carlos / platform Public

provision: re-pin reserveBoxes and the internal/console envelope (Task 3 fix round 1, PROPOSED-self-serve-moves-2)

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

claude 2 days ago 8303ae88f8e8fc1bf93f20d6b4d7b59a398e0007 parent 5ec9c78

3 files changed, +6 −4

docs/superpowers/notes/census-proposal-self-serve-moves-2.md +1 −1
internal/provision/self_serve_moves2_census_test.go +4 −2
internal/provision/testdata/plan14-root-reads-self-serve-moves-2.tsv +1 −1

CI failed — run details

CI log

=== gate ===
.amadan/test-gate.sh
=== launchctx (1 s)
ok  	amadan.net/carlos/platform.git/launchctx	0.013s
?   	amadan.net/carlos/platform.git/launchctx/controlname	[no test files]
?   	amadan.net/carlos/platform.git/launchctx/wireid	[no test files]
=== vet (9 s)
=== gofmt (1 s)
gofmt -l .: clean
=== rest (160 s)
?   	github.com/carlosframework/platform/cmd/changelog	[no test files]
ok  	github.com/carlosframework/platform/cmd/console	3.343s
ok  	github.com/carlosframework/platform/cmd/moveprobe	11.627s
ok  	github.com/carlosframework/platform/cmd/zddprobe	0.736s
ok  	github.com/carlosframework/platform/internal/activator	60.839s
ok  	github.com/carlosframework/platform/internal/agentsock	0.018s
ok  	github.com/carlosframework/platform/internal/alerting	0.005s
ok  	github.com/carlosframework/platform/internal/analytics	0.020s
ok  	github.com/carlosframework/platform/internal/appconfig	2.752s
ok  	github.com/carlosframework/platform/internal/apperr	0.091s
ok  	github.com/carlosframework/platform/internal/applog	0.151s
ok  	github.com/carlosframework/platform/internal/awsinv	0.005s
ok  	github.com/carlosframework/platform/internal/boxchoice	0.005s
ok  	github.com/carlosframework/platform/internal/boxid	1.172s
?   	github.com/carlosframework/platform/internal/boxid/boxidtest	[no test files]
?   	github.com/carlosframework/platform/internal/boxid/internal/signtest	[no test files]
ok  	github.com/carlosframework/platform/internal/boxvolumes	0.009s
ok  	github.com/carlosframework/platform/internal/caps	0.013s
ok  	github.com/carlosframework/platform/internal/certwarm	0.002s
ok  	github.com/carlosframework/platform/internal/cgroup	0.726s
ok  	github.com/carlosframework/platform/internal/changelog	0.371s
ok  	github.com/carlosframework/platform/internal/claimactivation	0.893s
ok  	github.com/carlosframework/platform/internal/clamd	0.055s
?   	github.com/carlosframework/platform/internal/cliflag	[no test files]
?   	github.com/carlosframework/platform/internal/controlname	[no test files]
?   	github.com/carlosframework/platform/internal/controlsock	[no test files]
ok  	github.com/carlosframework/platform/internal/dbdoor	5.764s
ok  	github.com/carlosframework/platform/internal/dbdoor/dbdoortest	0.010s
ok  	github.com/carlosframework/platform/internal/dbverify	0.006s
ok  	github.com/carlosframework/platform/internal/dnsrec	0.005s
ok  	github.com/carlosframework/platform/internal/docsite	0.006s
ok  	github.com/carlosframework/platform/internal/domains	2.820s
ok  	github.com/carlosframework/platform/internal/doorkey	0.006s
ok  	github.com/carlosframework/platform/internal/economics	0.008s
ok  	github.com/carlosframework/platform/internal/edge	45.348s
?   	github.com/carlosframework/platform/internal/edgeproof	[no test files]
ok  	github.com/carlosframework/platform/internal/edgesfile	0.014s
ok  	github.com/carlosframework/platform/internal/fleetapi	0.146s
ok  	github.com/carlosframework/platform/internal/gate	1.690s
ok  	github.com/carlosframework/platform/internal/genselect	0.019s
ok  	github.com/carlosframework/platform/internal/geo	0.017s
ok  	github.com/carlosframework/platform/internal/geoip	0.034s
ok  	github.com/carlosframework/platform/internal/historyreadback	0.157s
ok  	github.com/carlosframework/platform/internal/host	140.320s
ok  	github.com/carlosframework/platform/internal/hostactors	5.247s
ok  	github.com/carlosframework/platform/internal/hostactors/awsmembership	0.009s
ok  	github.com/carlosframework/platform/internal/hostbox	2.941s
ok  	github.com/carlosframework/platform/internal/hostclaim	0.703s
ok  	github.com/carlosframework/platform/internal/hostenv	0.009s
ok  	github.com/carlosframework/platform/internal/hostevidence	0.006s
ok  	github.com/carlosframework/platform/internal/hostexec	5.283s
ok  	github.com/carlosframework/platform/internal/hostfence	0.071s
ok  	github.com/carlosframework/platform/internal/hostfiles	10.315s
ok  	github.com/carlosframework/platform/internal/hostfloor	0.039s
ok  	github.com/carlosframework/platform/internal/hostguard	1.026s
ok  	github.com/carlosframework/platform/internal/hostops	1.942s
?   	github.com/carlosframework/platform/internal/hostops/fencerelease	[no test files]
ok  	github.com/carlosframework/platform/internal/hostops/internal/fencerelease	0.006s
ok  	github.com/carlosframework/platform/internal/hostquarantine	0.006s
ok  	github.com/carlosframework/platform/internal/hostrelocate	0.604s
ok  	github.com/carlosframework/platform/internal/hostresolve	0.221s
ok  	github.com/carlosframework/platform/internal/hostwrite	0.002s
ok  	github.com/carlosframework/platform/internal/infraview	0.006s
ok  	github.com/carlosframework/platform/internal/instancectl	5.225s
ok  	github.com/carlosframework/platform/internal/instanceexec	2.819s
ok  	github.com/carlosframework/platform/internal/instancefs	0.022s
ok  	github.com/carlosframework/platform/internal/instancekey	0.017s
ok  	github.com/carlosframework/platform/internal/instanceupdates	0.039s
ok  	github.com/carlosframework/platform/internal/layout	1.799s
ok  	github.com/carlosframework/platform/internal/lbhealth	0.006s
ok  	github.com/carlosframework/platform/internal/lease	10.104s
ok  	github.com/carlosframework/platform/internal/lease/leasetest	0.540s
ok  	github.com/carlosframework/platform/internal/ledger	0.044s
ok  	github.com/carlosframework/platform/internal/mail	0.213s
ok  	github.com/carlosframework/platform/internal/maintenance	0.110s
ok  	github.com/carlosframework/platform/internal/maintenanceexec	5.528s
ok  	github.com/carlosframework/platform/internal/maintenanceguard	0.089s
ok  	github.com/carlosframework/platform/internal/metrics	0.009s
ok  	github.com/carlosframework/platform/internal/moves	21.420s
ok  	github.com/carlosframework/platform/internal/moves/archive	0.985s
ok  	github.com/carlosframework/platform/internal/objstore	0.294s
ok  	github.com/carlosframework/platform/internal/ops	0.215s
ok  	github.com/carlosframework/platform/internal/park	0.227s
ok  	github.com/carlosframework/platform/internal/plans	0.006s
ok  	github.com/carlosframework/platform/internal/privatefile	0.007s
ok  	github.com/carlosframework/platform/internal/provision	17.605s
ok  	github.com/carlosframework/platform/internal/publicrelease	0.007s
?   	github.com/carlosframework/platform/internal/regionname	[no test files]
ok  	github.com/carlosframework/platform/internal/registry	5.839s
ok  	github.com/carlosframework/platform/internal/relay	7.236s
ok  	github.com/carlosframework/platform/internal/release	24.963s
ok  	github.com/carlosframework/platform/internal/rollout	3.787s
ok  	github.com/carlosframework/platform/internal/rolloutwords	0.003s
ok  	github.com/carlosframework/platform/internal/rootaws	0.008s
ok  	github.com/carlosframework/platform/internal/rootparticipation	0.063s
ok  	github.com/carlosframework/platform/internal/rootstate	0.026s
ok  	github.com/carlosframework/platform/internal/runs	0.596s
ok  	github.com/carlosframework/platform/internal/s3compat	0.007s
ok  	github.com/carlosframework/platform/internal/safefile	0.005s
ok  	github.com/carlosframework/platform/internal/schedule	2.743s
ok  	github.com/carlosframework/platform/internal/seeds	0.014s
ok  	github.com/carlosframework/platform/internal/sim/hostlife	9.990s
ok  	github.com/carlosframework/platform/internal/sim/litestreamfacts	3.934s
ok  	github.com/carlosframework/platform/internal/status	0.103s
ok  	github.com/carlosframework/platform/internal/steering	0.006s
ok  	github.com/carlosframework/platform/internal/stopevidence	0.278s
ok  	github.com/carlosframework/platform/internal/svcrole	0.002s
ok  	github.com/carlosframework/platform/internal/telemetry	0.007s
ok  	github.com/carlosframework/platform/internal/termfence	0.009s
ok  	github.com/carlosframework/platform/internal/tunnelclient	0.004s
ok  	github.com/carlosframework/platform/internal/unixdial	0.009s
ok  	github.com/carlosframework/platform/internal/updatewords	0.005s
ok  	github.com/carlosframework/platform/internal/usage	0.008s
ok  	github.com/carlosframework/platform/internal/version	0.003s
ok  	github.com/carlosframework/platform/internal/vet	1.622s
=== internal_console@0 (88 s)
ok  	github.com/carlosframework/platform/internal/console	86.054s
=== internal_console@1 (39 s)
ok  	github.com/carlosframework/platform/internal/console	37.286s
=== internal_console@2 (38 s)
ok  	github.com/carlosframework/platform/internal/console	35.935s
=== internal_console@3 (46 s)
ok  	github.com/carlosframework/platform/internal/console	43.868s
=== internal_console@4 (41 s)
ok  	github.com/carlosframework/platform/internal/console	39.618s
=== internal_console@5 (42 s)
ok  	github.com/carlosframework/platform/internal/console	40.041s
=== internal_console@6 (49 s)
ok  	github.com/carlosframework/platform/internal/console	47.050s
=== internal_console@7 (45 s)
ok  	github.com/carlosframework/platform/internal/console	43.412s
=== root@0 (29 s)
using http://127.0.0.1:45619 as a@keymail.dev
shipped titesite abc1234
--- FAIL: TestMovesApprovedCopyIsApplied (2.98s)
    approved_moves_copy_test.go:836: MV-O30: internal/console/apiinstancemove_offline.go does not contain the approved text "<other> is moving offline. move one instance at a time"
--- FAIL: TestMovesGateBitesOnTheRealRecord (6.49s)
    approved_moves_copy_test.go:1981: an approved row whose text is not in its file: problems = ["MV-N6: internal/console/apiinstancemove.go does not contain the approved text \"cut must be \\\"automatic\\\" or \\\"manual\\\"\"" "MV-O30: internal/console/apiinstancemove_offline.go does not contain the approved text \"<other> is moving offline. move one instance at a time\""]
    approved_moves_copy_test.go:1990: an approved row whose text is in its file: problems = ["MV-O30: internal/console/apiinstancemove_offline.go does not contain the approved text \"<other> is moving offline. move one instance at a time\""]
2026/10/23 08:25:32 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/23 08:25:32 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/23 08:25:32 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/23 08:25:32 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/23 08:25:32 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/23 08:25:32 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/23 08:25:32 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/23 08:25:32 console: api instances get bab/titogo/probe-titogo.bab.oncarlos.test: read timeout
2026/10/23 08:25:32 console: api instances get bab/titogo/probe-titogo.bab.oncarlos.test: read timeout
2026/10/23 08:25:32 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/23 08:25:33 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/23 08:25:33 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/23 08:25:35 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/23 08:25:35 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/23 08:25:35 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/23 08:25:39 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
FAIL
FAIL	github.com/carlosframework/platform	27.368s
FAIL
=== root@1 (44 s)
ok  	github.com/carlosframework/platform	42.251s
=== root@2 (46 s)
using http://127.0.0.1:46599 as a@keymail.dev
--- FAIL: TestMovesStringsAreRecorded (6.61s)
    approved_moves_copy_test.go:1714: no row of the record carries internal/console/apiinstancemove_offline.go:761 (jsonError) "the instance changed while the move was being started. try again"
    approved_moves_copy_test.go:1714: no row of the record carries internal/console/apiinstancemove_offline.go:825 (jsonError) "the instance changed while the move was being started. try again"
2026/10/23 08:25:39 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/23 08:25:43 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/23 08:25:48 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000000 txid.db=0000000000000001
2026/10/23 08:25:48 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000001 maxTXID=0000000000000001 size=720
2026/10/23 08:25:48 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000001
2026/10/23 08:25:48 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000002
2026/10/23 08:25:48 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000002 maxTXID=0000000000000002 size=370
2026/10/23 08:25:48 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000002 txid.db=0000000000000002
2026/10/23 08:25:50 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000002 txid.db=0000000000000003
2026/10/23 08:25:50 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000003 maxTXID=0000000000000003 size=888
2026/10/23 08:25:50 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000003 txid.db=0000000000000003
2026/10/23 08:25:50 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
using http://127.0.0.1:44773 as paul@keymail.dev
using http://127.0.0.1:44773 as paul@keymail.dev
using http://127.0.0.1:44773 as paul@keymail.dev
Querying a copy of acme.go.tito.io's database, up to transaction 3, written 2026-10-23 08:25:50 UTC. Nothing you run here reaches acme.go.tito.io.
2026/10/23 08:25:50 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/23 08:25:50 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/23 08:25:50 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/23 08:25:50 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
using http://127.0.0.1:37863 as paul@keymail.dev
account: ops (bab)
attached tickets.example.com -> default.go.tito.io
DNS: pointing
using http://127.0.0.1:37863 as paul@keymail.dev
account: ops (bab)
attached carloku.example.com -> default.go.tito.io
2026/10/23 08:25:57 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/23 08:26:01 domains: minted platform domain echoapp.bab.oncarlos.test (upstream app.local)
2026/10/23 08:26:01 domains: minted platform domain site.bab.oncarlos.test (upstream site.local)
2026/10/23 08:26:01 edge: static oldsite/stable: resolve channel: dirstore: apps/bab/oldsite/channels/stable.json: file does not exist — if this deployment predates account-scoped bucket keys its objects are still at apps/oldsite/, which the runtime no longer reads; move them once with: carlos accounts migrate --app oldsite --from legacy --to bab
2026/10/23 08:26:01 domains: minted platform domain blog.mdbbndjqx.oncarlos.test (upstream blog.kass.test)
2026/10/23 08:26:01 domains: minted platform domain blog.gdpkwhwrw.oncarlos.test (upstream blog.woodstar.test)
2026/10/23 08:26:01 domains: minted platform domain oldsite.bab.oncarlos.test (upstream old.test)
2026/10/23 08:26:01 edge: static oldsite/stable: resolve channel: dirstore: apps/bab/oldsite/channels/stable.json: file does not exist — if this deployment predates account-scoped bucket keys its objects are still at apps/oldsite/, which the runtime no longer reads; move them once with: carlos accounts migrate --app oldsite --from legacy --to bab
FAIL
FAIL	github.com/carlosframework/platform	44.589s
FAIL

FAILED: root@0 root@2
make: *** [Makefile:19: test] Error 1

amadan: step gate failed: exit status 2

amadan: job failed at step gate — its output is above, not at the tail of this log

diff --git a/docs/superpowers/notes/census-proposal-self-serve-moves-2.md b/docs/superpowers/notes/census-proposal-self-serve-moves-2.md

index 81b68c520..9a6b3b80a 100644

--- a/docs/superpowers/notes/census-proposal-self-serve-moves-2.md

+++ b/docs/superpowers/notes/census-proposal-self-serve-moves-2.md

@@ -8,4 +8,4 @@ Task 1 (the move-capable token and the self-serve gate) changes no record envelo

Task 2 (the queued state, the receipts, the caller's stamps, the bound write and the open record) adds no root read, class or task. In the root-read overlay one accepted-legacy unit is re-pinned in place under `rev3=PROPOSED-self-serve-moves-2` with a reviewed basis and takes a new frozen fingerprint, so the seal moves: `offlineBegin`, the shared body of `OfflineStart` and `OfflineStage`, now also creates the self-serve move in `offline-queued` for `OfflineQueue` (queued_at, staged_at and precheck_at at the caller's stamp, move.seq set to the record's move_seq, no advance) and records `return_of`. Its one site is still `rec.ActiveRun.Open()`, a method, and its offset moved. The other new transitions, `ProposeStamp`, `Receipt`, `SetRecordMoveAt` and `moves.OpenRecordKey` read no file. The internal/console envelope is re-pinned (Task 1's row replaced in place), and internal/moves and internal/provision are pinned in this overlay. The plan asks for `@fields` rows for the new record fields (`self_serve`, `participants`, `queued_at`, `precheck_at`, `return_of`, `last_move.request`); the census's field rule derives its list from the `internal/registry` structs only, so these provision record fields change no `@fields` row, and none is added. In the record-write inventory `SetRecordMoveAt` is added as a record-writer (`key:SetRecordMoveAt`): SetRecordMove bound to an observed incarnation and record_seq, one attempt through `updateRecordSeeding` and so `WriteRecord`. `setrecordmoveat` joins the census's exact key names, so a writer that moves from `SetRecordMove` to the bound write stays a typed writer in the census rather than leaving it. `updateRecordSeeding` is re-pinned (the expect parameter: nil from every other caller; with it, a read of another incarnation or record_seq is refused before the mutation and the retry loop is skipped), and `updateRecord` and `SetRecordSeed` are re-pinned for passing nil. `moves/offline.go:OpenRecordKey` is a new key-site: `control/offline-moves/<host>/<id>/open.json`, beside the seal and never an instance record; nothing writes it until Task 8. The offline transitions are mutations for the record writers and write nothing themselves. Paul's ruling is still outstanding.

-Task 3 (per-box reservations with a legacy projection and a sentinel, the fenced reclaim and the operator doors' bound admission) adds no root read, class or task, and re-pins no accepted-legacy unit, so the root-read seal does not move. The new code reads no file: `moves.ParseOfflineActive` and `moves.OfflineActiveBody` are pure, and the console's `offlinereserve.go` reads `control/offline-moves/active.json` from the bucket and the instance record only through the judged reader (`observeRecord`) and plan 1's `fenceRecord`. The internal/console and internal/moves envelopes are re-pinned in place (Task 2's rows replaced). In the record-write inventory, `active.json`'s table form is a new write shape: `Server.reserveBoxes` and `Server.releaseBoxes` are added as nonrecord units (`sel:Put`): their only writes are that control key, a conditional Put under the ETag they read (create-only when absent) and, for release, a DeleteIfMatch when the table empties. `Server.offlineTakeLock`, the one-move lock's writer, is removed. `Server.offlineApplyBound` is added as a record-writer (`key:SetRecordMoveAt`): the start and stage doors' one transition bound to the incarnation and record_seq of the judged record the gate read before reserving. The reclaim's only record write is `fenceRecord`'s (WriteRecord, plan 1), reached under the holder's app lock then hostname exclusion and only once `admit` passes. Paul's ruling is still outstanding.

+Task 3 (per-box reservations with a legacy projection and a sentinel, the fenced reclaim and the operator doors' bound admission) adds no root read, class or task, and re-pins no accepted-legacy unit, so the root-read seal does not move. The new code reads no file: `moves.ParseOfflineActive` and `moves.OfflineActiveBody` are pure, and the console's `offlinereserve.go` reads `control/offline-moves/active.json` from the bucket and the instance record only through the judged reader (`observeRecord`) and plan 1's `fenceRecord`. The internal/console and internal/moves envelopes are re-pinned in place (Task 2's rows replaced). In the record-write inventory, `active.json`'s table form is a new write shape: `Server.reserveBoxes` and `Server.releaseBoxes` are added as nonrecord units (`sel:Put`): their only writes are that control key, a conditional Put under the ETag they read (create-only when absent) and, for release, a DeleteIfMatch when the table empties. `Server.offlineTakeLock`, the one-move lock's writer, is removed. `Server.offlineApplyBound` is added as a record-writer (`key:SetRecordMoveAt`): the start and stage doors' one transition bound to the incarnation and record_seq of the judged record the gate read before reserving. The reclaim's only record write is `fenceRecord`'s (WriteRecord, plan 1), reached under the holder's app lock then hostname exclusion and only once `admit` passes. Paul's ruling is still outstanding. Task 3's fix round 1 re-pins `Server.reserveBoxes` (the reclaim answers held, unreadable or reclaimed, so an unreadable holder keeps today's 502; two lost races answer busy) and the internal/console envelope; no write or read site changes.

diff --git a/internal/provision/self_serve_moves2_census_test.go b/internal/provision/self_serve_moves2_census_test.go

index e53d0d814..0d2d012a0 100644

--- a/internal/provision/self_serve_moves2_census_test.go

+++ b/internal/provision/self_serve_moves2_census_test.go

@@ -55,7 +55,9 @@ package provision

// Put under the ETag read, create-only when absent; releaseBoxes also

// DeleteIfMatch). The reclaim's record write is fenceRecord's (plan 1,

// WriteRecord), reached under the holder's app lock and hostname

-// exclusion; its pre-fence read is observeRecord.

+// exclusion; its pre-fence read is observeRecord. Fix round 1

+// re-pins reserveBoxes (the reclaim's three-way verdict; two lost

+// races answer busy); its write is unchanged.

func plan14SelfServeMoves2WriteCensusInventory() []censusEntry {

removed := []struct{ file, unit string }{

{"internal/console/apiinstancemove.go", "Server.handleAPIInstanceMoveRequest"},

@@ -72,7 +74,7 @@ func plan14SelfServeMoves2WriteCensusInventory() []censusEntry {

{"internal/provision/provision.go", "SetRecordMoveAt", "record-writer", "key:SetRecordMoveAt", "e818d6acd4429185c5fc11db4100a73b2d83409b9f6f32435e88aac7f9012f41"},

{"internal/moves/offline.go", "OpenRecordKey", "key-site", "key:OpenRecordKey", "ebb4f0dcd050b5d183b642829423ba71740bf6d86427af2cba64475d54276be9"},

{"internal/console/apiinstancemove_offline.go", "Server.offlineApplyBound", "record-writer", "key:SetRecordMoveAt", "039573bfd1f3ec621474e9c761f55ce301227d812f4dd6a7d206dad0c18b9980"},

- {"internal/console/offlinereserve.go", "Server.reserveBoxes", "nonrecord", "sel:Put", "15d70cf3aacf38f7ebb1fc0a55a35e1b233dbb23d15c46c2487858e4af18229d"},

+ {"internal/console/offlinereserve.go", "Server.reserveBoxes", "nonrecord", "sel:Put", "d8f9896e36b25b8dd9e2d25df30b3f2b01a08259a7ee1952299d4e1015bba48f"},

{"internal/console/offlinereserve.go", "Server.releaseBoxes", "nonrecord", "sel:Put", "0d7cad2d3a92890c10d7a538784713124d3659d89c872e75fbc107bf96794751"},

}

entries := plan14SelfServeMoves1WriteCensusInventory()

diff --git a/internal/provision/testdata/plan14-root-reads-self-serve-moves-2.tsv b/internal/provision/testdata/plan14-root-reads-self-serve-moves-2.tsv

index 5f83cbfa4..2a256c912 100644

--- a/internal/provision/testdata/plan14-root-reads-self-serve-moves-2.tsv

+++ b/internal/provision/testdata/plan14-root-reads-self-serve-moves-2.tsv

@@ -23,5 +23,5 @@ internal/console/templates/settings.html external legacy accepted-legacy accepte

internal/provision/offline_move.go offlineBegin legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=root-input (J4, as OfflineStart); the console (cmd/console serve under console.service, user carlos-console): self-serve moves 1 Task 7's body (OfflineStart's, the state a parameter; a direct start advances move_seq and stamps move.seq, refusing ErrLifetimeExhausted at MaxInt64 before any write), and it now also creates the self-serve move in offline-queued for OfflineQueue (queued_at, staged_at and precheck_at at the caller's stamp, move.seq set to the record's move_seq, no advance) and records return_of; a stage and a queue hold nothing; its one site is still rec.ActiveRun.Open(), a method on the record's run state (RunState.Open), not a file read; self-serve moves 2 Task 2 file:Open@208 0a9b432ddf2f39a977c0651e377258b35c1d05635e9979583eeac6253d6c0ec8

@coverage internal/provision 177bbc7f94d9ba7e4d999f832920e8552a0af4315d7ce2445572efb21fada342

# Task 3 (per-box reservations with a legacy projection and a sentinel, the fenced reclaim and the operator doors' bound admission), rev3=PROPOSED-self-serve-moves-2: no root read, class or task is added and no accepted-legacy unit is re-pinned, so the seal does not move. The new units (moves.ParseOfflineActive, moves.OfflineActiveBody, the console's offlinereserve.go, the doors' offlineApplyBound and offlineAdvanceBound) read no file: their reads are the bucket's control/offline-moves/active.json and the instance record through the judged readers and fenceRecord. Envelopes re-pinned in place (Task 2's rows replaced): internal/console (offlinereserve.go, the start and stage doors, the Server's two evidence fields) and internal/moves (the reservation table in offline.go).

-@coverage internal/console 7e63ab646b55ccc0d48592ca79d8c214165271439b8bc6336aacca6b49ae5059

+@coverage internal/console 55df205ec0e85b6e40263c55a6673a715a385c15b3bbc33a119f110dd59eecd9

@coverage internal/moves 7fcb4834a033d8cea99621143ba2afcbf14568c9467f08329af7c692d0c1359b