carlos / platform Public

census: Task 1's fix round 2 re-pins the internal/host and internal/offlinecleanup envelopes in the plan 4 overlay

No frozen unit moves and the seal is unchanged.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

claude 19 hours ago 8c689f85c42d32891442a79f28a8b9df410af07f parent 3ff5cd5

2 files changed, +5 −2

docs/superpowers/notes/census-proposal-self-serve-moves-4.md +2 −0
internal/provision/testdata/plan14-root-reads-self-serve-moves-4.tsv +3 −2

diff --git a/docs/superpowers/notes/census-proposal-self-serve-moves-4.md b/docs/superpowers/notes/census-proposal-self-serve-moves-4.md

index 5d6c661a2..2c626ec75 100644

--- a/docs/superpowers/notes/census-proposal-self-serve-moves-4.md

+++ b/docs/superpowers/notes/census-proposal-self-serve-moves-4.md

@@ -37,6 +37,8 @@ Eight new units are frozen as accepted legacy. All run in the agent (`carlos-edg

Envelopes added or re-pinned: `internal/host`, `internal/lease/leasetest` and `internal/offlinecleanup`.

+Task 1's fix round 2 (`8c258e1b`) moves no frozen unit. It re-pins the `internal/host` and `internal/offlinecleanup` envelopes in place, and the seal is unchanged.

## Task 2a: the table's kinds, epoch and rev, and its single-attempt writes

One new unit is frozen as accepted legacy: `internal/moves/reserve.go:newEpoch`, J4 root-input. It reads crypto/rand for the reservation table's 16-byte epoch, as the console's other random ids do. It runs in the console and, armed, in the agent. Root reads the table only through `moves.PeekActive`, which never reaches it. The table's readers, its release and its writes read no file.

diff --git a/internal/provision/testdata/plan14-root-reads-self-serve-moves-4.tsv b/internal/provision/testdata/plan14-root-reads-self-serve-moves-4.tsv

index e390d329d..68af5109c 100644

--- a/internal/provision/testdata/plan14-root-reads-self-serve-moves-4.tsv

+++ b/internal/provision/testdata/plan14-root-reads-self-serve-moves-4.tsv

@@ -1,5 +1,6 @@

# Census overlay self-serve-moves-4, marked rev3=PROPOSED-self-serve-moves-4 (not an accepted ruling; docs/superpowers/notes/census-proposal-self-serve-moves-4.md). Loaded after the self-serve-moves-3 overlay.

# Task 1 (the obligation and its evidence at gone) with its fix round 1, rev3=PROPOSED-self-serve-moves-4: no record envelope changes and no root read class or task is added beyond accepted-legacy. movesWorker.offlineSourceGone (accepted legacy since census-ruling-moves-offline) records the cleanup obligation on the sealing source box before its gone report and is re-pinned in place (read site unchanged, offsets moved). Four new units of internal/host/movescleanup_retired.go (scanRetired, moveAsideCorrupt, writeCorruptStub, writeSyncedTemp) and four of internal/offlinecleanup (Identify, RootOnlyChain, RootOnlyDir, and fstatat in its amd64 and arm64 files) are frozen accepted-legacy with reviewed bases: the agent as carlos in its own data directory, Lstat, Readlink, fstat and fstatat metadata reads that never follow a link, one ReadFile of a regular file the agent wrote, and two units with no production caller until Tasks 6b and 6c, which re-pin them with root's process. Envelopes added or re-pinned: internal/host, internal/lease/leasetest, internal/offlinecleanup.

+# Task 1 fix round 2 (8c258e1b), rev3=PROPOSED-self-serve-moves-4: a box with no hibernate region still records its obligation and one with no versioned store never holds gone back. No frozen unit moves and the seal is unchanged; the internal/host and internal/offlinecleanup envelopes are re-pinned in place.

# Task 2a (the table's kinds, epoch and rev, and its single-attempt writes), rev3=PROPOSED-self-serve-moves-4: moves.newEpoch is new and frozen accepted-legacy (J4 root-input, crypto/rand for the table's epoch, as the console's other random ids); the table's readers, release and writes read no file. release gains SingleAttemptPutter and PutOnce (S3Store, DirStore, prefixStore), which read nothing. The record-write census gains PutOnce as a write method (plan14SelfServeMoves4WriteCensusInventory). The seal moves. Envelopes re-pinned: internal/moves, internal/release.

@legacy 74fb3b90400ab84ce62dbd77469e292595d9ad5f463f71f6553d0a090c515383 internal/host/movescleanup_retired.go moveAsideCorrupt legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-4;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, self-serve moves 4 Task 1: moves a damaged retired.json aside create-only: an Lstat of the file, os.Link to the first free retired.json.corrupt-<n> (a name already holding the same inode, by Lstat and os.SameFile, counts as the target, which covers a crash after the link), os.Remove of the original and a directory fsync; reads no content; a link refused for permission is errRetiredUnmovable (fix round 1); scanRetired's only file:Lstat@514,file:Lstat@65 3125aba7d2f7910dbe8fd4624ebd44dc71d4a8c5574cb2d268f777b1c191188a

internal/host/movescleanup_retired.go moveAsideCorrupt legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-4;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, self-serve moves 4 Task 1: moves a damaged retired.json aside create-only: an Lstat of the file, os.Link to the first free retired.json.corrupt-<n> (a name already holding the same inode, by Lstat and os.SameFile, counts as the target, which covers a crash after the link), os.Remove of the original and a directory fsync; reads no content; a link refused for permission is errRetiredUnmovable (fix round 1); scanRetired's only file:Lstat@514,file:Lstat@65 3125aba7d2f7910dbe8fd4624ebd44dc71d4a8c5574cb2d268f777b1c191188a

@@ -23,8 +24,8 @@ internal/offlinecleanup/layout_linux.go Identify legacy accepted-legacy accepted

internal/offlinecleanup/layout_linux.go RootOnlyChain legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-4;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, self-serve moves 4 Task 1: judges a directory chain root-only: an Lstat of each directory from / (or from an e2e trust base, SetTrustForE2E) down to dir, none followed, each a directory owned by uid 0 and writable by no one else; reads no content; called from recordRetired's localInventory through moveCfg.rootOnlyChain; Tasks 6b and 6c's root checks re-pin this row with their process file:Lstat@375 95eb4ec59b23f2497e06e55b0fa73c942f414c485f03d015a9405beb555e15c1

@legacy 036ee28f00d6dbe7cdc060fe710b3d77ded995f815fd4685178a8ac7c381a409 internal/offlinecleanup/layout_linux.go RootOnlyDir legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-4;basis=no production caller yet: self-serve moves 4 Task 1 declares it for Task 6c's root step: an fstat (File.Stat) of a directory the caller already opened, judged owned by uid 0 and writable by no one else; reads no content; Task 6c re-pins this row with the root adopt pass's process when it calls it file:Stat@62 5be2487694449a4d06ea5f73bfd1c7c4e5247624e8d59fe02fc304481775159a

internal/offlinecleanup/layout_linux.go RootOnlyDir legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-4;basis=no production caller yet: self-serve moves 4 Task 1 declares it for Task 6c's root step: an fstat (File.Stat) of a directory the caller already opened, judged owned by uid 0 and writable by no one else; reads no content; Task 6c re-pins this row with the root adopt pass's process when it calls it file:Stat@62 5be2487694449a4d06ea5f73bfd1c7c4e5247624e8d59fe02fc304481775159a

-@coverage internal/host 7f2b551f39aeb3e76f45e574fea3cc621a7832d77ff648b7d1fb6585695eb6c1

+@coverage internal/host 9e3d57f0d449e3b793cf02e4759549565e2662f27f8d005789dab7070154a7ca

@coverage internal/lease/leasetest d6b128f048755ffda4632f43a2d417ebe2cb8a81a4e2b296c99ac83af8132f4f

@coverage internal/moves b5127759ebfc0b2ca957129deac0dcc3ae1255690669662215457354e146a2f8

-@coverage internal/offlinecleanup f3b6902a49c5cd9d7b8567d0e81b3806e9d853524554fcf1981113b519d3202a

+@coverage internal/offlinecleanup db9a962a529e985617d69ddc80ebf0dc128e6d5f229e3547613a321e63cb2778

@coverage internal/release ea549ae64c23cd49fccba2c5e298f883f9a94cb10fff10f227b6d884b7ccd0c5