carlos / platform Public

moves-copy-drift

Squashed from moves-copy-drift into main.

claude 2 weeks ago 9426318718587a2b4db3a6219805866292ff8c09 parent 316a076

7 files changed, +127 −57

docs/superpowers/plans/2026-10-06-moves-phase1-copy.md +40 −25
internal/console/apiinstancemove.go +3 −1
internal/host/movesfloor.go +10 −2
internal/host/systemapply.go +7 −5
internal/moves/archive/archive.go +33 −10
internal/moves/readiness.go +3 −4
internal/provision/provision.go +31 −10

CI passed — run details

diff --git a/docs/superpowers/plans/2026-10-06-moves-phase1-copy.md b/docs/superpowers/plans/2026-10-06-moves-phase1-copy.md

index ba8067f97..19458f100 100644

--- a/docs/superpowers/plans/2026-10-06-moves-phase1-copy.md

+++ b/docs/superpowers/plans/2026-10-06-moves-phase1-copy.md

@@ -26,9 +26,9 @@ Columns: id, file, text, status.

@@ -51,10 +51,10 @@ Columns: id, file, text, status.

@@ -79,26 +79,26 @@ Columns: id, file, text, status.

@@ -111,27 +111,27 @@ Columns: id, file, text, status.

| MV-N93 | internal/host/systemapply.go | <refusal>; the root passes paused for the install could not be started again: <error>. the next apply or recovery starts them | approved |

| MV-N94 | internal/host/systemapply.go | <refusal>; the root passes paused for the install could not be started again: <error>, and the retry could not be recorded: <error>. the journal stays for the next recovery | approved |

@@ -144,8 +144,8 @@ Columns: id, file, text, status.

@@ -273,6 +273,21 @@ Columns: id, file, text, status.

Paul approved the wording of all 205 rows then pending (M-C1 to M-C22 and MV-N1 to MV-N183), with no edits. 160 are marked approved above: their code already speaks the approved text.

-The other 45 stay `pending` here only because the copy gate requires an approved row's text to appear in its file. Their wording is approved and final. Each flips to approved, verbatim, in the commit that makes its file speak it: the CLI and paging strings when Plans 5 and 6 build them, and the drifted ones when their code is brought back to the approved text. The 45 rows are: M-C1, M-C10, M-C11, M-C12, M-C13, M-C14, M-C15, M-C16, M-C18, M-C19, M-C2, M-C20, M-C22, M-C3, M-C4, M-C5, M-C6, M-C7, M-C8, M-C9, MV-N105, MV-N106, MV-N11, MV-N12, MV-N129, MV-N13, MV-N14, MV-N146, MV-N15, MV-N40, MV-N41, MV-N42, MV-N43, MV-N44, MV-N45, MV-N52, MV-N54, MV-N59, MV-N72, MV-N77, MV-N79, MV-N80, MV-N81, MV-N86, MV-N92.

+The other 45 were `pending` only because the copy gate requires an approved row's text to appear in its file. Their wording is approved and final. 24 are now `approved`: their code was brought back to the approved text (18 rows: MV-N12, MV-N13, MV-N14, MV-N15, MV-N40 to MV-N45, MV-N52, MV-N59, MV-N77, MV-N80, MV-N86, MV-N92, MV-N105, MV-N106), or the row's File cell was corrected to the file that says it (6 rows, now `internal/host/movesphase1.go`: M-C14, M-C15, M-C16, MV-N72, MV-N79, MV-N81).

+21 stay `pending`. Each flips to approved, verbatim, in the commit that makes its file speak it.

+Not built yet (18):

+- M-C1 to M-C12, M-C18 and M-C22 (14 rows, `move.go`): the `carlos move` CLI is Plan 6, and no `move.go` exists.

+- M-C13 and M-C19 (`internal/console/apiinstancemove.go`, `internal/console/apiinstances.go`): the abort refusal after the cut started and the delete door's refusal during a move. Plan 5 Task 8 lists both as Plan 6 copy; no code says either.

+- M-C20 (`internal/host/movespaging.go`): the paging sentence is Plan 5, and no `movespaging.go` exists.

+- MV-N11 (`internal/console/apiinstancemove.go`): the declare-lost door is Plan 4 Task 10. `resolve` answers "nothing to resolve yet" to anything but a retry.

+Built, but the gate cannot read the row (3), so the row stays pending until Paul rules on how it is gated:

+- MV-N54: the row ends in a list template, `<sqid> ("<name>"), ...`. The code builds that list at run time (`apicli.go`) and joins it into the sentence, so the sentence is never one literal ending in `, ...`. Making it so would print a literal `...`.

+- MV-N129: the same, `<NAME (kind)>, ...`; `t3Differs` in `internal/host/movesreport.go` joins the names it found.

+- MV-N146: the row's text carries a note, `(MV-N68 with a new <which>)`. The code says `no fresh rate measurement for the disk's per-file sync` through MV-N68's `NoFreshRate`, which is correct; the note is not a part of any sentence the code could say.

Rows added after this review (MV-N184 onward, MV-N300 onward) still need review.

diff --git a/internal/console/apiinstancemove.go b/internal/console/apiinstancemove.go

index ac38b9e06..6ff8122ee 100644

--- a/internal/console/apiinstancemove.go

+++ b/internal/console/apiinstancemove.go

@@ -118,7 +118,9 @@ func phase1MoveCopy() moveCopy {

ambiguous: func(seg, alts string) string {

return fmt.Sprintf("account %q is ambiguous. pass --account-id with one of: %s", seg, alts)

- tooMany: func(noun string) string { return "too many " + noun + " requests. wait a minute and try again" },

+ // moveGate asks the family's gate for the noun "instance" and no

+ // other, so the recorded sentence (MV-N52) is written whole.

+ tooMany: func(string) string { return "too many instance requests. wait a minute and try again" },

noBucket: "this console has no deployment bucket, so it cannot answer this",

kind: func(k string) string { return "only exec-backed instances move. this route is kind " + k },

diff --git a/internal/host/movesfloor.go b/internal/host/movesfloor.go

index 8203cabbe..11b378d61 100644

--- a/internal/host/movesfloor.go

+++ b/internal/host/movesfloor.go

@@ -200,6 +200,14 @@ func floorRegression(local, remote *moves.Floor) error {

// less than what is published.

var errFloorWrite = errors.New("could not write it on this box")

+// floorWriteError is errFloorWrite with what the write said. Its text is

+// what it always was ("could not write it on this box: <cause>"); armFloor

+// reads cause to say the recorded sentence whole (copy record MV-N92).

+type floorWriteError struct{ cause error }

+func (e *floorWriteError) Error() string { return fmt.Sprintf("%v: %v", errFloorWrite, e.cause) }

+func (e *floorWriteError) Is(target error) bool { return target == errFloorWrite }

// syncLocalFloor is the rule root's apply and the agent's refresh share:

// read the published floor and make the local files say the same. It

// returns the floor on disk afterwards, nil when none is armed.

@@ -250,14 +258,14 @@ func syncLocalFloor(ctx context.Context, s release.Store, dataDir string) (*move

}

if err := writeFloorFiles(d, *remote); err != nil {

out, _ = readLocalFloor(dataDir)

- return fmt.Errorf("%w: %v", errFloorWrite, err)

+ return &floorWriteError{cause: err}

}

out = remote

return nil

})

if !ran {

out, _ = readLocalFloor(dataDir)

- return out, fmt.Errorf("%w: %v", errFloorWrite, err)

+ return out, &floorWriteError{cause: err}

}

return out, err

}

diff --git a/internal/host/systemapply.go b/internal/host/systemapply.go

index 09330955d..144c37edd 100644

--- a/internal/host/systemapply.go

+++ b/internal/host/systemapply.go

@@ -835,8 +835,9 @@ func (a *systemApplier) armFloor(ctx context.Context) error {

if err == nil {

return nil

}

- if errors.Is(err, errFloorWrite) {

- return fmt.Errorf("%w: moves protocol floor: %v", errSystemDeferred, err)

+ var fw *floorWriteError

+ if errors.As(err, &fw) {

+ return fmt.Errorf("%w: %s", errSystemDeferred, fmt.Sprintf("moves protocol floor: could not write it on this box: %v", fw.cause))

}

onDisk := "none"

if f != nil {

@@ -967,7 +968,7 @@ func (a *systemApplier) activationGuard(target, running string, fn func() error)

return err

}

if errors.Is(err, errFloorLockBusy) {

- return activationDeferred{fmt.Errorf("moves protocol floor: %v; this waits for the next run", errFloorLockBusy)}

+ return activationDeferred{errors.New("moves protocol floor: another writer holds the floor lock on this box; this waits for the next run")}

}

if floorLockCannotExist(err) && !a.floorArmed() {

a.ops.logf("system apply: moves protocol floor lock: %v (no floor is armed, and none can be on this box; continuing)", err)

@@ -1616,9 +1617,10 @@ func (a *systemApplier) restoreFiles(ctx context.Context, j *systemJournal) (boo

// before any early refusal. The caller keeps the journal.

if !renamed {

if rerr := a.rearm(prior); rerr != nil {

- err = fmt.Errorf("%w; the root passes paused for the restore could not be started again: %v", err, rerr)

if nerr := a.notePendingRearm(prior); nerr != nil {

- err = fmt.Errorf("%w, and the retry could not be recorded: %v", err, nerr)

+ err = fmt.Errorf("%w; the root passes paused for the restore could not be started again: %v, and the retry could not be recorded: %v", err, rerr, nerr)

+ } else {

+ err = fmt.Errorf("%w; the root passes paused for the restore could not be started again: %v", err, rerr)

}

diff --git a/internal/moves/archive/archive.go b/internal/moves/archive/archive.go

index 08fa24ece..648743084 100644

--- a/internal/moves/archive/archive.go

+++ b/internal/moves/archive/archive.go

@@ -48,7 +48,7 @@ var (

// (errors.Is sees it), Path the file as Build names it (relative to the

// files directory, or the env file's base name). It lets a caller say

// which file in its own words without reading the error's text; Error() is

-// the text the sentinel's rows record (MV-N77, MV-N81, MV-N86).

+// the text the sentinel's rows record (MV-N77, MV-N80, MV-N81, MV-N86).

type PathError struct {

Err error

Path string

@@ -63,8 +63,28 @@ func (e *PathError) Error() string {

}

func (e *PathError) Unwrap() error { return e.Err }

-func pathError(sentinel error, path, suffix string) error {

- return &PathError{Err: sentinel, Path: path, msg: sentinel.Error() + ": " + path + suffix}

+// The refusals that name a file, each one whole recorded sentence (copy

+// record MV-N77, MV-N80, MV-N81 and MV-N86) so the copy gate can read it.

+// Err is the sentinel errors.Is sees; the text is the sentinel's, a colon

+// and the path, as the rows say.

+func specialFileError(path string) error {

+ return &PathError{Err: ErrSpecialFile, Path: path, msg: fmt.Sprintf("archive: only regular files and directories move: %s", path)}

+func hardLinkError(path string) error {

+ return &PathError{Err: ErrSpecialFile, Path: path, msg: fmt.Sprintf("archive: only regular files and directories move: %s is a hard link", path)}

+func changedError(path string) error {

+ return &PathError{Err: ErrChanged, Path: path, msg: fmt.Sprintf("archive: a file changed while it was being archived: %s", path)}

+// The row says 4096, so the sentence does; this fails to compile if

+// MaxPathLen is ever changed without the row.

+const _ = uint(MaxPathLen-4096) + uint(4096-MaxPathLen)

+func longPathError(path string) error {

+ return &PathError{Err: ErrBadPath, Path: path, msg: fmt.Sprintf("archive: refused path: %s is longer than 4096 bytes", path)}

}

// The limits as enforced. Variables only so tests can lower them; nothing

@@ -142,10 +162,10 @@ func walk(root *os.Root, envPath string) ([]item, error) {

return err

}

if !info.Mode().IsRegular() && !info.IsDir() {

- return pathError(ErrSpecialFile, p, "")

+ return specialFileError(p)

}

if len(p) > MaxPathLen {

- return pathError(ErrBadPath, p, fmt.Sprintf(" is longer than %d bytes", MaxPathLen))

+ return longPathError(p)

}

return add(item{name: FilesPrefix + p, rel: p, root: root, info: info})

})

@@ -160,7 +180,7 @@ func walk(root *os.Root, envPath string) ([]item, error) {

case err != nil:

return nil, err

case !info.Mode().IsRegular():

- return nil, pathError(ErrSpecialFile, filepath.Base(envPath), "")

+ return nil, specialFileError(filepath.Base(envPath))

default:

if err := add(item{name: EnvEntry, path: envPath, info: info}); err != nil {

return nil, err

@@ -199,7 +219,7 @@ func openItemChecked(it item) (io.ReadCloser, error) {

}

if !got.Mode().IsRegular() || !os.SameFile(it.info, got) {

f.Close()

- return nil, fmt.Errorf("%w: %s", ErrChanged, displayName(it))

+ return nil, changedError(displayName(it))

}

// Phase 1 does not carry hard links. os.Root constrains names, not

// inodes: a pre-existing link to a file outside the instance directory

@@ -207,7 +227,7 @@ func openItemChecked(it item) (io.ReadCloser, error) {

// carry the outside inode to the target. Counted on the opened file.

if linkCount(got) > 1 {

f.Close()

- return nil, pathError(ErrSpecialFile, displayName(it), " is a hard link")

+ return nil, hardLinkError(displayName(it))

}

return f, nil

}

@@ -262,6 +282,8 @@ func openFilesRoot(filesDir string) (*os.Root, error) {

return nil, err

}

if !info.IsDir() {

+ // The files root itself is not a directory: untyped, so the caller

+ // reports it as the files failing to archive, never as a <path>.

return nil, fmt.Errorf("%w: %s", ErrSpecialFile, filesDir)

}

root, err := os.OpenRoot(filesDir)

@@ -275,6 +297,7 @@ func openFilesRoot(filesDir string) (*os.Root, error) {

}

if !os.SameFile(info, got) {

root.Close()

+ // The root itself, not a file in it: untyped, as above.

return nil, fmt.Errorf("%w: %s", ErrChanged, filesDir)

}

return root, nil

@@ -345,7 +368,7 @@ func copyItem(tw io.Writer, it item, size int64) (Entry, error) {

fh := sha256.New()

n, err := io.CopyN(io.MultiWriter(tw, fh), rc, size)

if errors.Is(err, io.EOF) {

- return Entry{}, fmt.Errorf("%w: %s", ErrChanged, displayName(it))

+ return Entry{}, changedError(displayName(it))

}

if err != nil {

return Entry{}, err

@@ -353,7 +376,7 @@ func copyItem(tw io.Writer, it item, size int64) (Entry, error) {

var one [1]byte

m, err := io.ReadFull(rc, one[:])

if m > 0 {

- return Entry{}, fmt.Errorf("%w: %s", ErrChanged, displayName(it))

+ return Entry{}, changedError(displayName(it))

}

if err != io.EOF {

return Entry{}, err

diff --git a/internal/moves/readiness.go b/internal/moves/readiness.go

index 4dfa55cef..937f49c4b 100644

--- a/internal/moves/readiness.go

+++ b/internal/moves/readiness.go

@@ -164,11 +164,10 @@ func (r TargetReport) Passing() (bool, string) {

return false, id + " was not reported"

}

if !c.OK {

- reason := c.Reason

- if reason == "" {

- reason = "did not pass"

+ if c.Reason == "" {

+ return false, id + ": did not pass"

}

- return false, id + ": " + reason

+ return false, id + ": " + c.Reason

}

return true, ""

diff --git a/internal/provision/provision.go b/internal/provision/provision.go

index cbc74a44f..b8f125f71 100644

--- a/internal/provision/provision.go

+++ b/internal/provision/provision.go

@@ -1148,6 +1148,19 @@ const (

// re-reads.

var ErrMoveConflict = errors.New("provision: move state conflict")

+// The move refusals that name no value (copy record MV-N12, MV-N14, MV-N15,

+// MV-N40, MV-N41 and, for the legacy abort, MV-N45). Each is a whole recorded

+// sentence, so the copy gate can read it; the ones that name a value (MV-N13,

+// MV-N42, MV-N43, MV-N44) are written in place as one format.

+const (

+ refusedNoMove = "no move in flight"

+ refusedNoJournaledMove = "no journaled move in flight"

+ refusedMalformedStart = "malformed move start"

+ refusedPastNoReturn = "past the point of no return. the cut completes forward or moves back on its own"

+ refusedCutNotReady = "cut is only legal from ready"

+ refusedAlreadyAborting = "already aborting"

// SetRecordMove applies one guarded move transition: the same narrow

// read-CAS-write with one retry that SetRecordRegion uses (and for the same

// reason — re-reading and re-applying a transition on a lost race changes

@@ -1206,16 +1219,16 @@ type MoveStart struct {

func MoveStartTransition(p MoveStart) func(*Record) error {

return func(rec *Record) error {

if rec.Move != nil {

- return fmt.Errorf("%w: a move to %s is already %s", ErrMoveConflict, rec.Move.To, rec.Move.State)

+ return fmt.Errorf("%w: %s", ErrMoveConflict, fmt.Sprintf("a move to %s is already %s", rec.Move.To, rec.Move.State))

}

if !moveIDShape.MatchString(p.ID) || len(p.Incarnation) != 64 || (p.Cut != "auto" && p.Cut != "manual") || p.Now.IsZero() {

- return fmt.Errorf("%w: malformed move start", ErrMoveConflict)

+ return fmt.Errorf("%w: %s", ErrMoveConflict, refusedMalformedStart)

}

if rec.Region == p.To || p.From != rec.Region {

return fmt.Errorf("%w: the instance is already in %s", ErrMoveConflict, rec.Region)

}

if rec.Role != "" {

- return fmt.Errorf("%w: a %s does not move. delete it and create one in the new region", ErrMoveConflict, rec.Role)

+ return fmt.Errorf("%w: %s", ErrMoveConflict, fmt.Sprintf("a %s does not move. delete it and create one in the new region", rec.Role))

}

rec.Move = &MoveState{ID: p.ID, Incarnation: p.Incarnation, From: p.From, To: p.To, Cut: p.Cut, State: MovePreparing, RequestedBy: p.By, RequestedAt: p.Now.UTC()}

return nil

@@ -1247,10 +1260,10 @@ type MoveGuard struct{ ID, Incarnation string }

func (g MoveGuard) check(rec *Record) error {

if rec.Move == nil || rec.Move.Legacy() {

- return fmt.Errorf("%w: no journaled move in flight", ErrMoveConflict)

+ return fmt.Errorf("%w: %s", ErrMoveConflict, refusedNoJournaledMove)

}

if rec.Move.ID != g.ID || rec.Move.Incarnation != g.Incarnation {

- return fmt.Errorf("%w: the record's move is %s for incarnation %s", ErrMoveConflict, rec.Move.ID, rec.Move.Incarnation)

+ return fmt.Errorf("%w: %s", ErrMoveConflict, fmt.Sprintf("the record's move is %s for incarnation %s", rec.Move.ID, rec.Move.Incarnation))

}

return nil

}

@@ -1279,7 +1292,7 @@ func MoveGuardedCut(g MoveGuard) func(*Record) error {

return err

}

if rec.Move.State != MoveReady {

- return fmt.Errorf("%w: cut is only legal from ready", ErrMoveConflict)

+ return fmt.Errorf("%w: %s", ErrMoveConflict, refusedCutNotReady)

}

// Spec §7.4 pins at readiness: a ready move with no pinned inputs

// (after a back-to-ready, until the repin) has nothing for the

@@ -1332,12 +1345,12 @@ func MoveGuardedAbort(g MoveGuard) func(*Record) error {

case MovePreparing, MoveReady:

case MoveCutting:

if rec.Move.CutPhase != CutRequested {

- return fmt.Errorf("%w: past the point of no return. the cut completes forward or moves back on its own", ErrMoveConflict)

+ return fmt.Errorf("%w: %s", ErrMoveConflict, refusedPastNoReturn)

}

case MoveAborting:

- return fmt.Errorf("%w: already aborting", ErrMoveConflict)

+ return fmt.Errorf("%w: %s", ErrMoveConflict, refusedAlreadyAborting)

default:

- return fmt.Errorf("%w: a move in state %q cannot be aborted", ErrMoveConflict, rec.Move.State)

+ return fmt.Errorf("%w: %s", ErrMoveConflict, fmt.Sprintf("a move in state \"%s\" cannot be aborted", quotedInner(rec.Move.State)))

}

rec.Move.State = MoveAborting

return nil

@@ -2383,7 +2396,7 @@ func MoveMarkCutting() func(*Record) error {

func MoveAbort() func(*Record) error {

return func(rec *Record) error {

if rec.Move == nil {

- return fmt.Errorf("%w: no move in flight", ErrMoveConflict)

+ return fmt.Errorf("%w: %s", ErrMoveConflict, refusedNoMove)

}

switch rec.Move.State {

case MovePreparing, MoveReady:

@@ -2733,3 +2746,11 @@ func PutManifestIfMatch(ctx context.Context, s release.Store, acct, app string,

})

return

}

+// quotedInner is strconv.Quote without the surrounding quotes: the approved

+// sentence (MV-N42) carries its own quotes, and the state inside them keeps

+// %q's escaping of quotes, backslashes and control characters.

+func quotedInner(s string) string {

+ q := strconv.Quote(s)

+ return q[1 : len(q)-1]