carlos / platform Public

census: Task 2 final fix round re-pins (rev3=PROPOSED-self-serve-moves-3)

Edge.Reload re-pinned in place; Edge.watchTick, Edge.watchHolds,
Edge.holdAliasDigest, Edge.installTable and Edge.refreshHoldRows frozen
as accepted legacy; internal/edge envelope re-pinned; seal e31bb4f6. No
class or task is added; the record-write census is unchanged. The
proposal note gains the round's paragraph.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

claude 23 hours ago 96e01f856b619098bd42ee6eac82b9d875416f3a parent a0f6cf5

3 files changed, +26 −5

docs/superpowers/notes/census-proposal-self-serve-moves-3.md +6 −0
internal/provision/plan14_root_reads_test.go +6 −2
internal/provision/testdata/plan14-root-reads-self-serve-moves-3.tsv +14 −3

CI failed — run details

CI log

=== gate ===
sigwho: pid 2 ppid 1 pgid 0 sid 0; child pid 3
.amadan/test-gate.sh
gate: 2026-10-24T06:52:39Z on aarch64, 32 cpus, 61548 MB available, go1.26.8 linux/arm64
gate: +0s start launchctx
gate: +0s start vet
gate: +0s start gofmt
gate: +1s start rest
gate: +18s start internal_console@0
gate: +18s start internal_console@1
gate: +18s start internal_console@2
gate: +18s start internal_console@3
gate: +18s start internal_console@4
gate: +18s start internal_console@5
gate: +18s start internal_console@6
gate: +18s start internal_console@7
gate: +18s waiting for internal_console's shards before the next split package
gate: +189s start root@0
gate: +189s start root@1
gate: +189s start root@2
gate: +189s waiting for root's shards before the next split package

amadan: step gate failed: signal: terminated

amadan: job failed at step gate — its output is above, not at the tail of this log

diff --git a/docs/superpowers/notes/census-proposal-self-serve-moves-3.md b/docs/superpowers/notes/census-proposal-self-serve-moves-3.md

index 43e181f9f..ce600f11f 100644

--- a/docs/superpowers/notes/census-proposal-self-serve-moves-3.md

+++ b/docs/superpowers/notes/census-proposal-self-serve-moves-3.md

@@ -155,3 +155,9 @@ The registry field is `route_aliases.explicit` (`RouteAlias.Explicit`), tracked

### Task 7 review round 1

`edge/rank.go` gains `holdLive`: a remote hold is believed while it is less than `holdingValidity` old. `rank` and the e2e seam's `E2ERemoteCandidates` both use it, so the two cannot disagree on the boundary. `rank.go` reads no row and is not a census unit. No unit's fingerprint moves, and the seal stays `e070316b…`. The `internal/edge` envelope is re-pinned. No root read, class or task is added.

+### Task 2 final fix round (Astra final review F1 to F3)

+The registry watch now also tracks a holds digest: every explicit alias row's name, primary, DNS status and provenance (`holdAliasDigest`). It reads that digest only while the rows the holds were last built from hold a row. When the fingerprint is unchanged but the digest moved (a DNS stamp, which the fingerprint leaves out on purpose), the watch re-lists the rows outside the offline view's lock and re-bases the holds on them without a Reload (`watchHolds`, `refreshHoldRows`). `Reload` publishes its table and the holds built from it as one snapshot under `holdsMu` (`installTable`), so the request path reads both from one pointer. `ExactHome` refuses a literal `*.` name.

+`edge/edge.go:Edge.Reload` is re-pinned in place. Five new edge units are frozen as accepted legacy under `rev3=PROPOSED-self-serve-moves-3`: `Edge.watchTick` (the watch's tick, split out of `Edge.Watch`), `Edge.watchHolds`, `Edge.holdAliasDigest`, `Edge.installTable` and `Edge.refreshHoldRows`. The new reads are the edge's own registry handle (`List`, `ListAliases`), on the watch goroutine and never under the view's lock. The `internal/edge` envelope is re-pinned and the seal moves to `e31bb4f6…`. No class or task is added, and the record-write census is unchanged.

diff --git a/internal/provision/plan14_root_reads_test.go b/internal/provision/plan14_root_reads_test.go

index f5bd88e52..4228c9fe7 100644

--- a/internal/provision/plan14_root_reads_test.go

+++ b/internal/provision/plan14_root_reads_test.go

@@ -1400,8 +1400,12 @@ func TestPlan14RootReadCensus(t *testing.T) {

// Server.probeTarget (the console's probe asks in probe mode and

// requires the target's box id), which moves it once more. Its review

// round 1 re-pins Edge.ServeHTTP in place (a comment, and the stale-hop

- // body through notServedHere), which moves it again.

- seal = "e070316bc7a483a790121f378c4d25e3868307fa58825af2126aa0611d29b2ac"

+ // body through notServedHere), which moves it again. Task 2's final fix

+ // round (the watch's holds digest, Reload's one-snapshot publication)

+ // re-pins Edge.Reload in place and freezes five new edge units

+ // (watchTick, watchHolds, holdAliasDigest, installTable,

+ // refreshHoldRows), which moves it once more.

+ seal = "e31bb4f6aa6b09e94a6495f620bd016615c75c49a9d457b0aa86fc91d936de8c"

errs := append(compareRootReads(got, inv), checkRootReadLegacy(inv, seal)...)

errs = append(errs, checkRootReadDeclarations(got, inv)...)

if len(errs) > 0 {

diff --git a/internal/provision/testdata/plan14-root-reads-self-serve-moves-3.tsv b/internal/provision/testdata/plan14-root-reads-self-serve-moves-3.tsv

index 39fe809e7..7ec4db2a3 100644

--- a/internal/provision/testdata/plan14-root-reads-self-serve-moves-3.tsv

+++ b/internal/provision/testdata/plan14-root-reads-self-serve-moves-3.tsv

@@ -9,6 +9,7 @@

# Task 6 review round 1, rev3=PROPOSED-self-serve-moves-3: the two "not served here" bodies (the probe refusal and homeMap.staleHopRefusal) share one constant, notServedHere in servedby.go, and ServeHTTP gains a comment on why a probe may be served from the local catch-all. Edge.ServeHTTP is re-pinned in place (read sites unchanged, offsets moved), which moves the seal; the internal/edge envelope is re-pinned. No root read, class or task is added.

# Task 7 (the end-to-end witnesses), rev3=PROPOSED-self-serve-moves-3: tests in internal/e2e/selfserve, plus two seams. internal/edge/e2e_bridge.go (new, //go:build e2e, so no production binary carries it) arms an Edge's home map without its loop, runs one poll, sets the map's clock, points the backhaul dial at loopback listeners and lists a name's admitted candidates: it reads no row, and the census's name match over the inactive file is kept clear of tracked field names (E2ECandidate.Type, not Kind). internal/host/e2e_bridge.go gains a per-box published address, the box edge's hold subscription (renewed at every agent restart), an opt-in alias pass in each tick (domains.ReconcileAliases, already accepted legacy, over the deployment route fold the witness hands in, so the bridge adds no edges-file read site to internal/edgesfile's audit) and a pair-less publication through the same writer (publishErr with lifetimes off): no unit with a read site moves. The internal/edge and internal/host envelopes are re-pinned; no root read, class or task is added, and the seal is unchanged.

# Task 7 review round 1, rev3=PROPOSED-self-serve-moves-3: rank.go gains holdLive (a remote hold is believed while it is less than holdingValidity old), used by rank and by the e2e seam's Live, so the two cannot disagree on the boundary. rank.go reads no row and is no census unit; no unit moves and the seal is unchanged. The internal/edge envelope is re-pinned.

+# Task 2 final fix round (Astra final review F1-F3), rev3=PROPOSED-self-serve-moves-3: the watch also tracks a holds digest over the explicit alias rows (the DNS stamp the fingerprint leaves out) and re-bases the holds on re-listed rows without a Reload (watchTick, watchHolds, holdAliasDigest, refreshHoldRows); Reload publishes its table and holds as one snapshot (installTable); ExactHome refuses a literal catch-all. Edge.Reload re-pinned in place; five new edge units frozen as accepted legacy; the internal/edge envelope re-pinned. No root read is added outside internal/edge's own registry handle, and no class or task is added.

@legacy 652c416a0cd27a153fa259d76ab20538480e2c3afd98cbec6af083902b17f5ff internal/domains/aliases.go ReconcileAliases legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-3;basis=root-route; the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos), from its fast-converge and instances loops: self-serve moves 1's body (rev3=J1, the catch-all's labels counted through domains.InstanceLabelCountsJudged), which now writes each alias row's provenance: an exact claim on the row's own name upserts it explicit (every pass, so a legacy row is upgraded on the first), and the synthetic "*.<host>" catch-all row not explicit; registry read sites unchanged, offsets moved; a report the edges file lists holding aliases by, not a decision registry:Account@15605,registry:Account@15618,registry:Alias@15220,registry:Alias@15260,registry:Alias@15330,registry:App@12165,registry:App@12365,registry:App@12521,registry:App@12722,registry:App@15631,registry:App@15640,registry:App@2026,registry:App@2222,registry:App@6036,registry:App@6235,registry:Host@15590,registry:Host@15879,registry:Host@15932,registry:Host@16004,registry:Host@16516,registry:Host@16608,registry:Host@16667,registry:Host@16748,registry:Host@406,registry:Prefix@16524,registry:Prefix@16622,registry:Prefix@16675,registry:Prefix@16756,registry:Status@8899,whole:Route@12134,whole:Route@12209,whole:Route@12356,whole:Route@12418,whole:Route@12561,whole:Route@12717,whole:Route@13613,whole:Route@1369,whole:Route@14825,whole:Route@14833,whole:Route@2066,whole:Route@2217,whole:Route@2273,whole:Route@359,whole:Route@388,whole:Route@399,whole:Route@417,whole:Route@5382,whole:Route@6080,whole:Route@6226,whole:Route@8229,whole:Route@8681,whole:Route@8843,whole:RouteAlias@14841,whole:RouteAlias@15195,whole:RoutePath@10426,whole:RoutePath@16409,whole:RoutePath@16451,whole:RoutePath@16565,whole:RoutePath@16595,whole:WildcardDomain@12933,whole:WildcardDomain@15520,whole:WildcardDomain@15569,whole:WildcardDomain@15732,whole:WildcardDomain@15838,whole:WildcardDomain@15867 edef8a1bf06cab5666a52ec19840c54f02913ddc67a32da7f6197db1606556a4

internal/domains/aliases.go ReconcileAliases legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-3;basis=root-route; the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos), from its fast-converge and instances loops: self-serve moves 1's body (rev3=J1, the catch-all's labels counted through domains.InstanceLabelCountsJudged), which now writes each alias row's provenance: an exact claim on the row's own name upserts it explicit (every pass, so a legacy row is upgraded on the first), and the synthetic "*.<host>" catch-all row not explicit; registry read sites unchanged, offsets moved; a report the edges file lists holding aliases by, not a decision registry:Account@15605,registry:Account@15618,registry:Alias@15220,registry:Alias@15260,registry:Alias@15330,registry:App@12165,registry:App@12365,registry:App@12521,registry:App@12722,registry:App@15631,registry:App@15640,registry:App@2026,registry:App@2222,registry:App@6036,registry:App@6235,registry:Host@15590,registry:Host@15879,registry:Host@15932,registry:Host@16004,registry:Host@16516,registry:Host@16608,registry:Host@16667,registry:Host@16748,registry:Host@406,registry:Prefix@16524,registry:Prefix@16622,registry:Prefix@16675,registry:Prefix@16756,registry:Status@8899,whole:Route@12134,whole:Route@12209,whole:Route@12356,whole:Route@12418,whole:Route@12561,whole:Route@12717,whole:Route@13613,whole:Route@1369,whole:Route@14825,whole:Route@14833,whole:Route@2066,whole:Route@2217,whole:Route@2273,whole:Route@359,whole:Route@388,whole:Route@399,whole:Route@417,whole:Route@5382,whole:Route@6080,whole:Route@6226,whole:Route@8229,whole:Route@8681,whole:Route@8843,whole:RouteAlias@14841,whole:RouteAlias@15195,whole:RoutePath@10426,whole:RoutePath@16409,whole:RoutePath@16451,whole:RoutePath@16565,whole:RoutePath@16595,whole:WildcardDomain@12933,whole:WildcardDomain@15520,whole:WildcardDomain@15569,whole:WildcardDomain@15732,whole:WildcardDomain@15838,whole:WildcardDomain@15867 edef8a1bf06cab5666a52ec19840c54f02913ddc67a32da7f6197db1606556a4

@legacy 887eab39c9584891268b9afedcd81c995849a97545258b3eacc506b5c0165b23 internal/domains/aliases.go deriveInstanceAliases legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-3;basis=root-route; the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): self-serve moves 1's body, whose already-the-row-we-want skip now also compares the existing row's provenance (registry:Explicit, one new site): a derived name left explicit by a detached exact claim on the same target and owner is rewritten not explicit, and both keep-as-it-is paths (a listing failure, an unjudged label) hand the kept row to keepDerived; the other registry read sites unchanged, offsets moved; no new route registry:Account@2163,registry:Account@3516,registry:Account@4587,registry:Alias@2225,registry:Alias@2293,registry:Alias@2337,registry:Alias@557,registry:App@1686,registry:App@2189,registry:App@3542,registry:App@4613,registry:Explicit@4632,registry:Host@1843,registry:Host@4566,registry:Host@4576,registry:Host@4787,registry:Provisioned@1636,registry:Replica@1672,registry:Slug@1775,whole:Route@1620,whole:Route@1726,whole:Route@3058,whole:RouteAlias@2143,whole:RouteAlias@2377,whole:RouteAlias@3498,whole:RouteAlias@3867,whole:RouteAlias@4548,whole:RouteAlias@509,whole:RouteAlias@539,whole:RouteAlias@552,whole:RouteAlias@568 42d5a40cccb38c31f306b49c00fde7482e4ee0b3cbf6a6a2dfbaac06592ef883

@@ -27,12 +28,22 @@ internal/registry/registry.go Registry.ListAliases legacy accepted-legacy accept

internal/registry/registry.go Registry.UpsertAlias legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-3;basis=the registry's SQLite side, as carlos: in the agent (/opt/carlos/carlos agent, carlos-edge.service) and in the registry child (carlos __registry-child, which a root pass forks as the service user); the remote arm, unchanged: rev3=J1,J4's route-and-input body, which also writes route_aliases.explicit from RouteAlias.Explicit on insert and in the conflict clause (explicit=excluded.explicit), the DNS and certificate stamps still preserved; self-serve moves 3 Task 1 file:Exec@183,registry:Account@497,registry:Alias@480,registry:App@508,registry:CertExpiresAt@544,registry:CreatedAt@561,registry:DNSCheckedAt@528,registry:DNSStatus@515,registry:Explicit@574,registry:Host@489,registry:remote@57,registry:remote@87,registry:sql@183,whole:RouteAlias@143,whole:RouteAlias@146,whole:remoteClient@59,whole:remoteClient@89 820523f13ffc70b1704122ab9a386a7b962edbd581e172ccd52dc7c87ff4d4ff

@legacy 1409145169f03f11766765601208065ab115929f8f773b23512c9465d6f6f8e3 internal/registry/registry.go Registry.migrate legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-3;basis=the registry's SQLite side, as carlos: in the agent (/opt/carlos/carlos agent, carlos-edge.service) and in the registry child (carlos __registry-child, which a root pass forks as the service user), on every registry open; a box CLI verb that opens the registry directly runs it as whoever runs the verb: self-serve moves 1's body with route_aliases.explicit (INTEGER NOT NULL DEFAULT 0) in the create statement and one idempotent ALTER for a table created before it (the duplicate-column rule); self-serve moves 3 Task 1 file:Exec@3622,file:Exec@3946,file:Exec@4638,file:Exec@51,file:Exec@5111,file:Exec@5971,file:Exec@6250,file:Exec@7113,file:Exec@7289,registry:sql@3622,registry:sql@3946,registry:sql@4638,registry:sql@51,registry:sql@5111,registry:sql@5971,registry:sql@6250,registry:sql@7113,registry:sql@7289 76673b36d4f61499f9649f3c0cf195ae582b6d21bea50d26dce147d59fb9c990

internal/registry/registry.go Registry.migrate legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-3;basis=the registry's SQLite side, as carlos: in the agent (/opt/carlos/carlos agent, carlos-edge.service) and in the registry child (carlos __registry-child, which a root pass forks as the service user), on every registry open; a box CLI verb that opens the registry directly runs it as whoever runs the verb: self-serve moves 1's body with route_aliases.explicit (INTEGER NOT NULL DEFAULT 0) in the create statement and one idempotent ALTER for a table created before it (the duplicate-column rule); self-serve moves 3 Task 1 file:Exec@3622,file:Exec@3946,file:Exec@4638,file:Exec@51,file:Exec@5111,file:Exec@5971,file:Exec@6250,file:Exec@7113,file:Exec@7289,registry:sql@3622,registry:sql@3946,registry:sql@4638,registry:sql@51,registry:sql@5111,registry:sql@5971,registry:sql@6250,registry:sql@7113,registry:sql@7289 76673b36d4f61499f9649f3c0cf195ae582b6d21bea50d26dce147d59fb9c990

-@legacy f41bc7d6d0f544ba64ab40732c62e4d11c9515dc75032e79888478236843b08a internal/edge/edge.go Edge.Reload legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-3;basis=root-route; the edge inside the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body, which also hands the rows and alias rows it listed, with the table it built from them, to the local hold rebuild (holdInputs, rebuildHolds) before the reload hook runs; read sites unchanged, offsets moved; serving only registry:Account@18079,registry:Alias@16388,registry:Alias@16475,registry:Alias@16571,registry:FleetBox@5526,registry:Health@7689,registry:Health@7807,registry:Hibernate@12450,registry:Hibernate@14360,registry:Hibernate@6049,registry:Host@12498,registry:Host@14422,registry:Host@14730,registry:Host@14757,registry:Host@15525,registry:Host@15791,registry:Host@16514,registry:Host@6098,registry:Host@8290,registry:Host@8385,registry:Host@8665,registry:Host@8691,registry:Host@8743,registry:Kind@10975,registry:Kind@10997,registry:Kind@12426,registry:Kind@14336,registry:Kind@6025,registry:Kind@8831,registry:Kind@8891,registry:Name@18069,registry:Prefix@15766,registry:Region@2252,registry:Socket@14738,registry:Socket@5633,registry:Socket@6162,registry:Status@1835,registry:Target@15778,registry:Tunnel@4574,registry:Tunnel@4630,registry:Version@10956,registry:Version@11058,whole:Fleet@18019,whole:Fleet@18048,whole:Route@130,whole:Route@14790,whole:Route@14797,whole:Route@19692,whole:Route@19700,whole:Route@4692,whole:Route@5590,whole:Route@6218,whole:Route@648,whole:Route@8808,whole:Route@8881,whole:Route@8941,whole:RouteAlias@16359,whole:RouteAlias@19708,whole:RouteAlias@19717,whole:RoutePath@15503 e4e7b4dbdef60f59e2d9b3f4ad1d087d2044791764681bd827b60466ce8f7943

+@legacy 33fa5afac6531f9808509e8d3ef13bf5b9b8f71f9a7c73c99d9bb128d313dc0b internal/edge/edge.go Edge.Reload legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-3;basis=root-route; the edge inside the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body, which also hands the rows and alias rows it listed, with the table it built from them, to the local hold rebuild (holdInputs, rebuildHolds) before the reload hook runs; read sites unchanged, offsets moved; serving only; final review fix round: the table and the holds built from it are published together under holdsMu (installTable), so the request path never sees the new table without its holds registry:Account@18079,registry:Alias@16388,registry:Alias@16475,registry:Alias@16571,registry:FleetBox@5526,registry:Health@7689,registry:Health@7807,registry:Hibernate@12450,registry:Hibernate@14360,registry:Hibernate@6049,registry:Host@12498,registry:Host@14422,registry:Host@14730,registry:Host@14757,registry:Host@15525,registry:Host@15791,registry:Host@16514,registry:Host@6098,registry:Host@8290,registry:Host@8385,registry:Host@8665,registry:Host@8691,registry:Host@8743,registry:Kind@10975,registry:Kind@10997,registry:Kind@12426,registry:Kind@14336,registry:Kind@6025,registry:Kind@8831,registry:Kind@8891,registry:Name@18069,registry:Prefix@15766,registry:Region@2252,registry:Socket@14738,registry:Socket@5633,registry:Socket@6162,registry:Status@1835,registry:Target@15778,registry:Tunnel@4574,registry:Tunnel@4630,registry:Version@10956,registry:Version@11058,whole:Fleet@18019,whole:Fleet@18048,whole:Route@130,whole:Route@14790,whole:Route@14797,whole:Route@19772,whole:Route@4692,whole:Route@5590,whole:Route@6218,whole:Route@648,whole:Route@8808,whole:Route@8881,whole:Route@8941,whole:RouteAlias@16359,whole:RouteAlias@19780,whole:RoutePath@15503 9cda7d84edb328d9b05279f3371b11434f074c7d8f135ad104d863db921c10ec

@legacy c275e37e11bed6581b7da8e1a47f54ffeb25c92a3aef8cf56236a85d8c323294 internal/edge/edge.go Edge.ServeHTTP legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-3;basis=root-route; the edge inside the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body (import gate after the door's scope, a gated row left out of the response cache), with the request's one decision (resolve: this box's table, its local holds and the home map's candidates, ranked) in place of the table lookup and the exact-home probe; the prefix target, the login re-resolution and the door's check read the decision's own table (selectUpstream), and a holding decision answers the holding page; read sites unchanged, offsets moved; serving only; Task 2 fix round 1: the import gate is handed the decision's table (local.table) and judges the front row there; Task 6: a probe (X-Carlos-Probe: local) is answered under servedByWriter, stamped with this box id on its final response, and is kept out of the response cache in both directions; the forwarding paths refuse it in backhaulTo, which reads no row; Task 6 review round 1: a comment on the kept exceptions (a probe served from the local catch-all) and the stale-hop body through the notServedHere constant registry:Gate@15012,registry:Gate@15072,registry:Gate@15130,registry:Host@15115,registry:ImportGate@18443,registry:Kind@13251,registry:Kind@18414,whole:Route@11256,whole:Route@11468,whole:Route@13254,whole:Route@13812,whole:Route@13907,whole:Route@13983,whole:Route@15015,whole:Route@15075,whole:Route@15118,whole:Route@15133,whole:Route@15946,whole:Route@18417,whole:Route@18446,whole:Route@19592 71d424324ae847f5fbf23b9e928a5e27f80b5fd904dcfefd60d04aa7b93f11e5

@legacy 59d746cbafad658130c4c6be6d6597f0a57cd2bcb2a493e3f2f9c8a456ceb524 internal/edge/edge.go Edge.currentHosts legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-3;basis=root-route; the edge inside the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body, which also lists this box's real holds of platform rows (holdSnapshot.platformNames, which reads no row) so a held row's wildcard parent stays loaded; read sites unchanged; serving only (the wildcard parent set) registry:Platform@123,registry:Provisioned@144,whole:Route@126,whole:Route@147 88419f01a8c80da7e11def22cd5512365c097ec17ee5afa895c1863d6c858ff1

@legacy 9cd24dc39fec3c4b8f569729b7a2a8fdd30a008e1064295afdf9e62937fde31c internal/edge/edge.go localReady legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-3;basis=root-route; the edge inside the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, a table entry as a ranking candidate: reads the route the entry carries (its owner through release.RouteAccount, app, lifetime pair, class marks and, for an alias, its primary's host); serving only registry:App@258,registry:Host@498,registry:Incarnation@287,registry:Platform@357,registry:Provisioned@378,registry:ServingSeq@321,whole:Route@245,whole:Route@261,whole:Route@290,whole:Route@324,whole:Route@360,whole:Route@381,whole:Route@501 cabee4199c52c17849c70e7e6d7089d1e404c113008de3611083029bc4dd678d

@legacy c5d51734282888f6f4e90af026b8e369ce86f97e03e3867b1632ce70823bf1e9 internal/edge/holding.go localHolds legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-3;basis=root-route; the edge inside the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, the local holds: reads the rows and alias rows the latest Reload listed (a row's status, hold op, host, owner, pair and class marks; an alias row's name, primary, provenance and DNS status through edgesfile.AliasPublishable) against the offline view's moves; serving only (the holding page and its certificate), writes nothing registry:Alias@1108,registry:Alias@1235,registry:Alias@1256,registry:Alias@1284,registry:App@532,registry:Explicit@1051,registry:HoldOp@286,registry:HoldOp@392,registry:Host@1030,registry:Host@1409,registry:Host@359,registry:Host@446,registry:Host@716,registry:Host@741,registry:Host@768,registry:Host@902,registry:Incarnation@574,registry:Incarnation@926,registry:Platform@464,registry:Provisioned@478,registry:ServingSeq@601,registry:ServingSeq@953,registry:Status@273,whole:Route@242,whole:Route@523,whole:RouteAlias@1003,whole:RouteAlias@1150 416a3342657d3672fea1fd5b31292148ee6b3b3a9601f5f48b8f436187944424

-internal/edge/edge.go Edge.Reload legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-3;basis=root-route; the edge inside the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body, which also hands the rows and alias rows it listed, with the table it built from them, to the local hold rebuild (holdInputs, rebuildHolds) before the reload hook runs; read sites unchanged, offsets moved; serving only registry:Account@18079,registry:Alias@16388,registry:Alias@16475,registry:Alias@16571,registry:FleetBox@5526,registry:Health@7689,registry:Health@7807,registry:Hibernate@12450,registry:Hibernate@14360,registry:Hibernate@6049,registry:Host@12498,registry:Host@14422,registry:Host@14730,registry:Host@14757,registry:Host@15525,registry:Host@15791,registry:Host@16514,registry:Host@6098,registry:Host@8290,registry:Host@8385,registry:Host@8665,registry:Host@8691,registry:Host@8743,registry:Kind@10975,registry:Kind@10997,registry:Kind@12426,registry:Kind@14336,registry:Kind@6025,registry:Kind@8831,registry:Kind@8891,registry:Name@18069,registry:Prefix@15766,registry:Region@2252,registry:Socket@14738,registry:Socket@5633,registry:Socket@6162,registry:Status@1835,registry:Target@15778,registry:Tunnel@4574,registry:Tunnel@4630,registry:Version@10956,registry:Version@11058,whole:Fleet@18019,whole:Fleet@18048,whole:Route@130,whole:Route@14790,whole:Route@14797,whole:Route@19692,whole:Route@19700,whole:Route@4692,whole:Route@5590,whole:Route@6218,whole:Route@648,whole:Route@8808,whole:Route@8881,whole:Route@8941,whole:RouteAlias@16359,whole:RouteAlias@19708,whole:RouteAlias@19717,whole:RoutePath@15503 e4e7b4dbdef60f59e2d9b3f4ad1d087d2044791764681bd827b60466ce8f7943

+internal/edge/edge.go Edge.Reload legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-3;basis=root-route; the edge inside the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body, which also hands the rows and alias rows it listed, with the table it built from them, to the local hold rebuild (holdInputs, rebuildHolds) before the reload hook runs; read sites unchanged, offsets moved; serving only; final review fix round: the table and the holds built from it are published together under holdsMu (installTable), so the request path never sees the new table without its holds registry:Account@18079,registry:Alias@16388,registry:Alias@16475,registry:Alias@16571,registry:FleetBox@5526,registry:Health@7689,registry:Health@7807,registry:Hibernate@12450,registry:Hibernate@14360,registry:Hibernate@6049,registry:Host@12498,registry:Host@14422,registry:Host@14730,registry:Host@14757,registry:Host@15525,registry:Host@15791,registry:Host@16514,registry:Host@6098,registry:Host@8290,registry:Host@8385,registry:Host@8665,registry:Host@8691,registry:Host@8743,registry:Kind@10975,registry:Kind@10997,registry:Kind@12426,registry:Kind@14336,registry:Kind@6025,registry:Kind@8831,registry:Kind@8891,registry:Name@18069,registry:Prefix@15766,registry:Region@2252,registry:Socket@14738,registry:Socket@5633,registry:Socket@6162,registry:Status@1835,registry:Target@15778,registry:Tunnel@4574,registry:Tunnel@4630,registry:Version@10956,registry:Version@11058,whole:Fleet@18019,whole:Fleet@18048,whole:Route@130,whole:Route@14790,whole:Route@14797,whole:Route@19772,whole:Route@4692,whole:Route@5590,whole:Route@6218,whole:Route@648,whole:Route@8808,whole:Route@8881,whole:Route@8941,whole:RouteAlias@16359,whole:RouteAlias@19780,whole:RoutePath@15503 9cda7d84edb328d9b05279f3371b11434f074c7d8f135ad104d863db921c10ec

+@legacy 81b7e8da185d01dff3b969572fdd6e19ef6db65794dbf5f0e6fc10681ed10196 internal/edge/holding.go Edge.installTable legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-3;basis=root-route; the edge inside the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, Reload's publication: stores the table it built and the rows and alias rows it listed (holdInputs), and rebuilds the holds into the one snapshot the request path reads, under holdsMu; the rows are passed in, nothing is read here; serving only whole:Route@213,whole:Route@221,whole:RouteAlias@229,whole:RouteAlias@238 b2f09d7b9eece730cb67dab643647cd815fa4ec9aeaa3880d659b5033d8efdb2

+internal/edge/holding.go Edge.installTable legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-3;basis=root-route; the edge inside the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, Reload's publication: stores the table it built and the rows and alias rows it listed (holdInputs), and rebuilds the holds into the one snapshot the request path reads, under holdsMu; the rows are passed in, nothing is read here; serving only whole:Route@213,whole:Route@221,whole:RouteAlias@229,whole:RouteAlias@238 b2f09d7b9eece730cb67dab643647cd815fa4ec9aeaa3880d659b5033d8efdb2

+@legacy 723756f215373033c137386a4e6becb656613ee12160c30cdeb09f5e2f070ed1 internal/edge/holding.go Edge.refreshHoldRows legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-3;basis=root-route; the edge inside the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, the watch's holds re-base (final review F1): stores freshly listed rows and alias rows against the published table and rebuilds the holds under holdsMu; the rows are passed in, nothing is read here; serving only whole:Route@201,whole:Route@209,whole:RouteAlias@217,whole:RouteAlias@226 7bd9b7d21c51d981eec07628cba0de47632e30ee8d4c1a2370b95447cf714fdd

+internal/edge/holding.go Edge.refreshHoldRows legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-3;basis=root-route; the edge inside the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, the watch's holds re-base (final review F1): stores freshly listed rows and alias rows against the published table and rebuilds the holds under holdsMu; the rows are passed in, nothing is read here; serving only whole:Route@201,whole:Route@209,whole:RouteAlias@217,whole:RouteAlias@226 7bd9b7d21c51d981eec07628cba0de47632e30ee8d4c1a2370b95447cf714fdd

+@legacy 6f0dc1be8759fd7da5c14289123e08ddfbe2529dcd1699a0b891ec3e6f06d39a internal/edge/holding.go Edge.holdAliasDigest legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-3;basis=root-route; the edge inside the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, the watch's holds digest (final review F1): only while the rows the holds were built from hold a row (registry.IsHold over their status), lists the alias rows and digests every explicit one's name, primary, DNS status and provenance; serving only, never written registry:Alias@477,registry:DNSStatus@494,registry:Explicit@418,registry:Explicit@507,registry:Host@486,registry:Status@234,whole:Route@173,whole:RouteAlias@282,whole:RouteAlias@403,whole:RouteAlias@566 f64911bfb86daefc791603b05d39a4b068c1f20916404a25f7f0fdc19bf2f1e7

+internal/edge/holding.go Edge.holdAliasDigest legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-3;basis=root-route; the edge inside the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, the watch's holds digest (final review F1): only while the rows the holds were built from hold a row (registry.IsHold over their status), lists the alias rows and digests every explicit one's name, primary, DNS status and provenance; serving only, never written registry:Alias@477,registry:DNSStatus@494,registry:Explicit@418,registry:Explicit@507,registry:Host@486,registry:Status@234,whole:Route@173,whole:RouteAlias@282,whole:RouteAlias@403,whole:RouteAlias@566 f64911bfb86daefc791603b05d39a4b068c1f20916404a25f7f0fdc19bf2f1e7

+@legacy 8f18503e4e42bdd24cca56e4b5188000a58e1ce20e12b8acad22da263a041174 internal/edge/edge.go Edge.watchTick legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-3;basis=root-route; the edge inside the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): the watch's one tick, split out of Edge.Watch (whose fingerprint poll and reload are unchanged): also reads the holds digest before any reload and baselines it with the fingerprint; serving only whole:RouteAlias@737 9e7f6c42b8bd3295649ee08dc89dec2f732f22e7e37bab035551bc223ba9d425

+internal/edge/edge.go Edge.watchTick legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-3;basis=root-route; the edge inside the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): the watch's one tick, split out of Edge.Watch (whose fingerprint poll and reload are unchanged): also reads the holds digest before any reload and baselines it with the fingerprint; serving only whole:RouteAlias@737 9e7f6c42b8bd3295649ee08dc89dec2f732f22e7e37bab035551bc223ba9d425

+@legacy 480cbb00e522f2d9241506121131f0fb24e07a02c445ddd52cb114e17a549853 internal/edge/edge.go Edge.watchHolds legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-3;basis=root-route; the edge inside the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, the watch's holds half (final review F1): on a tick whose fingerprint did not move and whose holds digest did, re-lists the rows (registry List) outside the offline view's lock and hands them, with the alias rows the digest read, to refreshHoldRows; a failed read keeps the baseline; serving only whole:Route@262,whole:Route@512,whole:RouteAlias@520 eb3447667ad9ed07794252e118877612e09e52e5bcc606ed973e0090048c5c8c

+internal/edge/edge.go Edge.watchHolds legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-3;basis=root-route; the edge inside the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, the watch's holds half (final review F1): on a tick whose fingerprint did not move and whose holds digest did, re-lists the rows (registry List) outside the offline view's lock and hands them, with the alias rows the digest read, to refreshHoldRows; a failed read keeps the baseline; serving only whole:Route@262,whole:Route@512,whole:RouteAlias@520 eb3447667ad9ed07794252e118877612e09e52e5bcc606ed973e0090048c5c8c

internal/edge/edge.go Edge.ServeHTTP legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-3;basis=root-route; the edge inside the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body (import gate after the door's scope, a gated row left out of the response cache), with the request's one decision (resolve: this box's table, its local holds and the home map's candidates, ranked) in place of the table lookup and the exact-home probe; the prefix target, the login re-resolution and the door's check read the decision's own table (selectUpstream), and a holding decision answers the holding page; read sites unchanged, offsets moved; serving only; Task 2 fix round 1: the import gate is handed the decision's table (local.table) and judges the front row there; Task 6: a probe (X-Carlos-Probe: local) is answered under servedByWriter, stamped with this box id on its final response, and is kept out of the response cache in both directions; the forwarding paths refuse it in backhaulTo, which reads no row; Task 6 review round 1: a comment on the kept exceptions (a probe served from the local catch-all) and the stale-hop body through the notServedHere constant registry:Gate@15012,registry:Gate@15072,registry:Gate@15130,registry:Host@15115,registry:ImportGate@18443,registry:Kind@13251,registry:Kind@18414,whole:Route@11256,whole:Route@11468,whole:Route@13254,whole:Route@13812,whole:Route@13907,whole:Route@13983,whole:Route@15015,whole:Route@15075,whole:Route@15118,whole:Route@15133,whole:Route@15946,whole:Route@18417,whole:Route@18446,whole:Route@19592 71d424324ae847f5fbf23b9e928a5e27f80b5fd904dcfefd60d04aa7b93f11e5

@legacy 41ea8d89ccf9116ee6f6208c8edfa17bd6e79c8c2a7bd97c89c447af5dcc11a6 internal/edge/importgate.go Edge.importGateAdmit legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-3;basis=root-route; the edge inside the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): the import gate (a gated row admits only a GET carrying the verify token; anything else is a 503), with host's own front row looked up in the table the request's decision was resolved in (self-serve moves plan 3 Task 2 fix round 1) rather than the live table; read sites unchanged, offsets moved; serving only registry:Host@364,registry:Host@378,registry:ImportGate@295,registry:ImportGate@318,registry:ImportGate@438,whole:Route@224,whole:Route@271,whole:Route@282 1207a7a3d9fa8c99debb563b456cfa4e472fd4c3ceba83157fb4189a12c53f70

internal/edge/importgate.go Edge.importGateAdmit legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-3;basis=root-route; the edge inside the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): the import gate (a gated row admits only a GET carrying the verify token; anything else is a 503), with host's own front row looked up in the table the request's decision was resolved in (self-serve moves plan 3 Task 2 fix round 1) rather than the live table; read sites unchanged, offsets moved; serving only registry:Host@364,registry:Host@378,registry:ImportGate@295,registry:ImportGate@318,registry:ImportGate@438,whole:Route@224,whole:Route@271,whole:Route@282 1207a7a3d9fa8c99debb563b456cfa4e472fd4c3ceba83157fb4189a12c53f70

@@ -48,7 +59,7 @@ internal/console/selfserve_health.go Server.probeTarget legacy accepted-legacy a

@fields A,Account,Accounts,AddedAt,Addr,Addrs,Alias,Aliases,Alive,AllowAbsent,App,Archives,Args,At,Attempts,B,Backing,Bucket,BuildState,Callback,CallbackError,CallbackFailed,Canary,Caps,CertExpiresAt,Changed,Channel,CheckedAt,ClaimIncarnation,ClaimOwner,ClaimOwnership,ClaimRowID,ClaimStamp,Class,Contents,CreatedAt,DBPath,DNSCheckedAt,DNSStatus,Deadline,Demand,Digest,DoneBefore,Due,DueAt,Env,EnvBefore,Environment,Error,ErrorKind,ExcludeHosts,ExpectGood,ExpectOp,ExpectPair,Expected,Explicit,F,Failed,FenceGen,Fleet,FleetBox,FleetBoxes,Fleets,From,FromDB,FromOp,FromSock,Gate,GoodDemand,GoodDigest,GoodVersion,Hash,Health,Held,Hibernate,HoldOp,Host,Hosts,ID,Id,IdValue,Idle,IdleSeconds,ImportGate,Incarnation,Journal,Keep,Kind,Label,LastAt,LastError,LastMs,LastStatus,Limit,MaxRun,MaxRunSeconds,Method,Ms,Name,Next,NextAt,NextDue,NextGood,NextValue,Now,Number,Number64,Observed,ObservedValue,Old,On,Op,Original,Owner,Ownership,P,Pair,Path,Paths,Platform,Pool,Prefix,Prev,PrevVersion,Provisioned,RecordKey,Region,Registration,Replica,Replicas,Replication,Retirement,Route,Routes,Row,Rows,Seed,SeedID,SeedSource,ServingSeq,ServingVersion,Slug,Socket,Spec,Sqid,State,Status,StatusNamed,Steering,StringMap,T,TValue,Tags,Target,Targets,Text,Timer,Timers,Times,To,ToDB,ToOp,ToSock,TokenHash,Tunnel,Unit,UpdateSettings,Ver,Version,W,WakeIncarnation,Wildcards,closed,conn,connect,ctx,d,dec,done,enc,full,input,mu,output,path,remote,sql,wait

@coverage internal/console bc88b0e12e2a48b9a22951b01cf4e10f65e475079bce2a6cf076942ac1808ef6

@coverage internal/domains 0cf7748c97e4caa7d0daa73e251fdd2f2f03e425321599bf046292b0a86ebde8

-@coverage internal/edge 26e86fdbe8c1d78bb0c6e3a1268694d77ccc72f08fee93b1f26c0a06636f20d7

+@coverage internal/edge f93cc2e83d06f3121f24534a21d4fc0eb0df8cb50c6f094a2d45a220adaad48b

@coverage internal/edgesfile ee82e43c7d6363297f63abcde9c3e828a53d377573649f0d26a9853056aad4be

@coverage internal/host 30ad675ecba1fc67bc34028c91c4da4e8b83ffa730f6e172fdd73ab7f7fa40f9

@coverage internal/registry ae19eaec5c4dde2c400fcb2fc6afd23c6b129e77306d6916fe55b2091b0fb5ed