carlos / platform Public

provision: census for Task 8 fix round 1: the return index, the box's open-record read and report, finishSelfServeMove, probeTarget re-pinned; the note corrected (the return step reads judged) and the aborted open records left to plan 4

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

claude 1 day ago 9cac4e46112cef53c3e204714f46505b97e9c8f9 parent 4129ce3

4 files changed, +30 −16

docs/superpowers/notes/census-proposal-self-serve-moves-2.md +3 −1
internal/provision/plan14_root_reads_test.go +5 −2
internal/provision/self_serve_moves2_census_test.go +13 −7
internal/provision/testdata/plan14-root-reads-self-serve-moves-2.tsv +9 −6

CI failed — run details

CI log

=== gate ===
.amadan/test-gate.sh

amadan: step gate failed: signal: terminated

amadan: job failed at step gate — its output is above, not at the tail of this log

diff --git a/docs/superpowers/notes/census-proposal-self-serve-moves-2.md b/docs/superpowers/notes/census-proposal-self-serve-moves-2.md

index 4fc2c875a..632ecfccd 100644

--- a/docs/superpowers/notes/census-proposal-self-serve-moves-2.md

+++ b/docs/superpowers/notes/census-proposal-self-serve-moves-2.md

@@ -34,6 +34,8 @@ Task 7 (the job from requested to ready, and its reconciliation) adds no root re

Task 7 fix round 1 adds no root read, class or task. `offlineClaimEvidence` and `participantIdentityFor` are re-pinned in place with their bases extended: their unreadable refusals are now built with `offlineRefusal.transient` set (the job waits a transient refusal out rather than aborting), and every door's answer, status and sentence is unchanged; their read sites are unchanged and their offsets moved, so the seal moves. The internal/console envelope is re-pinned in place. The two Task 7 removals' bases are corrected: `AdvanceSelfServeToStep` also stamps `staging_started_at` and `next_maintenance_at` (a changed behaviour of `AdvanceSelfServe`), and `issueSelfServeRequest` gains the variant that sets the round's step deadline. The record-write inventory is unchanged. Paul's ruling is still outstanding.

-Task 8 (the cut, the abort, the finaliser, paging and the operator return) adds no root read, class or task, and no record write: every transition of the cut (the start, the seal, the flip, the open, both finishing gates, the finish and the abort after the start) is `selfServeRun`'s one bound `SetRecordMoveAt`, unchanged. In the root-read overlay five accepted-legacy units are added under `rev3=PROPOSED-self-serve-moves-2`, each frozen with a one-line basis: `firstDataPath` (the data directory a return-ready report names, a literal), `Server.probeTarget` (the health probe's random value from crypto/rand; the probe is an HTTPS request to the target box), `Store.SetSelfServeStep` (one journal UPDATE), `BoxHandle.RenderHeldConfig` (the end-to-end bridge's config-sync stand-in, tests only) and `movesWorker.returnLeftovers` (the box lists its own park and nested directories by name for a completed forward). `Store.AdvanceSelfServeToStep` and `Store.FinishSelfServeMove` are re-pinned in place with their bases extended (a finished row is never advanced; the outcome sets phase done, clears the open record owed and waits for an unconfirmed request to be resolved). The `internal/console`, `internal/host`, `internal/moves` and `internal/provision` envelopes are re-pinned in place, and the seal moves to `0e8b1e1c…`. In the record-write inventory the new write shapes are: the open record (`offlineOpenRecord`, foreign-recordkey: `OpenRecordKey` matches the census's record-key suffix and the `Put` is direct, create-only, of `control/offline-moves/<host>/<id>/open.json`, never an instance record), the operator return's request (`handleAPIInstanceOfflineReturn`, nonrecord, create-only under `<forward id>/return/`) and the box's return-ready report (`answerReturn`, nonrecord, create-only under `<forward id>/reports/`). Three key-sites read without writing: `readOfflineEvidence` (it skips the open record and the return keys), `readOpenRecord` and the box's `scanReturns` (the return listing, a root read of the deployment bucket's `control/offline-moves/` prefixes by an agent that lists them by name). `registerCLIRoutes` is re-pinned as a key-site for the return door's route. `TestNoUnjudgedRecordReads` stays green: the job's new record reads are `observeRecord` (the orphan reservation scan) and `selfServeRecordOf` over it; the box's return step reads the instance record with `provision.GetRecord`, as its other offline steps do.

+Task 8 (the cut, the abort, the finaliser, paging and the operator return) adds no root read, class or task, and no record write: every transition of the cut (the start, the seal, the flip, the open, both finishing gates, the finish and the abort after the start) is `selfServeRun`'s one bound `SetRecordMoveAt`, unchanged. In the root-read overlay five accepted-legacy units are added under `rev3=PROPOSED-self-serve-moves-2`, each frozen with a one-line basis: `firstDataPath` (the data directory a return-ready report names, a literal), `Server.probeTarget` (the health probe's random value from crypto/rand; the probe is an HTTPS request to the target box), `Store.SetSelfServeStep` (one journal UPDATE), `BoxHandle.RenderHeldConfig` (the end-to-end bridge's config-sync stand-in, tests only) and `movesWorker.returnLeftovers` (the box lists its own park and nested directories by name for a completed forward). `Store.AdvanceSelfServeToStep` and `Store.FinishSelfServeMove` are re-pinned in place with their bases extended (a finished row is never advanced; the outcome sets phase done, clears the open record owed and waits for an unconfirmed request to be resolved). The `internal/console`, `internal/host`, `internal/moves` and `internal/provision` envelopes are re-pinned in place, and the seal moves to `0e8b1e1c…`. In the record-write inventory the new write shapes are: the open record (`offlineOpenRecord`, foreign-recordkey: `OpenRecordKey` matches the census's record-key suffix and the `Put` is direct, create-only, of `control/offline-moves/<host>/<id>/open.json`, never an instance record), the operator return's request (`handleAPIInstanceOfflineReturn`, nonrecord, create-only under `<forward id>/return/`) and the box's return-ready report (`answerReturn`, nonrecord, create-only under `<forward id>/reports/`). Three key-sites read without writing: `readOfflineEvidence` (it skips the open record and the return keys), `readOpenRecord` and the box's `scanReturns` (the return listing, a root read of the deployment bucket's `control/offline-moves/` prefixes by an agent that lists them by name). `registerCLIRoutes` is re-pinned as a key-site for the return door's route. `TestNoUnjudgedRecordReads` stays green: the job's new record reads are `observeRecord` (the orphan reservation scan) and `selfServeRecordOf` over it; the box's return step reads the instance record with `provision.ReadRecordJudged` under the pass's judge (`JudgeFrom`), and answers only for the forward's lifetime.

Also on Task 8's branch: `targetDataPaths` names the raw nested directory through `internal/layout`'s `RawInstanceDir` (the same path; `TestRawInstancesDirectoryIsNamedOnlyHere` failed on CI at `c9822492`), re-pinned in place with its frozen declaration, which moved the seal once before Task 8's own rows.

+Task 8 fix round 1 adds no root read, class or task and no record write. The operator return's discovery is now the return index: the return door writes `control/offline-moves/@returns/<region>/<host>/<forward id>.json` (`offlineReturnIndex`, nonrecord, create-only, moved to the newest request if-match), and a box lists only its own region's index once a minute (one LIST per region per box, whatever the number of hosts), reads an indexed forward's open record once (`readOpen`, a key-site; a record it may not answer for cached as a negative), writes its report (`writeReturnReport`, nonrecord, renamed from `answerReturn`'s write) and deletes the index entry if-match; `scanReturns`'s listing of every host's move prefixes is gone. `FinishSelfServeMove`'s statement moved to `finishSelfServeMove` (shared with `YieldSelfServeMove`, the move an operator took over), so its row is removed under a proposed H3 disposition and `finishSelfServeMove` is frozen accepted-legacy; `probeTarget` is re-pinned in place (one transport per target address); the console, host and moves envelopes are re-pinned in place and the seal moves to `7351b869…`. Open records of aborted moves (written before an open that never committed) are left in the bucket: their cleanup is plan 4's.

diff --git a/internal/provision/plan14_root_reads_test.go b/internal/provision/plan14_root_reads_test.go

index 94b729630..5d5391979 100644

--- a/internal/provision/plan14_root_reads_test.go

+++ b/internal/provision/plan14_root_reads_test.go

@@ -1345,8 +1345,11 @@ func TestPlan14RootReadCensus(t *testing.T) {

// mode's data directory, the health probe's random value, the substep

// statement, the bridge's config render and the box's leftovers

// listing) and re-pins AdvanceSelfServeToStep and FinishSelfServeMove

- // in place, which moves it once more.

- seal = "0e8b1e1cbef8bf940ce76010f09e0a646c635221d57d7bde856153932016c60a"

+ // in place, which moves it once more. Its fix round 1 freezes

+ // finishSelfServeMove (FinishSelfServeMove's statement, shared with

+ // YieldSelfServeMove; FinishSelfServeMove's row under a proposed H3

+ // disposition) and re-pins probeTarget in place, which moves it again.

+ seal = "7351b8695ac429be6459277bd1209fb494069cbc91f2a30959368adcaa1f2ff1"

errs := append(compareRootReads(got, inv), checkRootReadLegacy(inv, seal)...)

errs = append(errs, checkRootReadDeclarations(got, inv)...)

if len(errs) > 0 {

diff --git a/internal/provision/self_serve_moves2_census_test.go b/internal/provision/self_serve_moves2_census_test.go

index 139abd721..a89aacd1a 100644

--- a/internal/provision/self_serve_moves2_census_test.go

+++ b/internal/provision/self_serve_moves2_census_test.go

@@ -149,13 +149,18 @@ package provision

// nanos>-<console id>-<8 hex>.json, create-only; never a record.

// - offlinereturn.go:Server.readOpenRecord is added, a key-site

// (key:OpenRecordKey): it reads the forward's open record.

-// - movesoffline_return.go:movesWorker.answerReturn is added, nonrecord

-// (sel:Put): the box's return-ready report,

+// - offlinereturn.go:Server.offlineReturnIndex is added, nonrecord

+// (sel:Put; fix round 1): the return index entry,

+// control/offline-moves/@returns/<region>/<host>/<forward id>.json,

+// create-only, moved to the newest request key if-match; the box

+// deletes it if-match once it has answered (release.DeleteIfMatch).

+// - movesoffline_return.go:movesWorker.writeReturnReport is added,

+// nonrecord (sel:Put): the box's return-ready report,

// control/offline-moves/<host>/<forward id>/reports/return-ready-<box

// id>-<request key>.json, create-only (a conflict is the request

// answered); never a record.

-// - movesoffline_return.go:movesWorker.scanReturns is added, a key-site

-// (key:OpenRecordKey): it reads the forward moves' open records.

+// - movesoffline_return.go:movesWorker.readOpen is added, a key-site

+// (key:OpenRecordKey): it reads the open record of an indexed forward.

// - authcli.go:Server.registerCLIRoutes stays a key-site and is

// re-pinned: it registers the return door beside the other offline

// doors.

@@ -207,10 +212,11 @@ func plan14SelfServeMoves2WriteCensusInventory() []censusEntry {

// report, their readers, and the return door's route.

{"internal/console/apiinstancemove_offline.go", "Server.offlineOpenRecord", "foreign-recordkey", "key:OpenRecordKey,sel:Put", "8a192083d237fbf7489ac900f03da62c854dfc521ccaa31d5cc8fc7d73b2d5d7"},

{"internal/console/apiinstancemove_offline.go", "Server.readOfflineEvidence", "key-site", "key:OpenRecordKey", "09b3dd97c2e4fb9828d04e09a451a4380b1a9dc321640f6d57f18a217547af12"},

- {"internal/console/offlinereturn.go", "Server.handleAPIInstanceOfflineReturn", "nonrecord", "sel:Put", "166c1282a02472a2105220bfbf553ded1a59717a78939ed20c3a86c48ba41c1e"},

+ {"internal/console/offlinereturn.go", "Server.handleAPIInstanceOfflineReturn", "nonrecord", "sel:Put", "351bf250002266f6ef071f7ea254253218305ee8ae4fd8b5dc8cc0e92dc6bf48"},

+ {"internal/console/offlinereturn.go", "Server.offlineReturnIndex", "nonrecord", "sel:Put", "38f5e6d1f0781f11491d7b116a43dd8fb42d5fb3e60c66419513ec1cfb646792"},

{"internal/console/offlinereturn.go", "Server.readOpenRecord", "key-site", "key:OpenRecordKey", "809cf07d965d8bd136a1d463e5df3c435c086598359432630fa9d5fea6cd8950"},

- {"internal/host/movesoffline_return.go", "movesWorker.answerReturn", "nonrecord", "sel:Put", "e77f5490f87f010437e94a9fc46cf48c471f9f2d9f32d1386fbd0446cb2a1d06"},

- {"internal/host/movesoffline_return.go", "movesWorker.scanReturns", "key-site", "key:OpenRecordKey", "59ccfef1e3cb9f7abb5d4f6e553ccb23bc83ebf1d2a41533247b16ac50ce6ad9"},

+ {"internal/host/movesoffline_return.go", "movesWorker.writeReturnReport", "nonrecord", "sel:Put", "2a22da03ff31ee930897e9953707778e28ed241d2a259aecd5fd8a352b608a86"},

+ {"internal/host/movesoffline_return.go", "movesWorker.readOpen", "key-site", "key:OpenRecordKey", "712d3bd4ab0850b208e9feb61c9c76ccd8eba9878711982f640b0d78910cdb47"},

{"internal/console/authcli.go", "Server.registerCLIRoutes", "key-site", "lit:instances,lit:sidecars", "0af692569c69daef180738395057594bd8413fdf6d9e1c4cc91f0a924ab3ef7b"},

}

entries := plan14SelfServeMoves1WriteCensusInventory()

diff --git a/internal/provision/testdata/plan14-root-reads-self-serve-moves-2.tsv b/internal/provision/testdata/plan14-root-reads-self-serve-moves-2.tsv

index c42a100be..cb0f94155 100644

--- a/internal/provision/testdata/plan14-root-reads-self-serve-moves-2.tsv

+++ b/internal/provision/testdata/plan14-root-reads-self-serve-moves-2.tsv

@@ -23,8 +23,8 @@ internal/console/templates/settings.html external legacy accepted-legacy accepte

internal/provision/offline_move.go offlineBegin legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=root-input (J4, as OfflineStart); the console (cmd/console serve under console.service, user carlos-console): self-serve moves 1 Task 7's body (OfflineStart's, the state a parameter; a direct start advances move_seq and stamps move.seq, refusing ErrLifetimeExhausted at MaxInt64 before any write), and it now also creates the self-serve move in offline-queued for OfflineQueue (queued_at, staged_at and precheck_at at the caller's stamp, move.seq set to the record's move_seq, no advance) and records return_of; a stage and a queue hold nothing; its one site is still rec.ActiveRun.Open(), a method on the record's run state (RunState.Open), not a file read; self-serve moves 2 Task 2 file:Open@208 0a9b432ddf2f39a977c0651e377258b35c1d05635e9979583eeac6253d6c0ec8

@coverage internal/provision d018e5699137db933be2142f7526d0d1d10b08170525886bd9c424cde5578b55

# Task 3 (per-box reservations with a legacy projection and a sentinel, the fenced reclaim and the operator doors' bound admission), rev3=PROPOSED-self-serve-moves-2: no root read, class or task is added and no accepted-legacy unit is re-pinned, so the seal does not move. The new units (moves.ParseOfflineActive, moves.OfflineActiveBody, the console's offlinereserve.go, the doors' offlineApplyBound and offlineAdvanceBound) read no file: their reads are the bucket's control/offline-moves/active.json and the instance record through the judged readers and fenceRecord. Envelopes re-pinned in place (Task 2's rows replaced): internal/console (offlinereserve.go, the start and stage doors, the Server's two evidence fields) and internal/moves (the reservation table in offline.go).

-@coverage internal/console e71517c2d451201566c305ed32f1366262b62c6db794350303e2a37c5b3ed441

-@coverage internal/moves 5206525d3a710f5e9c2cb2b320a14e7f3243d7702fa875eaf1bb7364cf8829cb

+@coverage internal/console 4dfa31277b9a3cbbae60c08f01c40d4adce75b1918719a165e05513f75133c73

+@coverage internal/moves 6a61fc2680d29b8998a383c7c65756f78a06ac312279148bdde752546686cd8d

# Task 4 (the journal, the events table, the console lease and the pass skeleton), rev3=PROPOSED-self-serve-moves-2: no root read, class or task is added. The console SQLite journal (selfserve_store.go) adds twenty-two units, each frozen accepted-legacy with a reviewed basis (console SQL as carlos-console, no bucket or root action), and the lease's console name adds one crypto/rand read (Server.selfServeConsoleID); serve (in place: the paging arm takes the store, the pass is started), NewServer (the row evidence and the recovery-mode scan) and Store.migrate (migrateSelfServe) are re-pinned. The seal moves. The lease and the pass read control/offline-moves/console.json and active.json from the bucket, not a file. Envelopes re-pinned in place: cmd/console, internal/console and internal/provision (WithWriteGuard in WriteRecord).

@legacy a8dd51a494ab3cd2ad371ded2850b6d78492569729527ea82cd8dd0f2b418a78 internal/console/selfserve_lease.go Server.selfServeConsoleID legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: reads crypto/rand once per process for the random console name the self-serve moves lease carries; randomness grants no root authority file:Read@110 3303b18ec5c77ccaf662064801f94276bfe947c31378cc1ecb8c4fe509d5d4d1

internal/console/selfserve_lease.go Server.selfServeConsoleID legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: reads crypto/rand once per process for the random console name the self-serve moves lease carries; randomness grants no root authority file:Read@110 3303b18ec5c77ccaf662064801f94276bfe947c31378cc1ecb8c4fe509d5d4d1

@@ -40,7 +40,6 @@ internal/console/selfserve_store.go Store.ConfirmSelfServeRequest legacy accepte

@legacy 95da6de389a580fa5c0802c37d9409f171f34d1b756765ffa962087687aa679b internal/console/selfserve_store.go Store.ConsumeSelfServeRequest legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: consumes a confirmed self-serve request with the next substep and deadline, predicated on its nonce; no bucket or root action file:Exec@122 56964152a1adc56490a602c9649b40affee2e11b86ee48200721e9e24ca95229

internal/console/selfserve_store.go Store.ConsumeSelfServeRequest legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: consumes a confirmed self-serve request with the next substep and deadline, predicated on its nonce; no bucket or root action file:Exec@122 56964152a1adc56490a602c9649b40affee2e11b86ee48200721e9e24ca95229

@legacy 2af004d044f348306bcea936da03941d474ba305eb23a04687947890ad7e8d15 internal/console/selfserve_store.go Store.FinishSelfServeMove legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: records a self-serve row's outcome, consumes its confirmed request and inserts the terminal event in one SQLite transaction, only while the row has no outcome; no bucket or root action; self-serve moves 2 Task 8: the statement also sets phase done and clears open_record_pending, and refuses a row whose request is unconfirmed file:Exec@290,file:QueryRow@922 b8171ea50d77204a37e862edb065384ed466b9ed1191a3b17bf1b536d84ce550

-internal/console/selfserve_store.go Store.FinishSelfServeMove legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: records a self-serve row's outcome, consumes its confirmed request and inserts the terminal event in one SQLite transaction, only while the row has no outcome; no bucket or root action; self-serve moves 2 Task 8: the statement also sets phase done and clears open_record_pending, and refuses a row whose request is unconfirmed file:Exec@290,file:QueryRow@922 b8171ea50d77204a37e862edb065384ed466b9ed1191a3b17bf1b536d84ce550

@legacy 888bde94f97959ae38336fc48530f9dd76532faea049743f1f57bee01550a20a internal/console/selfserve_store.go Store.HostHasIssuedRequest legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: counts a host's self-serve rows with an issued request still in flight, for the reservation reclaim rule; no bucket or root action file:QueryRow@96 a0fef5ee78031bafdbebd06f2268011a2f2d4f700c01617d04da596ce40c8c89

internal/console/selfserve_store.go Store.HostHasIssuedRequest legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: counts a host's self-serve rows with an issued request still in flight, for the reservation reclaim rule; no bucket or root action file:QueryRow@96 a0fef5ee78031bafdbebd06f2268011a2f2d4f700c01617d04da596ce40c8c89

@legacy 09a6b77755e93a3002743007c6689309f6c40cd5308c15da53cfbc7dae6e2c7e internal/console/selfserve_store.go Store.IssueSelfServeRequest legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: persists one request on a self-serve row, predicated on its phase, no outcome and no unconsumed request; no bucket or root action file:Exec@541 39cee79531f56be7080e0e8a030d7913a19554034b19118050d7a55ecb249e86

@@ -124,7 +123,7 @@ internal/host/movespass.go armOffline legacy accepted-legacy accepted-legacy;rev

internal/host/probes.go stagePathActive legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=root-input (J4, as configPathActive): systemctl is-active carlos-stage.path for the precheck's and the ready report's stage-path fact; self-serve moves 2 Task 6 file:Command@42 f7cbe0e2ba971d201f8fc7111eb4cebac9c9bae14cc826366c06b9e8bd3eecb8

@legacy 6febdffd5ed3a46ca7c8296e2bf12d8249561e26ab6479eb672f40a96b13f0f4 internal/status/snapshot.go CollectBox legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=root-route; self-serve moves 2 Task 6: carries Probes.BoxID, Lanes and Hosts into the private BoxMetrics only (never the public feed); read sites unchanged, offsets moved registry:Alias@4465,registry:CertExpiresAt@3160,registry:CertExpiresAt@3396,registry:CertExpiresAt@4580,registry:DBPath@2495,registry:DBPath@2553,registry:DNSCheckedAt@3365,registry:DNSCheckedAt@4549,registry:DNSStatus@3139,registry:DNSStatus@3334,registry:DNSStatus@4519,registry:Hibernate@3853,registry:Host@2295,registry:Host@2437,registry:Host@2666,registry:Host@3280,registry:Host@3315,registry:Host@4500,registry:Kind@2473,registry:Kind@3807,registry:Platform@2152,registry:ServingVersion@2324,registry:ServingVersion@2447,registry:Socket@3988,registry:Version@2186,registry:Version@2305,whole:Route@1581,whole:RouteAlias@4362 e874e3166d22d437b4d4daf2b1dc8b2d56bc853076cc132b9b2c1d30f9a2b1be

internal/status/snapshot.go CollectBox legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=root-route; self-serve moves 2 Task 6: carries Probes.BoxID, Lanes and Hosts into the private BoxMetrics only (never the public feed); read sites unchanged, offsets moved registry:Alias@4465,registry:CertExpiresAt@3160,registry:CertExpiresAt@3396,registry:CertExpiresAt@4580,registry:DBPath@2495,registry:DBPath@2553,registry:DNSCheckedAt@3365,registry:DNSCheckedAt@4549,registry:DNSStatus@3139,registry:DNSStatus@3334,registry:DNSStatus@4519,registry:Hibernate@3853,registry:Host@2295,registry:Host@2437,registry:Host@2666,registry:Host@3280,registry:Host@3315,registry:Host@4500,registry:Kind@2473,registry:Kind@3807,registry:Platform@2152,registry:ServingVersion@2324,registry:ServingVersion@2447,registry:Socket@3988,registry:Version@2186,registry:Version@2305,whole:Route@1581,whole:RouteAlias@4362 e874e3166d22d437b4d4daf2b1dc8b2d56bc853076cc132b9b2c1d30f9a2b1be

-@coverage internal/host 73e7147a7ae827fd328144093c234003b721bebdfc4882d52358e28ab1393fa0

+@coverage internal/host 0b14fb62aa55aa0cb26959564599812fe1ceb56e0c2c92a4eb47e385a149a6fc

@coverage internal/lease 7e2a4a3652f964aaf1ee32356d2538a292c66ee0aaf9e622cf087b644aeaaa61

@coverage internal/status 6bf65bf3b04fdc150e2ec35d2d0d67046cf37b7c60a9dcde1c2204b75bcf8d2b

# Task 6 fix round 1 (the import cycle internal/park's tests saw), rev3=PROPOSED-self-serve-moves-2: PlacementMatches moves into internal/regionname (park.PlacementMatches delegates to it, unchanged in behaviour) so internal/moves no longer imports internal/park; no root read is added or moved. Envelopes: internal/moves in place, internal/park and internal/regionname added.

@@ -195,11 +194,15 @@ internal/console/selfserve_store.go Store.issueSelfServeRequest legacy accepted-

# Task 8 (the cut, abort, finaliser, paging and the operator return), rev3=PROPOSED-self-serve-moves-2: five accepted-legacy units are added (firstDataPath, probeTarget, Store.SetSelfServeStep, BoxHandle.RenderHeldConfig, movesWorker.returnLeftovers); Store.AdvanceSelfServeToStep and Store.FinishSelfServeMove are re-pinned in place (their predicates gain outcome = and the unconfirmed-request refusal); the internal/console, internal/host, internal/moves and internal/provision envelopes are re-pinned in place.

@legacy 68ece6567d9b4e8561ae648e1ae0c2673877dc557f56815b43a622e30b0345de internal/console/offlinereturn.go firstDataPath legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: names the data directory a return-ready report uses (/data when the report names none), as targetDataPaths does; reads no file and grants nothing data-literal@155 283e6272ea6a25cb27321e2f957af217a046117bb14dc7cc570bb61384ebec89

internal/console/offlinereturn.go firstDataPath legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: names the data directory a return-ready report uses (/data when the report names none), as targetDataPaths does; reads no file and grants nothing data-literal@155 283e6272ea6a25cb27321e2f957af217a046117bb14dc7cc570bb61384ebec89

-@legacy b2f5e445abe5845965e43d57fe80a2ec831110e0e75df40c0c821c6075b8ad4c internal/console/selfserve_health.go Server.probeTarget legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: the health probe value is 8 bytes of crypto/rand; the probe itself is an HTTPS request to the target box, no file file:Read@854 c82f3acca5ed6b8e369fdba6a126f9567d688b7d661f5edfde3f2940cb4fc251

-internal/console/selfserve_health.go Server.probeTarget legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: the health probe value is 8 bytes of crypto/rand; the probe itself is an HTTPS request to the target box, no file file:Read@854 c82f3acca5ed6b8e369fdba6a126f9567d688b7d661f5edfde3f2940cb4fc251

+@legacy a66d9dcadb20b16eb5cba228432c90bf59ba04ac86be89295c00e5343f888405 internal/console/selfserve_health.go Server.probeTarget legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: the health probe value is 8 bytes of crypto/rand; the probe itself is an HTTPS request to the target box, no file; fix round 1: the request moved to probeAt over one transport per target address file:Read@854 d3b1ab93d0c6083e723a322b4e95ae704056524729ced1ecbad8fb9f82cd2864

+internal/console/selfserve_health.go Server.probeTarget legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: the health probe value is 8 bytes of crypto/rand; the probe itself is an HTTPS request to the target box, no file; fix round 1: the request moved to probeAt over one transport per target address file:Read@854 d3b1ab93d0c6083e723a322b4e95ae704056524729ced1ecbad8fb9f82cd2864

@legacy cc48b4d8d3079cb6c12be592421b5e0bfd5478fbf0a6349582d02465c2337f51 internal/console/selfserve_store.go Store.SetSelfServeStep legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: one predicated UPDATE of the console SQLite journal (a row moved between substeps after an operator transition); no root input file:Exec@111 5511b422b5f6fd6f8a8d99926a527a19169a320bdefa5f1e45fa7a82b67f7c63

internal/console/selfserve_store.go Store.SetSelfServeStep legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: one predicated UPDATE of the console SQLite journal (a row moved between substeps after an operator transition); no root input file:Exec@111 5511b422b5f6fd6f8a8d99926a527a19169a320bdefa5f1e45fa7a82b67f7c63

@legacy caf925ce7aa45d5792244a8744132b465ef7cc8dd9ca88d2998ba5d11089d550 internal/host/e2e_bridge.go BoxHandle.RenderHeldConfig legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=tests only (the end-to-end bridge, called by internal/e2e/selfserve alone): config sync stand-in reading the fixture box registry row registry:HoldOp@162,whole:Route@149,whole:Route@281 be2a0c09f44ff809ac7f98e9ca7985c0907b1942a385a897ef7405953ec2a54f

internal/host/e2e_bridge.go BoxHandle.RenderHeldConfig legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=tests only (the end-to-end bridge, called by internal/e2e/selfserve alone): config sync stand-in reading the fixture box registry row registry:HoldOp@162,whole:Route@149,whole:Route@281 be2a0c09f44ff809ac7f98e9ca7985c0907b1942a385a897ef7405953ec2a54f

@legacy fec756f3338175c3a0eb2bc7980a7ec0da09e5231becbe0f422f1b249850e24d internal/host/movesoffline_return.go movesWorker.returnLeftovers legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=carlos-edge agent, J4 root-input: lists the box own park directory and nested instance directories for the host of a completed forward move to report them as a return leftovers; reads names only, grants nothing file:ReadDir@1059,file:ReadDir@515,file:ReadDir@733 97ce4913cc0334c78fed12cb52948bc41de60d613df1849566c4f3882b1ac507

internal/host/movesoffline_return.go movesWorker.returnLeftovers legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=carlos-edge agent, J4 root-input: lists the box own park directory and nested instance directories for the host of a completed forward move to report them as a return leftovers; reads names only, grants nothing file:ReadDir@1059,file:ReadDir@515,file:ReadDir@733 97ce4913cc0334c78fed12cb52948bc41de60d613df1849566c4f3882b1ac507

+# Task 8 fix round 1, rev3=PROPOSED-self-serve-moves-2: Store.FinishSelfServeMove keeps no direct read (its statement moved to finishSelfServeMove, shared with YieldSelfServeMove), so its entry row is removed under a proposed H3 disposition and finishSelfServeMove is frozen accepted-legacy; Server.probeTarget is re-pinned in place (the probe moved to probeAt with one transport per target address; its read site, crypto/rand, unchanged); the internal/console, internal/host and internal/moves envelopes are re-pinned in place.

+@removed internal/console/selfserve_store.go Store.FinishSelfServeMove H3 census-ruling-PROPOSED-self-serve-moves-2;rev3=PROPOSED-self-serve-moves-2;basis=remains declared but has no direct read; its statement moved unchanged to finishSelfServeMove, classified below, which FinishSelfServeMove calls with release_pending 1; proposed removal only

+@legacy 5fa093abea94ae2d7bd67ee3221e07eda12402fb56698c6455ad82c75108673e internal/console/selfserve_store.go Store.finishSelfServeMove legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: FinishSelfServeMove's statement moved here unchanged by Task 8 fix round 1, with release_pending set by its two callers (FinishSelfServeMove 1, YieldSelfServeMove 0, a move an operator took over); one predicated UPDATE of the console SQLite journal and its row count; no root input file:Exec@304,file:QueryRow@953 ccdea95c3714d983a25511eeb2801220b96b4dc8a5fe6892e1ec816c3ac33775

+internal/console/selfserve_store.go Store.finishSelfServeMove legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: FinishSelfServeMove's statement moved here unchanged by Task 8 fix round 1, with release_pending set by its two callers (FinishSelfServeMove 1, YieldSelfServeMove 0, a move an operator took over); one predicated UPDATE of the console SQLite journal and its row count; no root input file:Exec@304,file:QueryRow@953 ccdea95c3714d983a25511eeb2801220b96b4dc8a5fe6892e1ec816c3ac33775