71917311f71dba4061ddbad785072e61384 internal/console/selfserve_estimate.go type estimateTerms legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: a type declaration whose Open field is the open phase's duration; no file read, no root action file:Open@47 70ba8214af2db2b694d87c83750665856669faabb91359c20d6483503e69f77c

+internal/console/selfserve_estimate.go type estimateTerms legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: a type declaration whose Open field is the open phase's duration; no file read, no root action file:Open@47 70ba8214af2db2b694d87c83750665856669faabb91359c20d6483503e69f77c

+@legacy e7a1b4b8179de6b4d263f785208f5bad87eaa2ec4ff8eb07876e01f6034002a8 internal/console/selfserve_estimate.go var estimateDefaults legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: the estimate's default terms, a literal whose Open field is the open phase's term; no file read, no root action file:Open@247,file:Open@49 e7c598c8e4a4fa1e4df207e463c6fd722f89d0955f896baa439ce328db821849

+internal/console/selfserve_estimate.go var estimateDefaults legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: the estimate's default terms, a literal whose Open field is the open phase's term; no file read, no root action file:Open@247,file:Open@49 e7c598c8e4a4fa1e4df207e463c6fd722f89d0955f896baa439ce328db821849