carlos / platform Public

moves-offline-fixes: the config retry backoff saturates (Astra re-review); census-ruling-moves-offline-fixes recorded (platform-1c), seal 826c54be

claude 4 days ago 574cf51c0c025dee2dace50be9d3a3491e5d3d8d parent 7cd5db4

5 files changed, +61 −27

docs/superpowers/notes/census-proposal-moves-offline-fixes.md +5 −1
internal/host/agent.go +5 −1
internal/host/configdirpending_test.go +26 −0
internal/provision/plan14_root_reads_test.go +4 −4
internal/provision/testdata/plan14-root-reads-moves-offline-fixes.tsv +21 −21

diff --git a/docs/superpowers/notes/census-proposal-moves-offline-fixes.md b/docs/superpowers/notes/census-proposal-moves-offline-fixes.md

index 0891f7ba9..d5693f960 100644

--- a/docs/superpowers/notes/census-proposal-moves-offline-fixes.md

+++ b/docs/superpowers/notes/census-proposal-moves-offline-fixes.md

@@ -1,6 +1,6 @@

# Census: the offline move's harness fixes (Run 9, defects 6 to 8)

-Status: PROPOSED. Every row carries `rev3=PROPOSED-moves-offline-fixes`. The

+Status: RULED. Every row carries `rev3=PROPOSED-moves-offline-fixes`. The

ruling is asked of the census owner, platform-1c.

The branch is `moves-offline-fixes`, from main after 54ae7fb9 (v0.28.5). It

@@ -86,3 +86,7 @@ still shows on its own.

withholds a token and a record for a host `Skip` names.

3. That the re-assert of defect 7 needs no row: it calls only steps already

classified under census-ruling-moves-offline.

+## Ruling (platform-1c, 2026-10-20): census-ruling-moves-offline-fixes, ACCEPTED as proposed

+Accepted at d75b7e0b (F1 to F4) and re-ruled for fix round 1 at 7cd5db4d (F5 to F7). After Astra's scoped re-review, the backoff counter saturates (agent.go `pendingDirs.record`): an internal/host envelope re-pin only. The rev3 tag was rewritten to the ruling's name, so the seal moves to 826c54be…a62f.

diff --git a/internal/host/agent.go b/internal/host/agent.go

index 98caa3e48..483700f2d 100644

--- a/internal/host/agent.go

+++ b/internal/host/agent.go

@@ -1451,7 +1451,11 @@ func (p *pendingDirs) record(absent map[string]string, outcomes map[string]bool,

case named && done, !named && complete:

delete(p.dirs, host)

case named:

- e.failures++

+ // The count saturates once the delay reaches the cap, so the

+ // shift below never overflows however long a host keeps failing.

+ if 1<<e.failures <= pendingRetryCap {

+ e.failures++

+ }

e.waitTicks = min(1<<(e.failures-1), pendingRetryCap) - 1

}

diff --git a/internal/host/configdirpending_test.go b/internal/host/configdirpending_test.go

index 748f18a2b..a1605c1d3 100644

--- a/internal/host/configdirpending_test.go

+++ b/internal/host/configdirpending_test.go

@@ -236,3 +236,29 @@ func (p *pendingDirs) peek() (string, bool) {

}

return "", false

}

+// TestPendingDirsBackoffSaturates: a host that keeps failing backs off to

+// the cap and stays there; the failure count never grows far enough for the

+// shift to overflow into a negative or zero delay (Astra fix round 1).

+func TestPendingDirsBackoffSaturates(t *testing.T) {

+ var p pendingDirs

+ dir := t.TempDir()

+ p.record(map[string]string{"shop.example.com": dir}, nil, false)

+ for i := 0; i < 200; i++ {

+ p.record(nil, map[string]bool{"shop.example.com": false}, false)

+ e := p.dirs["shop.example.com"]

+ if e == nil {

+ t.Fatalf("pass %d: the waiting host was dropped", i)

+ }

+ if e.waitTicks < 0 || e.waitTicks > pendingRetryCap-1 {

+ t.Fatalf("pass %d: waitTicks %d outside [0,%d]", i, e.waitTicks, pendingRetryCap-1)

+ }

+ if got := p.dirs["shop.example.com"].waitTicks; got != pendingRetryCap-1 {

+ t.Fatalf("after 200 failures waitTicks = %d, want the cap %d", got, pendingRetryCap-1)

+ }

+ p.record(nil, map[string]bool{"shop.example.com": true}, false)

+ if _, ok := p.dirs["shop.example.com"]; ok {

+ t.Fatal("a delivered host stays pending")

+ }

diff --git a/internal/provision/plan14_root_reads_test.go b/internal/provision/plan14_root_reads_test.go

index fdbf3fe99..8d36f6686 100644

--- a/internal/provision/plan14_root_reads_test.go

+++ b/internal/provision/plan14_root_reads_test.go

@@ -982,9 +982,9 @@ func TestPlan14RootReadCensus(t *testing.T) {

t.Fatal(err)

}

// Census overlay moves-offline-fixes (harness Run 9's defects 6 to 8 in

- // the offline operator move), loaded last. PROPOSED-moves-offline-fixes,

- // ruling asked of the census owner (platform-1c); the proposal names

- // each unit's executing identity

+ // the offline operator move), loaded last, under

+ // census-ruling-moves-offline-fixes (platform-1c, 2026-10-20); the

+ // proposal names each unit's executing identity

// (docs/superpowers/notes/census-proposal-moves-offline-fixes.md). Every

// unit runs in the agent and makes no root decision: changed legacy

// units re-frozen at main's disposition, new ones proposed accepted

@@ -996,7 +996,7 @@ func TestPlan14RootReadCensus(t *testing.T) {

if err = loadRootReadInventory(filepath.Join(root, "internal/provision/testdata/plan14-root-reads-moves-offline-fixes.tsv"), &inv, true); err != nil {

t.Fatal(err)

}

- seal = "edc04f7349acf2b9ea98ffc8a1d3b71516a6ddb95505abfc2e38e49fd802ccc2"

+ seal = "826c54be9447f0a7c42386dba6be5888fc5a708bf1e5a57f2a6de6da4662a62f"

errs := append(compareRootReads(got, inv), checkRootReadLegacy(inv, seal)...)

errs = append(errs, checkRootReadDeclarations(got, inv)...)

if len(errs) > 0 {

diff --git a/internal/provision/testdata/plan14-root-reads-moves-offline-fixes.tsv b/internal/provision/testdata/plan14-root-reads-moves-offline-fixes.tsv

index 45ff1f6b3..06f9f857f 100644

--- a/internal/provision/testdata/plan14-root-reads-moves-offline-fixes.tsv

+++ b/internal/provision/testdata/plan14-root-reads-moves-offline-fixes.tsv

@@ -1,4 +1,4 @@

-# Census overlay moves-offline-fixes (harness Run 9's defects 6 to 8 in the offline operator move, on main after 54ae7fb9), loaded LAST, after armed-box-updates. PROPOSED-moves-offline-fixes: every row is rev3=PROPOSED-moves-offline-fixes, and the ruling is asked of the census owner (platform-1c). The proposal, with each unit's executing identity: docs/superpowers/notes/census-proposal-moves-offline-fixes.md.

+# Census overlay moves-offline-fixes (harness Run 9's defects 6 to 8 in the offline operator move, on main after 54ae7fb9), loaded LAST, after armed-box-updates. RULED as census-ruling-moves-offline-fixes (platform-1c, 2026-10-20, accepted as proposed, re-ruled for fix round 1); was PROPOSED-moves-offline-fixes: every row is rev3=census-ruling-moves-offline-fixes, and the ruling is asked of the census owner (platform-1c). The proposal, with each unit's executing identity: docs/superpowers/notes/census-proposal-moves-offline-fixes.md.

# Every unit here runs in the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos) and makes no root decision, so each is proposed accepted legacy at main's disposition (J1 root-route for registry and route reads, J4 root-input for file reads), as census-ruling-moves-offline proposed its units.

# Defect 6 (config.env for a nested row whose instance directory is not made yet): SyncExecWithCallbacks, renderExecConfigBefore and configGenLoop re-frozen at main's disposition; configGenTick and pendingDirs.appeared new. The seal moves.

# Defect 7 (fresh reports at every door step): envelope only. The source and sealer re-assert (movesWorker.offlineReassert, offlineReassertLoop) reads no root input of its own: it reads the record from the deployment store and calls the steps census-ruling-moves-offline already classified. The console's stale-report refusal reads nothing new. internal/console and internal/host re-pinned; the seal stands.

@@ -8,24 +8,24 @@

# Fix round 1, finding 3 (Astra: a skipped config read cleared the pending retry): SyncExecWithCallbacks re-pinned (it names each in-scope host done or not, WithHostOutcome), pendingDirs.appeared re-pinned (the same Lstat, now with a retry backoff); internal/appconfig and internal/host re-pinned. The seal moves.

@coverage internal/appconfig d2258ea641530870dc3b7600cda01896b0d647229a3b70b83addcd30b15210aa

@coverage internal/console 7b015747c5ef8a3ee7473ad63f7f99200ce14c63c1b7a47945c212ad9239756b

-@coverage internal/host 242917d80f343a8a2ca1536c5b1775a9bf8f445ce643cc22fde9fa55f12a627c

+@coverage internal/host 4b5858f9fc824fb29e4de678dde6510bf8d5c42715b7d2c49278d1264a08f884

@coverage internal/schedule a76efa679b9089eff4f6dae8e6f0adc5d92de628e66e16d4a00c81ba70e086ff

-@legacy 8941e875e49f6b5d23c8153f793ac36c78f20776ff9e064534302e19ca7ca62b internal/appconfig/syncexec.go SyncExecWithCallbacks legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline-fixes;basis=route-and-input (J1,J4, main's disposition); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos), through syncExecSerialized: main's body, with a nested row whose write found no instance directory named and skipped (errInstanceDirAbsent, WhenInstanceDirAbsent) instead of failing the pass, and each in-scope host reported done or not done (WithHostOutcome) once the pass has gone through every route; no new read site file:Stat@28417,registry:App@10156,registry:App@10371,registry:App@15917,registry:App@28302,registry:Environment@10164,registry:Environment@10379,registry:Environment@15925,registry:Environment@28310,registry:Host@1031,registry:Host@1460,registry:Host@15425,registry:Host@15752,registry:Host@15850,registry:Host@16682,registry:Host@17033,registry:Host@17968,registry:Host@18509,registry:Host@21436,registry:Host@21653,registry:Host@22211,registry:Host@22401,registry:Host@22410,registry:Host@22429,registry:Host@25330,registry:Host@25947,registry:Host@25999,registry:Host@26155,registry:Host@28811,registry:Host@831,registry:Host@902,registry:Host@996,whole:Route@10049,whole:Route@10110,whole:Route@10151,whole:Route@10268,whole:Route@10302,whole:Route@10366,whole:Route@1412,whole:Route@1441,whole:Route@15337,whole:Route@15387,whole:Route@15912,whole:Route@24926,whole:Route@25340,whole:Route@26044,whole:Route@28201,whole:Route@28234,whole:Route@28297,whole:Route@28398,whole:Route@29048,whole:Route@29121,whole:Route@693,whole:Route@721,whole:Route@750,whole:Route@776,whole:Route@9984 b523044621e10b4a702d5e1b8c5ecd843b645cf72b327487ed424f96956a3a7e

-internal/appconfig/syncexec.go SyncExecWithCallbacks legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline-fixes;basis=route-and-input (J1,J4, main's disposition); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos), through syncExecSerialized: main's body, with a nested row whose write found no instance directory named and skipped (errInstanceDirAbsent, WhenInstanceDirAbsent) instead of failing the pass, and each in-scope host reported done or not done (WithHostOutcome) once the pass has gone through every route; no new read site file:Stat@28417,registry:App@10156,registry:App@10371,registry:App@15917,registry:App@28302,registry:Environment@10164,registry:Environment@10379,registry:Environment@15925,registry:Environment@28310,registry:Host@1031,registry:Host@1460,registry:Host@15425,registry:Host@15752,registry:Host@15850,registry:Host@16682,registry:Host@17033,registry:Host@17968,registry:Host@18509,registry:Host@21436,registry:Host@21653,registry:Host@22211,registry:Host@22401,registry:Host@22410,registry:Host@22429,registry:Host@25330,registry:Host@25947,registry:Host@25999,registry:Host@26155,registry:Host@28811,registry:Host@831,registry:Host@902,registry:Host@996,whole:Route@10049,whole:Route@10110,whole:Route@10151,whole:Route@10268,whole:Route@10302,whole:Route@10366,whole:Route@1412,whole:Route@1441,whole:Route@15337,whole:Route@15387,whole:Route@15912,whole:Route@24926,whole:Route@25340,whole:Route@26044,whole:Route@28201,whole:Route@28234,whole:Route@28297,whole:Route@28398,whole:Route@29048,whole:Route@29121,whole:Route@693,whole:Route@721,whole:Route@750,whole:Route@776,whole:Route@9984 b523044621e10b4a702d5e1b8c5ecd843b645cf72b327487ed424f96956a3a7e

-@legacy 356c576628a285021657e989a015ef938bb1da3498d8146a734903a23fea1e4a internal/appconfig/syncexec.go renderExecConfigBefore legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline-fixes;basis=route-and-input (J1,J4, main's disposition); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos), from config sync and the moves worker's held render: main's body with one Lstat of a nested row's instance directory after its write failed, to tell a directory not made yet from any other failure; it follows no link and changes no outcome but the error's kind file:Lstat@3893,file:ReadFile@951,registry:Environment@3190,registry:Host@1070,registry:Host@2586,registry:Host@4088,registry:Host@4320,registry:Host@4576,registry:Host@4669,registry:Host@876,whole:Route@2522,whole:Route@257,whole:Route@3715,whole:Route@680 a60a9a2e2158f3a8dadf6fcf46810930dad89b67d1acc23fb57c324a7d9ac1f1

-internal/appconfig/syncexec.go renderExecConfigBefore legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline-fixes;basis=route-and-input (J1,J4, main's disposition); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos), from config sync and the moves worker's held render: main's body with one Lstat of a nested row's instance directory after its write failed, to tell a directory not made yet from any other failure; it follows no link and changes no outcome but the error's kind file:Lstat@3893,file:ReadFile@951,registry:Environment@3190,registry:Host@1070,registry:Host@2586,registry:Host@4088,registry:Host@4320,registry:Host@4576,registry:Host@4669,registry:Host@876,whole:Route@2522,whole:Route@257,whole:Route@3715,whole:Route@680 a60a9a2e2158f3a8dadf6fcf46810930dad89b67d1acc23fb57c324a7d9ac1f1

-@legacy 547dba02dd41e9e318da6368d9bf493f94152a4d5e56737765199cc2f298a302 internal/host/agent.go configGenLoop legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline-fixes;basis=root-route (J1, main's disposition); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's loop, its tick's body moved into configGenTick; the registry listing stays here whole:Route@1265 a0b36186f7c8abdd818c81c2651a75b202078ad7f197d93b6157bcab97604188

-internal/host/agent.go configGenLoop legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline-fixes;basis=root-route (J1, main's disposition); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's loop, its tick's body moved into configGenTick; the registry listing stays here whole:Route@1265 a0b36186f7c8abdd818c81c2651a75b202078ad7f197d93b6157bcab97604188

-@legacy 2bf1eb09b85c6c8fa62feb2173628e757913e153a656247a3423ef9a753783b0 internal/host/agent.go configGenTick legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline-fixes;basis=root-route (J1, as configGenLoop); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, configGenLoop's tick over the routes it listed; it also runs the agent's own config pass once an instance directory the last pass waited for exists whole:Route@268 751870d636c3ea7b3670a7e00c71d085e94ae9b013545e319047a4609f514943

-internal/host/agent.go configGenTick legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline-fixes;basis=root-route (J1, as configGenLoop); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, configGenLoop's tick over the routes it listed; it also runs the agent's own config pass once an instance directory the last pass waited for exists whole:Route@268 751870d636c3ea7b3670a7e00c71d085e94ae9b013545e319047a4609f514943

-@legacy 681979f76e87cb6dcd82e4b0843e0a720382366629ccc1d46d393b3ed78746c4 internal/host/agent.go pendingDirs.appeared legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline-fixes;basis=root-input (J4, as the moves units' isDir and lexists); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, an Lstat that never follows a link, of the instance directories config passes could not write into, with a retry backoff for a host a pass left undone; it decides only whether the agent runs its own config pass again file:Lstat@135 691589305b19ebe4e7311bb853ae68003676786ce0684e6e7133382d26c982c7

-internal/host/agent.go pendingDirs.appeared legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline-fixes;basis=root-input (J4, as the moves units' isDir and lexists); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, an Lstat that never follows a link, of the instance directories config passes could not write into, with a retry backoff for a host a pass left undone; it decides only whether the agent runs its own config pass again file:Lstat@135 691589305b19ebe4e7311bb853ae68003676786ce0684e6e7133382d26c982c7

-@legacy fb3a335703bd3d6008ff82252d64aa9f41676650a874eb786291d1d201e57910 internal/host/schedule_wiring.go newScheduleDeps legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline-fixes;basis=root-route (J1, main's disposition); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos), from armSchedule: main's body with the runner's Skip set to scheduleSkip; no new read site registry:App@1479,registry:App@388,registry:Host@1546,registry:Host@396,whole:Route@1474,whole:Route@383 aa93bed2781d1005cf864ebaaf6ac4597d6f547c45d6a1063f10c4a483ba46c3

-internal/host/schedule_wiring.go newScheduleDeps legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline-fixes;basis=root-route (J1, main's disposition); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos), from armSchedule: main's body with the runner's Skip set to scheduleSkip; no new read site registry:App@1479,registry:App@388,registry:Host@1546,registry:Host@396,whole:Route@1474,whole:Route@383 aa93bed2781d1005cf864ebaaf6ac4597d6f547c45d6a1063f10c4a483ba46c3

-@legacy 48af22e2b896b940598175e9c4988e2837b14a72e88b7ee1ba8346098f209606 internal/host/schedule_wiring.go scheduleSkip legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline-fixes;basis=root-route (J1, as the runner's own hold checks); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos), from its schedule runner: new, reads a row's status (any hold) and host (the armed offline view: the record names another region) to tell the runner to leave the host alone; it only withholds a tick, never grants one registry:Host@155,registry:Status@64 4f471727429b5b79bfa909693a09e588051b9f490eafd8480ee9893581362d64

-internal/host/schedule_wiring.go scheduleSkip legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline-fixes;basis=root-route (J1, as the runner's own hold checks); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos), from its schedule runner: new, reads a row's status (any hold) and host (the armed offline view: the record names another region) to tell the runner to leave the host alone; it only withholds a tick, never grants one registry:Host@155,registry:Status@64 4f471727429b5b79bfa909693a09e588051b9f490eafd8480ee9893581362d64

-@legacy f938c1e7ab247e5531c6786342ea7c523a87ef60c42c94448b4c57b3fda01597 internal/schedule/runner.go Runner.Tick legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline-fixes;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos), from its scheduler: census-ruling-seeded-instances' body with a host Skip names given no tick and no bookkeeping at the pre-filter, and its due query moved into Runner.dueRows; no root decision registry:Host@1352,registry:Host@1394,registry:Host@1415,registry:Host@1439,registry:Host@5457,registry:ImportGate@2969,registry:ImportGate@3884,registry:Status@2762,registry:Status@3870,whole:Route@1821,whole:Route@2111,whole:Route@2240,whole:Route@3650,whole:Route@3841,whole:Route@4974,whole:Route@5323,whole:Route@5498,whole:Route@5534,whole:Timer@1219,whole:Timer@1323,whole:Timer@1345,whole:Timer@1408,whole:Timer@1432,whole:Timer@1448,whole:Timer@4649,whole:Timer@4978,whole:Timer@5538 0c7ef6fbd18e1be821561b82bd059ffdb5e9ac3fe1a35d3b6e1cb8aada3a9edc

-internal/schedule/runner.go Runner.Tick legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline-fixes;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos), from its scheduler: census-ruling-seeded-instances' body with a host Skip names given no tick and no bookkeeping at the pre-filter, and its due query moved into Runner.dueRows; no root decision registry:Host@1352,registry:Host@1394,registry:Host@1415,registry:Host@1439,registry:Host@5457,registry:ImportGate@2969,registry:ImportGate@3884,registry:Status@2762,registry:Status@3870,whole:Route@1821,whole:Route@2111,whole:Route@2240,whole:Route@3650,whole:Route@3841,whole:Route@4974,whole:Route@5323,whole:Route@5498,whole:Route@5534,whole:Timer@1219,whole:Timer@1323,whole:Timer@1345,whole:Timer@1408,whole:Timer@1432,whole:Timer@1448,whole:Timer@4649,whole:Timer@4978,whole:Timer@5538 0c7ef6fbd18e1be821561b82bd059ffdb5e9ac3fe1a35d3b6e1cb8aada3a9edc

-internal/schedule/runner.go Runner.fire hint E2 accepted-legacy;rev3=PROPOSED-moves-offline-fixes;basis=root-route (main: J1) PROPOSED E46: captured claim selection and root journal mutation; root RPC outside service host exclusion; SQL/route data never grants root authority. Executing identity: service controller; root for inventory/retirement callbacks. moves-offline-fixes: with Skip set (only the agent's runner sets it, scheduleSkip), the row is read again before the token and a skipped host gets no token and no record; class and task unchanged registry:Host@243,registry:Host@385,registry:Host@691,registry:Host@837,registry:Name@252,registry:Name@394,registry:Spec@148,registry:Spec@260,whole:Route@1005,whole:Route@1202,whole:Route@1504,whole:Route@1567,whole:Route@1735,whole:Route@662,whole:Route@742,whole:Route@768,whole:Route@879,whole:Timer@1009,whole:Timer@108,whole:Timer@1206,whole:Timer@1306,whole:Timer@1508,whole:Timer@1739,whole:Timer@317,whole:Timer@883 1aaf0e167a6852ab6958cb409aaac63523334b4595e1cb8a0e30ac96f4499e9d

-@legacy 32d1784c5ae37f6209554d5a3dc02c95d58c8a9e5593ea5c610ec6041891cc0f internal/schedule/runner.go Runner.dueRows legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline-fixes;basis=root-route (J1, as Runner.Tick); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos), from its scheduler: new, Tick's due query moved out of Tick: held hosts left out by the query when the hold wiring is armed or Skip is set, and each host Skip names (one registry row read per host in the batch) added to the exclusion and the batch read again, so a skipped host's rows never fill the limit; it only withholds ticks registry:Host@489,registry:Host@525,registry:Host@567,registry:Host@647,whole:Route@590,whole:Route@611,whole:Timer@186,whole:Timer@264,whole:Timer@366,whole:Timer@388,whole:Timer@472,whole:Timer@699 6e0d3045eebd802a7d3936a84d7fcbd8a9edd2741e5a13ed8c595c7dcfdaa2c1

-internal/schedule/runner.go Runner.dueRows legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline-fixes;basis=root-route (J1, as Runner.Tick); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos), from its scheduler: new, Tick's due query moved out of Tick: held hosts left out by the query when the hold wiring is armed or Skip is set, and each host Skip names (one registry row read per host in the batch) added to the exclusion and the batch read again, so a skipped host's rows never fill the limit; it only withholds ticks registry:Host@489,registry:Host@525,registry:Host@567,registry:Host@647,whole:Route@590,whole:Route@611,whole:Timer@186,whole:Timer@264,whole:Timer@366,whole:Timer@388,whole:Timer@472,whole:Timer@699 6e0d3045eebd802a7d3936a84d7fcbd8a9edd2741e5a13ed8c595c7dcfdaa2c1

+@legacy 378070928b39fce4bbb645a70cccc08421a0a8c025e73a90b3590e884286afb4 internal/appconfig/syncexec.go SyncExecWithCallbacks legacy accepted-legacy accepted-legacy;rev3=census-ruling-moves-offline-fixes;basis=route-and-input (J1,J4, main's disposition); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos), through syncExecSerialized: main's body, with a nested row whose write found no instance directory named and skipped (errInstanceDirAbsent, WhenInstanceDirAbsent) instead of failing the pass, and each in-scope host reported done or not done (WithHostOutcome) once the pass has gone through every route; no new read site file:Stat@28417,registry:App@10156,registry:App@10371,registry:App@15917,registry:App@28302,registry:Environment@10164,registry:Environment@10379,registry:Environment@15925,registry:Environment@28310,registry:Host@1031,registry:Host@1460,registry:Host@15425,registry:Host@15752,registry:Host@15850,registry:Host@16682,registry:Host@17033,registry:Host@17968,registry:Host@18509,registry:Host@21436,registry:Host@21653,registry:Host@22211,registry:Host@22401,registry:Host@22410,registry:Host@22429,registry:Host@25330,registry:Host@25947,registry:Host@25999,registry:Host@26155,registry:Host@28811,registry:Host@831,registry:Host@902,registry:Host@996,whole:Route@10049,whole:Route@10110,whole:Route@10151,whole:Route@10268,whole:Route@10302,whole:Route@10366,whole:Route@1412,whole:Route@1441,whole:Route@15337,whole:Route@15387,whole:Route@15912,whole:Route@24926,whole:Route@25340,whole:Route@26044,whole:Route@28201,whole:Route@28234,whole:Route@28297,whole:Route@28398,whole:Route@29048,whole:Route@29121,whole:Route@693,whole:Route@721,whole:Route@750,whole:Route@776,whole:Route@9984 b523044621e10b4a702d5e1b8c5ecd843b645cf72b327487ed424f96956a3a7e

+internal/appconfig/syncexec.go SyncExecWithCallbacks legacy accepted-legacy accepted-legacy;rev3=census-ruling-moves-offline-fixes;basis=route-and-input (J1,J4, main's disposition); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos), through syncExecSerialized: main's body, with a nested row whose write found no instance directory named and skipped (errInstanceDirAbsent, WhenInstanceDirAbsent) instead of failing the pass, and each in-scope host reported done or not done (WithHostOutcome) once the pass has gone through every route; no new read site file:Stat@28417,registry:App@10156,registry:App@10371,registry:App@15917,registry:App@28302,registry:Environment@10164,registry:Environment@10379,registry:Environment@15925,registry:Environment@28310,registry:Host@1031,registry:Host@1460,registry:Host@15425,registry:Host@15752,registry:Host@15850,registry:Host@16682,registry:Host@17033,registry:Host@17968,registry:Host@18509,registry:Host@21436,registry:Host@21653,registry:Host@22211,registry:Host@22401,registry:Host@22410,registry:Host@22429,registry:Host@25330,registry:Host@25947,registry:Host@25999,registry:Host@26155,registry:Host@28811,registry:Host@831,registry:Host@902,registry:Host@996,whole:Route@10049,whole:Route@10110,whole:Route@10151,whole:Route@10268,whole:Route@10302,whole:Route@10366,whole:Route@1412,whole:Route@1441,whole:Route@15337,whole:Route@15387,whole:Route@15912,whole:Route@24926,whole:Route@25340,whole:Route@26044,whole:Route@28201,whole:Route@28234,whole:Route@28297,whole:Route@28398,whole:Route@29048,whole:Route@29121,whole:Route@693,whole:Route@721,whole:Route@750,whole:Route@776,whole:Route@9984 b523044621e10b4a702d5e1b8c5ecd843b645cf72b327487ed424f96956a3a7e

+@legacy 062b7343a8fa6be7988022f17181fd4e7e17450b99c3b8c6f9b8ea764b14a22b internal/appconfig/syncexec.go renderExecConfigBefore legacy accepted-legacy accepted-legacy;rev3=census-ruling-moves-offline-fixes;basis=route-and-input (J1,J4, main's disposition); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos), from config sync and the moves worker's held render: main's body with one Lstat of a nested row's instance directory after its write failed, to tell a directory not made yet from any other failure; it follows no link and changes no outcome but the error's kind file:Lstat@3893,file:ReadFile@951,registry:Environment@3190,registry:Host@1070,registry:Host@2586,registry:Host@4088,registry:Host@4320,registry:Host@4576,registry:Host@4669,registry:Host@876,whole:Route@2522,whole:Route@257,whole:Route@3715,whole:Route@680 a60a9a2e2158f3a8dadf6fcf46810930dad89b67d1acc23fb57c324a7d9ac1f1

+internal/appconfig/syncexec.go renderExecConfigBefore legacy accepted-legacy accepted-legacy;rev3=census-ruling-moves-offline-fixes;basis=route-and-input (J1,J4, main's disposition); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos), from config sync and the moves worker's held render: main's body with one Lstat of a nested row's instance directory after its write failed, to tell a directory not made yet from any other failure; it follows no link and changes no outcome but the error's kind file:Lstat@3893,file:ReadFile@951,registry:Environment@3190,registry:Host@1070,registry:Host@2586,registry:Host@4088,registry:Host@4320,registry:Host@4576,registry:Host@4669,registry:Host@876,whole:Route@2522,whole:Route@257,whole:Route@3715,whole:Route@680 a60a9a2e2158f3a8dadf6fcf46810930dad89b67d1acc23fb57c324a7d9ac1f1

+@legacy 4f285d36e7c92102da6a29594cd2bf0de1cae4c88486cb09b59d502fdc670283 internal/host/agent.go configGenLoop legacy accepted-legacy accepted-legacy;rev3=census-ruling-moves-offline-fixes;basis=root-route (J1, main's disposition); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's loop, its tick's body moved into configGenTick; the registry listing stays here whole:Route@1265 a0b36186f7c8abdd818c81c2651a75b202078ad7f197d93b6157bcab97604188

+internal/host/agent.go configGenLoop legacy accepted-legacy accepted-legacy;rev3=census-ruling-moves-offline-fixes;basis=root-route (J1, main's disposition); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's loop, its tick's body moved into configGenTick; the registry listing stays here whole:Route@1265 a0b36186f7c8abdd818c81c2651a75b202078ad7f197d93b6157bcab97604188

+@legacy c9727345192047c534cb2c08fe70d75ed2787e0b37b262aa364dd66a11a1d121 internal/host/agent.go configGenTick legacy accepted-legacy accepted-legacy;rev3=census-ruling-moves-offline-fixes;basis=root-route (J1, as configGenLoop); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, configGenLoop's tick over the routes it listed; it also runs the agent's own config pass once an instance directory the last pass waited for exists whole:Route@268 751870d636c3ea7b3670a7e00c71d085e94ae9b013545e319047a4609f514943

+internal/host/agent.go configGenTick legacy accepted-legacy accepted-legacy;rev3=census-ruling-moves-offline-fixes;basis=root-route (J1, as configGenLoop); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, configGenLoop's tick over the routes it listed; it also runs the agent's own config pass once an instance directory the last pass waited for exists whole:Route@268 751870d636c3ea7b3670a7e00c71d085e94ae9b013545e319047a4609f514943

+@legacy c9582505e641f881ffcfb86213bf2ade68d7118eb11a521e0a45706cd6f3cf65 internal/host/agent.go pendingDirs.appeared legacy accepted-legacy accepted-legacy;rev3=census-ruling-moves-offline-fixes;basis=root-input (J4, as the moves units' isDir and lexists); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, an Lstat that never follows a link, of the instance directories config passes could not write into, with a retry backoff for a host a pass left undone; it decides only whether the agent runs its own config pass again file:Lstat@135 691589305b19ebe4e7311bb853ae68003676786ce0684e6e7133382d26c982c7

+internal/host/agent.go pendingDirs.appeared legacy accepted-legacy accepted-legacy;rev3=census-ruling-moves-offline-fixes;basis=root-input (J4, as the moves units' isDir and lexists); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, an Lstat that never follows a link, of the instance directories config passes could not write into, with a retry backoff for a host a pass left undone; it decides only whether the agent runs its own config pass again file:Lstat@135 691589305b19ebe4e7311bb853ae68003676786ce0684e6e7133382d26c982c7

+@legacy d46b09858688390f1b1f5efe86d3816dbdbe642720081ddbc8acc7e109f53ac4 internal/host/schedule_wiring.go newScheduleDeps legacy accepted-legacy accepted-legacy;rev3=census-ruling-moves-offline-fixes;basis=root-route (J1, main's disposition); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos), from armSchedule: main's body with the runner's Skip set to scheduleSkip; no new read site registry:App@1479,registry:App@388,registry:Host@1546,registry:Host@396,whole:Route@1474,whole:Route@383 aa93bed2781d1005cf864ebaaf6ac4597d6f547c45d6a1063f10c4a483ba46c3

+internal/host/schedule_wiring.go newScheduleDeps legacy accepted-legacy accepted-legacy;rev3=census-ruling-moves-offline-fixes;basis=root-route (J1, main's disposition); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos), from armSchedule: main's body with the runner's Skip set to scheduleSkip; no new read site registry:App@1479,registry:App@388,registry:Host@1546,registry:Host@396,whole:Route@1474,whole:Route@383 aa93bed2781d1005cf864ebaaf6ac4597d6f547c45d6a1063f10c4a483ba46c3

+@legacy e324727c3eaaa15ef864e46a26391bca939383e96f8c2fe9b1b4252478469481 internal/host/schedule_wiring.go scheduleSkip legacy accepted-legacy accepted-legacy;rev3=census-ruling-moves-offline-fixes;basis=root-route (J1, as the runner's own hold checks); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos), from its schedule runner: new, reads a row's status (any hold) and host (the armed offline view: the record names another region) to tell the runner to leave the host alone; it only withholds a tick, never grants one registry:Host@155,registry:Status@64 4f471727429b5b79bfa909693a09e588051b9f490eafd8480ee9893581362d64

+internal/host/schedule_wiring.go scheduleSkip legacy accepted-legacy accepted-legacy;rev3=census-ruling-moves-offline-fixes;basis=root-route (J1, as the runner's own hold checks); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos), from its schedule runner: new, reads a row's status (any hold) and host (the armed offline view: the record names another region) to tell the runner to leave the host alone; it only withholds a tick, never grants one registry:Host@155,registry:Status@64 4f471727429b5b79bfa909693a09e588051b9f490eafd8480ee9893581362d64

+@legacy db611291d2e3616ea5dc6a3dfdb540d850095a2a8e58bab324350e8aff53d789 internal/schedule/runner.go Runner.Tick legacy accepted-legacy accepted-legacy;rev3=census-ruling-moves-offline-fixes;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos), from its scheduler: census-ruling-seeded-instances' body with a host Skip names given no tick and no bookkeeping at the pre-filter, and its due query moved into Runner.dueRows; no root decision registry:Host@1352,registry:Host@1394,registry:Host@1415,registry:Host@1439,registry:Host@5457,registry:ImportGate@2969,registry:ImportGate@3884,registry:Status@2762,registry:Status@3870,whole:Route@1821,whole:Route@2111,whole:Route@2240,whole:Route@3650,whole:Route@3841,whole:Route@4974,whole:Route@5323,whole:Route@5498,whole:Route@5534,whole:Timer@1219,whole:Timer@1323,whole:Timer@1345,whole:Timer@1408,whole:Timer@1432,whole:Timer@1448,whole:Timer@4649,whole:Timer@4978,whole:Timer@5538 0c7ef6fbd18e1be821561b82bd059ffdb5e9ac3fe1a35d3b6e1cb8aada3a9edc

+internal/schedule/runner.go Runner.Tick legacy accepted-legacy accepted-legacy;rev3=census-ruling-moves-offline-fixes;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos), from its scheduler: census-ruling-seeded-instances' body with a host Skip names given no tick and no bookkeeping at the pre-filter, and its due query moved into Runner.dueRows; no root decision registry:Host@1352,registry:Host@1394,registry:Host@1415,registry:Host@1439,registry:Host@5457,registry:ImportGate@2969,registry:ImportGate@3884,registry:Status@2762,registry:Status@3870,whole:Route@1821,whole:Route@2111,whole:Route@2240,whole:Route@3650,whole:Route@3841,whole:Route@4974,whole:Route@5323,whole:Route@5498,whole:Route@5534,whole:Timer@1219,whole:Timer@1323,whole:Timer@1345,whole:Timer@1408,whole:Timer@1432,whole:Timer@1448,whole:Timer@4649,whole:Timer@4978,whole:Timer@5538 0c7ef6fbd18e1be821561b82bd059ffdb5e9ac3fe1a35d3b6e1cb8aada3a9edc

+internal/schedule/runner.go Runner.fire hint E2 accepted-legacy;rev3=census-ruling-moves-offline-fixes;basis=root-route (main: J1) PROPOSED E46: captured claim selection and root journal mutation; root RPC outside service host exclusion; SQL/route data never grants root authority. Executing identity: service controller; root for inventory/retirement callbacks. moves-offline-fixes: with Skip set (only the agent's runner sets it, scheduleSkip), the row is read again before the token and a skipped host gets no token and no record; class and task unchanged registry:Host@243,registry:Host@385,registry:Host@691,registry:Host@837,registry:Name@252,registry:Name@394,registry:Spec@148,registry:Spec@260,whole:Route@1005,whole:Route@1202,whole:Route@1504,whole:Route@1567,whole:Route@1735,whole:Route@662,whole:Route@742,whole:Route@768,whole:Route@879,whole:Timer@1009,whole:Timer@108,whole:Timer@1206,whole:Timer@1306,whole:Timer@1508,whole:Timer@1739,whole:Timer@317,whole:Timer@883 1aaf0e167a6852ab6958cb409aaac63523334b4595e1cb8a0e30ac96f4499e9d

+@legacy a1d5746862e64c4ea2a5b27cfe36565b7b2a11968923461eb6e4dbff72137b36 internal/schedule/runner.go Runner.dueRows legacy accepted-legacy accepted-legacy;rev3=census-ruling-moves-offline-fixes;basis=root-route (J1, as Runner.Tick); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos), from its scheduler: new, Tick's due query moved out of Tick: held hosts left out by the query when the hold wiring is armed or Skip is set, and each host Skip names (one registry row read per host in the batch) added to the exclusion and the batch read again, so a skipped host's rows never fill the limit; it only withholds ticks registry:Host@489,registry:Host@525,registry:Host@567,registry:Host@647,whole:Route@590,whole:Route@611,whole:Timer@186,whole:Timer@264,whole:Timer@366,whole:Timer@388,whole:Timer@472,whole:Timer@699 6e0d3045eebd802a7d3936a84d7fcbd8a9edd2741e5a13ed8c595c7dcfdaa2c1

+internal/schedule/runner.go Runner.dueRows legacy accepted-legacy accepted-legacy;rev3=census-ruling-moves-offline-fixes;basis=root-route (J1, as Runner.Tick); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos), from its scheduler: new, Tick's due query moved out of Tick: held hosts left out by the query when the hold wiring is armed or Skip is set, and each host Skip names (one registry row read per host in the batch) added to the exclusion and the batch read again, so a skipped host's rows never fill the limit; it only withholds ticks registry:Host@489,registry:Host@525,registry:Host@567,registry:Host@647,whole:Route@590,whole:Route@611,whole:Timer@186,whole:Timer@264,whole:Timer@366,whole:Timer@388,whole:Timer@472,whole:Timer@699 6e0d3045eebd802a7d3936a84d7fcbd8a9edd2741e5a13ed8c595c7dcfdaa2c1