carlos / platform Public

docs: self-serve moves rulings taken 2026-10-22 (Q3, cleanup exclusion, cutover, plan-2 deviation, #345 scope) and copy approved

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
claude agent, operated by paul@keymail.dev a0ddb2d204de6d8b5143ae1bf116c6633fed6507 parent b81a953
4 files changed, +8 −8
  • docs/superpowers/plans/2026-10-22-self-serve-moves-1-lifetimes-and-order.md +1 −1
  • docs/superpowers/plans/2026-10-22-self-serve-moves-2-door-token-job.md +2 −2
  • docs/superpowers/plans/2026-10-22-self-serve-moves-4-cleanup.md +1 −1
  • docs/superpowers/specs/2026-10-21-self-serve-offline-moves-design.md +4 −4

CI failed — run details

CI log
=== gate ===
.amadan/test-gate.sh
=== launchctx (0 s)
ok  	amadan.net/carlos/platform.git/launchctx	0.014s
?   	amadan.net/carlos/platform.git/launchctx/controlname	[no test files]
?   	amadan.net/carlos/platform.git/launchctx/wireid	[no test files]
=== vet (35 s)
=== gofmt (1 s)
gofmt -l .: clean
=== rest (199 s)
?   	github.com/carlosframework/platform/cmd/changelog	[no test files]
ok  	github.com/carlosframework/platform/cmd/console	6.828s
ok  	github.com/carlosframework/platform/cmd/moveprobe	13.422s
ok  	github.com/carlosframework/platform/cmd/zddprobe	0.758s
ok  	github.com/carlosframework/platform/internal/activator	63.523s
ok  	github.com/carlosframework/platform/internal/agentsock	0.021s
ok  	github.com/carlosframework/platform/internal/alerting	0.007s
ok  	github.com/carlosframework/platform/internal/analytics	0.067s
ok  	github.com/carlosframework/platform/internal/appconfig	5.237s
ok  	github.com/carlosframework/platform/internal/apperr	0.280s
ok  	github.com/carlosframework/platform/internal/applog	0.423s
ok  	github.com/carlosframework/platform/internal/awsinv	0.005s
ok  	github.com/carlosframework/platform/internal/boxchoice	0.015s
ok  	github.com/carlosframework/platform/internal/boxid	1.376s
?   	github.com/carlosframework/platform/internal/boxid/boxidtest	[no test files]
?   	github.com/carlosframework/platform/internal/boxid/internal/signtest	[no test files]
ok  	github.com/carlosframework/platform/internal/boxvolumes	0.025s
ok  	github.com/carlosframework/platform/internal/caps	0.084s
ok  	github.com/carlosframework/platform/internal/certwarm	0.011s
ok  	github.com/carlosframework/platform/internal/cgroup	0.960s
ok  	github.com/carlosframework/platform/internal/changelog	1.012s
ok  	github.com/carlosframework/platform/internal/claimactivation	2.232s
ok  	github.com/carlosframework/platform/internal/clamd	0.122s
?   	github.com/carlosframework/platform/internal/cliflag	[no test files]
?   	github.com/carlosframework/platform/internal/controlname	[no test files]
?   	github.com/carlosframework/platform/internal/controlsock	[no test files]
ok  	github.com/carlosframework/platform/internal/dbdoor	6.504s
ok  	github.com/carlosframework/platform/internal/dbdoor/dbdoortest	0.015s
ok  	github.com/carlosframework/platform/internal/dbverify	0.034s
ok  	github.com/carlosframework/platform/internal/dnsrec	0.006s
--- FAIL: TestFenceLanguagesAreDeclared (0.00s)
    fences_test.go:32: cli.md:2345: fence declares no language
    fences_test.go:32: cli.md:2351: fence declares no language
FAIL
FAIL	github.com/carlosframework/platform/internal/docsite	0.029s
ok  	github.com/carlosframework/platform/internal/domains	4.970s
ok  	github.com/carlosframework/platform/internal/doorkey	0.022s
ok  	github.com/carlosframework/platform/internal/economics	0.009s
ok  	github.com/carlosframework/platform/internal/edge	48.919s
?   	github.com/carlosframework/platform/internal/edgeproof	[no test files]
ok  	github.com/carlosframework/platform/internal/edgesfile	0.012s
ok  	github.com/carlosframework/platform/internal/fleetapi	0.242s
ok  	github.com/carlosframework/platform/internal/gate	1.734s
ok  	github.com/carlosframework/platform/internal/genselect	0.031s
ok  	github.com/carlosframework/platform/internal/geo	0.035s
ok  	github.com/carlosframework/platform/internal/geoip	0.037s
ok  	github.com/carlosframework/platform/internal/historyreadback	0.357s
ok  	github.com/carlosframework/platform/internal/host	148.698s
ok  	github.com/carlosframework/platform/internal/hostactors	9.247s
ok  	github.com/carlosframework/platform/internal/hostactors/awsmembership	0.013s
ok  	github.com/carlosframework/platform/internal/hostbox	5.065s
ok  	github.com/carlosframework/platform/internal/hostclaim	1.527s
ok  	github.com/carlosframework/platform/internal/hostenv	0.010s
ok  	github.com/carlosframework/platform/internal/hostevidence	0.016s
ok  	github.com/carlosframework/platform/internal/hostexec	9.257s
ok  	github.com/carlosframework/platform/internal/hostfence	0.136s
ok  	github.com/carlosframework/platform/internal/hostfiles	12.343s
ok  	github.com/carlosframework/platform/internal/hostfloor	0.019s
ok  	github.com/carlosframework/platform/internal/hostguard	1.131s
ok  	github.com/carlosframework/platform/internal/hostops	3.802s
?   	github.com/carlosframework/platform/internal/hostops/fencerelease	[no test files]
ok  	github.com/carlosframework/platform/internal/hostops/internal/fencerelease	0.010s
ok  	github.com/carlosframework/platform/internal/hostquarantine	0.010s
ok  	github.com/carlosframework/platform/internal/hostrelocate	1.364s
ok  	github.com/carlosframework/platform/internal/hostresolve	0.523s
ok  	github.com/carlosframework/platform/internal/hostwrite	0.005s
ok  	github.com/carlosframework/platform/internal/infraview	0.005s
ok  	github.com/carlosframework/platform/internal/instancectl	5.284s
ok  	github.com/carlosframework/platform/internal/instanceexec	3.273s
ok  	github.com/carlosframework/platform/internal/instancefs	0.011s
ok  	github.com/carlosframework/platform/internal/instancekey	0.005s
ok  	github.com/carlosframework/platform/internal/instanceupdates	0.052s
ok  	github.com/carlosframework/platform/internal/layout	3.528s
ok  	github.com/carlosframework/platform/internal/lbhealth	0.028s
ok  	github.com/carlosframework/platform/internal/lease	10.623s
ok  	github.com/carlosframework/platform/internal/lease/leasetest	0.884s
ok  	github.com/carlosframework/platform/internal/ledger	0.058s
ok  	github.com/carlosframework/platform/internal/mail	0.475s
ok  	github.com/carlosframework/platform/internal/maintenance	0.171s
ok  	github.com/carlosframework/platform/internal/maintenanceexec	6.172s
ok  	github.com/carlosframework/platform/internal/maintenanceguard	0.316s
ok  	github.com/carlosframework/platform/internal/metrics	0.016s
ok  	github.com/carlosframework/platform/internal/moves	37.554s
ok  	github.com/carlosframework/platform/internal/moves/archive	1.772s
ok  	github.com/carlosframework/platform/internal/objstore	0.787s
ok  	github.com/carlosframework/platform/internal/ops	0.383s
ok  	github.com/carlosframework/platform/internal/park	0.552s
ok  	github.com/carlosframework/platform/internal/plans	0.024s
ok  	github.com/carlosframework/platform/internal/privatefile	0.017s
ok  	github.com/carlosframework/platform/internal/provision	41.226s
ok  	github.com/carlosframework/platform/internal/publicrelease	0.009s
?   	github.com/carlosframework/platform/internal/regionname	[no test files]
ok  	github.com/carlosframework/platform/internal/registry	7.784s
ok  	github.com/carlosframework/platform/internal/relay	7.287s
ok  	github.com/carlosframework/platform/internal/release	37.478s
ok  	github.com/carlosframework/platform/internal/rollout	5.469s
ok  	github.com/carlosframework/platform/internal/rolloutwords	0.015s
ok  	github.com/carlosframework/platform/internal/rootaws	0.012s
ok  	github.com/carlosframework/platform/internal/rootparticipation	0.062s
ok  	github.com/carlosframework/platform/internal/rootstate	0.061s
ok  	github.com/carlosframework/platform/internal/runs	0.839s
ok  	github.com/carlosframework/platform/internal/s3compat	0.005s
ok  	github.com/carlosframework/platform/internal/safefile	0.008s
ok  	github.com/carlosframework/platform/internal/schedule	4.104s
ok  	github.com/carlosframework/platform/internal/seeds	0.026s
ok  	github.com/carlosframework/platform/internal/sim/hostlife	32.928s
ok  	github.com/carlosframework/platform/internal/sim/litestreamfacts	3.820s
ok  	github.com/carlosframework/platform/internal/status	0.202s
ok  	github.com/carlosframework/platform/internal/steering	0.014s
ok  	github.com/carlosframework/platform/internal/stopevidence	0.491s
ok  	github.com/carlosframework/platform/internal/svcrole	0.005s
ok  	github.com/carlosframework/platform/internal/telemetry	0.007s
ok  	github.com/carlosframework/platform/internal/termfence	0.013s
ok  	github.com/carlosframework/platform/internal/tunnelclient	0.009s
ok  	github.com/carlosframework/platform/internal/unixdial	0.003s
ok  	github.com/carlosframework/platform/internal/updatewords	0.005s
ok  	github.com/carlosframework/platform/internal/usage	0.007s
ok  	github.com/carlosframework/platform/internal/version	0.006s
ok  	github.com/carlosframework/platform/internal/vet	2.300s
FAIL
=== internal_console@0 (90 s)
ok  	github.com/carlosframework/platform/internal/console	87.265s
=== internal_console@1 (53 s)
ok  	github.com/carlosframework/platform/internal/console	49.821s
=== internal_console@2 (47 s)
2026/10/22 21:00:51 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:51 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:51 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:51 console: backfilled account manifest for bab (ops)
2026/10/22 21:00:52 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:52 console: alert watch: no keymail grant for ops-b@keymail.dev — not notified (they must sign in to the console once)
2026/10/22 21:00:52 console: alert watch: unparsable alerts/boxes/box-junk.json: invalid character 'n' looking for beginning of object key string
2026/10/22 21:00:52 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:52 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:52 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:52 console: could not notify alice@keymail.dev of a CLI token issue: keymail: grant revoked or invalid
2026/10/22 21:00:52 console: backfilled account manifest for bab (ops)
2026/10/22 21:00:52 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:52 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:52 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:52 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:52 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:52 console: app region bab/piped:  (default)
2026/10/22 21:00:52 console: backfilled account manifest for bab (ops)
2026/10/22 21:00:52 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:52 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:52 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:52 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:52 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:52 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:52 console: could not notify paul@keymail.dev of a CLI token issue: Post "http://127.0.0.1:33475/api/app/send": dial tcp 127.0.0.1:33475: connect: connection refused
2026/10/22 21:00:52 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:52 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:52 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:53 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:53 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:53 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:53 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:53 console: could not notify mallory@keymail.dev of a CLI token issue: Post "http://127.0.0.1:35543/api/app/send": dial tcp 127.0.0.1:35543: connect: connection refused
2026/10/22 21:00:53 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:54 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:54 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:54 console: could not notify alice@keymail.dev of a CLI token issue: keymail: grant revoked or invalid
2026/10/22 21:00:54 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:54 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:54 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:54 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:54 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:54 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:54 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:54 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:54 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:54 console: door keys bab/titogo: overwriting an unverifiable object: invalid character 'o' in literal null (expecting 'u')
2026/10/22 21:00:54 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:54 console: door keys bab/titogo: overwriting an unverifiable object: doorkey: bad signature
2026/10/22 21:00:54 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:54 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:54 console: backfilled account manifest for bab (ops)
2026/10/22 21:00:54 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:54 console: api features block bab/titogo: features at apps/bab/titogo/features.json: unknown schema 9
2026/10/22 21:00:54 console: api features get bab/titogo: features at apps/bab/titogo/features.json: unknown schema 9
2026/10/22 21:00:55 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:55 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:55 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:55 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:55 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:55 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:55 console: import old.shop.example.com: panic in the upload of seed sd_yhybm6v2kwolnbkaw3titvc47y: a fault in the check
goroutine 2339 [running]:
runtime/debug.Stack()
	/usr/local/go/src/runtime/debug/stack.go:26 +0x64
github.com/carlosframework/platform/internal/console.(*Server).runImportUpload.func2()
	/var/lib/amadan-runner/w2/repos/carlos__platform/wt/design-self-serve-offline-moves/internal/console/apiinstanceimport.go:561 +0x48
panic({0x18a7e40?, 0x1db1f90?})
	/usr/local/go/src/runtime/panic.go:860 +0x12c
github.com/carlosframework/platform/internal/console.TestImportUploadPanicAborts.func2({0x1dd6ce0?, 0x1df7df2a8b70?}, {0x1a3185c5000?, 0x1db9300?})
	/var/lib/amadan-runner/w2/repos/carlos__platform/wt/design-self-serve-offline-moves/internal/console/apiinstanceimport_test.go:976 +0x2c
github.com/carlosframework/platform/internal/console.(*Server).runImportUpload(0x1df7df144008, 0x1df7de446d80)
	/var/lib/amadan-runner/w2/repos/carlos__platform/wt/design-self-serve-offline-moves/internal/console/apiinstanceimport.go:568 +0x198
created by github.com/carlosframework/platform/internal/console.(*Server).handleAPIImportUpload in goroutine 2223
	/var/lib/amadan-runner/w2/repos/carlos__platform/wt/design-self-serve-offline-moves/internal/console/apiinstanceimport.go:442 +0x8ec
2026/10/22 21:00:55 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:55 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:55 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:55 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:55 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:55 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:55 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:55 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:55 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:56 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:56 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:56 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:56 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:56 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:56 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:57 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:57 console: api instance move bab/titogo/acme.go.tito.io: typed move write refused: hostops: identity mismatch
2026/10/22 21:00:57 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:57 console: api instance move bab/titogo/acme.go.tito.io: typed move write refused: hostops: identity mismatch
2026/10/22 21:00:57 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:57 console: api instance move bab/titogo/acme.go.tito.io: typed move write refused: hostops: identity mismatch
2026/10/22 21:00:57 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:58 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:59 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:59 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:59 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:59 console: offline move acme.shop.example.com: ignoring control/offline-moves/acme.shop.example.com/mv_fskutcvpkmzwptnrqkdpitt7mu/source/ie-x.json: not a report of this move
2026/10/22 21:00:59 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:59 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:59 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:59 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:59 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:00:59 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:00 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:00 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:00 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:00 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:00 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:00 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:00 edges: box "legacy" has an edges file under control/edges/ but no status snapshot at all, so no region outside the home is automatically eligible until it reports; said once
2026/10/22 21:01:00 edges: 1 edges file(s) under control/edges/ but no fresh box snapshot matched any of them, so automatic region placement sees the home alone (are edges and status in different buckets? see CARLOS_STATUS_BUCKET/CARLOS_STATUS_PREFIX)
2026/10/22 21:01:00 console: an incomplete read of the edges files or box snapshots (edges complete true, snapshots complete false), so no region outside the home is automatically eligible this request; said once
2026/10/22 21:01:00 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:00 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:00 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:00 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000000 txid.db=0000000000000001
2026/10/22 21:01:00 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000001 maxTXID=0000000000000001 size=720
2026/10/22 21:01:00 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000001
2026/10/22 21:01:00 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000002
2026/10/22 21:01:00 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000002 maxTXID=0000000000000002 size=370
2026/10/22 21:01:00 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000002 txid.db=0000000000000002
2026/10/22 21:01:00 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000002 txid.db=0000000000000003
2026/10/22 21:01:00 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000003 maxTXID=0000000000000003 size=454
2026/10/22 21:01:00 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000003 txid.db=0000000000000003
2026/10/22 21:01:00 console: from main.shop.example.com: plan: dbdoor: the last planned file's header does not describe it
2026/10/22 21:01:00 console: from main.shop.example.com: plan: file does not exist
2026/10/22 21:01:00 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:00 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000000 txid.db=0000000000000001
2026/10/22 21:01:00 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000001 maxTXID=0000000000000001 size=720
2026/10/22 21:01:00 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000001
2026/10/22 21:01:00 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000002
2026/10/22 21:01:00 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000002 maxTXID=0000000000000002 size=370
2026/10/22 21:01:00 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000002 txid.db=0000000000000002
2026/10/22 21:01:00 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000002 txid.db=0000000000000003
2026/10/22 21:01:00 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000003 maxTXID=0000000000000003 size=454
2026/10/22 21:01:00 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000003 txid.db=0000000000000003
2026/10/22 21:01:00 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:00 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000000 txid.db=0000000000000001
2026/10/22 21:01:00 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000001 maxTXID=0000000000000001 size=720
2026/10/22 21:01:00 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000001
2026/10/22 21:01:00 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000002
2026/10/22 21:01:00 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000002 maxTXID=0000000000000002 size=370
2026/10/22 21:01:00 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000002 txid.db=0000000000000002
2026/10/22 21:01:00 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000002 txid.db=0000000000000003
2026/10/22 21:01:00 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000003 maxTXID=0000000000000003 size=454
2026/10/22 21:01:00 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000003 txid.db=0000000000000003
2026/10/22 21:01:00 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:00 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000000 txid.db=0000000000000001
2026/10/22 21:01:00 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000001 maxTXID=0000000000000001 size=720
2026/10/22 21:01:00 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000001
2026/10/22 21:01:00 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000002
2026/10/22 21:01:00 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000002 maxTXID=0000000000000002 size=370
2026/10/22 21:01:00 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000002 txid.db=0000000000000002
2026/10/22 21:01:00 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000002 txid.db=0000000000000003
2026/10/22 21:01:00 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000003 maxTXID=0000000000000003 size=454
2026/10/22 21:01:00 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000003 txid.db=0000000000000003
2026/10/22 21:01:01 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:01 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000000 txid.db=0000000000000001
2026/10/22 21:01:01 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000001 maxTXID=0000000000000001 size=720
2026/10/22 21:01:01 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000001
2026/10/22 21:01:01 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000002
2026/10/22 21:01:01 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000002 maxTXID=0000000000000002 size=370
2026/10/22 21:01:01 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000002 txid.db=0000000000000002
2026/10/22 21:01:01 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000002 txid.db=0000000000000003
2026/10/22 21:01:01 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000003 maxTXID=0000000000000003 size=454
2026/10/22 21:01:01 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000003 txid.db=0000000000000003
2026/10/22 21:01:01 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000000 txid.db=0000000000000001
2026/10/22 21:01:01 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000001 maxTXID=0000000000000001 size=720
2026/10/22 21:01:01 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000001
2026/10/22 21:01:01 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000002
2026/10/22 21:01:01 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000002 maxTXID=0000000000000002 size=370
2026/10/22 21:01:01 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000002 txid.db=0000000000000002
2026/10/22 21:01:01 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000002 txid.db=0000000000000003
2026/10/22 21:01:01 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000003 maxTXID=0000000000000003 size=454
2026/10/22 21:01:01 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000003 txid.db=0000000000000003
2026/10/22 21:01:01 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:01 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:01 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:01 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:01 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:01 console: could not notify paul@keymail.dev of a CLI token issue: Post "http://127.0.0.1:37175/api/app/send": dial tcp 127.0.0.1:37175: connect: connection refused
2026/10/22 21:01:01 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:01 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:01 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:01 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:01 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:01 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:01 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:01 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:01 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:01 console: relay enabled bab/titogo in eu-west-1 by alice@keymail.dev (incarnation 03d0dd4f709acd31, op 1)
2026/10/22 21:01:01 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:01 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:01 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:02 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:02 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:02 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:02 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:02 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:02 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:02 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:02 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:02 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:02 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:02 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:02 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:02 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:02 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:02 console: api run bab/shop/acme.example.com run_mt2vxff77egccdcg6wxg6d4j7u: delete after ack: delete refused
2026/10/22 21:01:02 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:02 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:02 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:03 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:03 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:03 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:03 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:03 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:03 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:03 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:03 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:03 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:04 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:04 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:04 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:04 console: could not notify paul@keymail.dev of a CLI token issue: keymail: lookup paul@keymail.dev: Get "http://127.0.0.1:37783/api/federation/lookup?addr=paul%40keymail.dev&from=console%40127.0.0.1%3A33975": dial tcp 127.0.0.1:37783: connect: connection refused
2026/10/22 21:01:04 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:04 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:04 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:04 console: could not notify paul@keymail.dev of a CLI token issue: Post "http://127.0.0.1:36413/api/app/send": dial tcp 127.0.0.1:36413: connect: connection refused
2026/10/22 21:01:04 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:04 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:04 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:04 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:05 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:05 console: could not notify owner@example.teſt of a CLI token issue: keymail: lookup owner@example.teſt: Get "http://127.0.0.1:37735/api/federation/lookup?addr=owner%40example.te%C5%BFt&from=console%40127.0.0.1%3A46483": dial tcp 127.0.0.1:37735: connect: connection refused
2026/10/22 21:01:05 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:05 console: api store approvals: read store/entitlements/bab.json: objstore: store/entitlements/bab.json: invalid character 'o' in literal null (expecting 'u')
2026/10/22 21:01:05 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:05 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:05 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:05 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:05 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:05 console: could not notify alice@keymail.dev of a CLI token issue: Post "http://127.0.0.1:37333/api/app/send": dial tcp 127.0.0.1:37333: connect: connection refused
2026/10/22 21:01:05 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:05 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:05 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:05 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:05 console: could not notify owner@example.teſt of a CLI token issue: keymail: lookup owner@example.teſt: keymail: GET /api/federation/lookup?addr=owner%40example.te%C5%BFt&from=console%40127.0.0.1%3A33407: could not determine target mailbox
2026/10/22 21:01:05 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:05 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:05 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:05 console: api system antivirus: read: release: system/antivirus.json: schema 99 is not 1
2026/10/22 21:01:05 console: api system antivirus: replacing an unreadable record on disable: release: system/antivirus.json: schema 99 is not 1
2026/10/22 21:01:05 console: object scanning disabled deployment-wide by alice@keymail.dev
2026/10/22 21:01:05 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:05 console: geoip upload: unexpected EOF
2026/10/22 21:01:06 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:06 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:06 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:06 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:06 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:06 console: bab/tmp-a is in the trash in the bucket; marking it trashed here
2026/10/22 21:01:06 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:06 console: bab/tmp-b is in the trash in the bucket; marking it trashed here
2026/10/22 21:01:06 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:06 console: could not notify alice@keymail.dev of a CLI token issue: keymail: grant revoked or invalid
2026/10/22 21:01:06 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:06 console: could not notify paul@keymail.dev of a CLI token issue: Post "http://127.0.0.1:37587/api/app/send": EOF
2026/10/22 21:01:06 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:06 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:06 console: api updates install bab/km/a.example.com: AccessDenied: s3://carlos-prod-secret-bucket/ledgers request id ABC123
2026/10/22 21:01:06 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:07 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:07 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:07 console: api releases list bab/km: tags: AccessDenied: s3://carlos-prod-secret-bucket/tags request id DEF456
2026/10/22 21:01:07 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:07 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:07 console: app region bab/console:  (default)
2026/10/22 21:01:07 console: backfilled account manifest for bab (ops)
2026/10/22 21:01:07 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:07 console: backfilled account manifest for bab (ops)
2026/10/22 21:01:07 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:07 console: backfilled account manifest for bab (ops)
2026/10/22 21:01:07 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:07 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:07 console: backfilled account manifest for bab (ops)
2026/10/22 21:01:07 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:07 console: backfilled account manifest for bab (ops)
2026/10/22 21:01:07 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:07 console: architecture refresh: console: infra inventory disabled for this process
2026/10/22 21:01:07 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:08 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:08 console: could not notify paul@keymail.dev of a CLI token issue: Post "http://127.0.0.1:37109/api/app/send": EOF
2026/10/22 21:01:08 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:08 console: app region bab/hub-a-0:  (default)
2026/10/22 21:01:08 console: backfilled account manifest for bab (ops)
2026/10/22 21:01:08 console: app region bab/hub-a-1:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-2:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-3:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-4:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-5:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-6:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-7:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-8:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-9:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-10:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-11:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-12:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-13:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-14:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-15:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-16:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-17:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-18:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-19:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-20:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-21:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-22:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-23:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-24:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-25:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-26:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-27:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-28:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-29:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-30:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-31:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-32:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-33:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-34:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-35:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-36:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-37:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-38:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-39:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-40:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-41:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-42:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-43:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-44:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-45:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-46:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-47:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-48:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-49:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-50:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-51:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-52:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-53:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-54:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-55:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-56:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-57:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-58:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-59:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-60:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-61:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-62:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-63:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-64:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-65:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-66:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-67:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-68:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-69:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-70:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-71:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-72:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-73:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-74:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-75:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-76:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-77:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-78:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-79:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-80:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-81:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-82:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-83:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-84:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-85:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-86:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-87:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-88:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-89:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-90:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-91:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-92:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-93:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-94:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-95:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-96:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-97:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-98:  (default)
2026/10/22 21:01:08 console: app region bab/hub-a-99:  (default)
2026/10/22 21:01:08 console: app region bab/hub-b-fresh:  (default)
2026/10/22 21:01:08 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:08 console: could not notify paul@keymail.dev of a CLI token issue: Post "http://127.0.0.1:39439/api/app/send": dial tcp 127.0.0.1:39439: connect: connection refused
2026/10/22 21:01:08 console: materialized account bac (Kass) from the bucket
2026/10/22 21:01:08 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:08 edges: skipping control/edges/uk-box.json in the placement join: not a versioned edges file
2026/10/22 21:01:08 edges: box "uk-box" has a fresh status snapshot but no edges file under control/edges/, so no region outside the home is automatically eligible until it publishes one; said once
2026/10/22 21:01:08 console: claim request refused: hostops: the placement read was incomplete, so no box could be judged
2026/10/22 21:01:08 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:09 console: claim request refused: hostops: the placement read was incomplete, so no box could be judged
2026/10/22 21:01:09 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:09 console: claim request refused: move room check: edges store down
2026/10/22 21:01:09 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:09 console: claim request refused: move room check: hostops: the placement read was incomplete, so no box could be judged
2026/10/22 21:01:09 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:09 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:10 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:10 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:10 console: backfilled account manifest for bab (ops)
2026/10/22 21:01:10 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:10 console: backfilled account manifest for bab (ops)
2026/10/22 21:01:10 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:10 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:10 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:10 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:10 console: claim recovery: context canceled
2026/10/22 21:01:10 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:11 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:11 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:12 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:12 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:12 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:12 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:12 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:12 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:13 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:13 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:13 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:13 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000000 txid.db=0000000000000001
2026/10/22 21:01:13 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000001 maxTXID=0000000000000001 size=720
2026/10/22 21:01:13 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000001
2026/10/22 21:01:13 console: api instances create bab/titogo: refused: acme.go.tito.io still holds replica data from a deleted record (#199); purge it to free the host
2026/10/22 21:01:13 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:13 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000000 txid.db=0000000000000001
2026/10/22 21:01:13 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000001 maxTXID=0000000000000001 size=720
2026/10/22 21:01:13 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000001
2026/10/22 21:01:13 console: api sidecars create bab/titogo: refused: bot.titogo.bab.sidecar.internal still holds replica data from a deleted record (#199); purge it to free the host
2026/10/22 21:01:13 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:13 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000000 txid.db=0000000000000001
2026/10/22 21:01:13 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000001 maxTXID=0000000000000001 size=720
2026/10/22 21:01:13 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000001
2026/10/22 21:01:13 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:13 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000000 txid.db=0000000000000001
2026/10/22 21:01:13 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000001 maxTXID=0000000000000001 size=720
2026/10/22 21:01:13 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000001
2026/10/22 21:01:13 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:13 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000000 txid.db=0000000000000001
2026/10/22 21:01:13 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000001 maxTXID=0000000000000001 size=720
2026/10/22 21:01:13 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000001
2026/10/22 21:01:13 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:13 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000000 txid.db=0000000000000001
2026/10/22 21:01:13 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000001 maxTXID=0000000000000001 size=720
2026/10/22 21:01:13 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000001
2026/10/22 21:01:13 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:13 console: materialized account bac (Testco) from the bucket
2026/10/22 21:01:13 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:13 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:13 console: backfilled account manifest for bab (ops)
2026/10/22 21:01:13 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:13 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:13 console: deploy signer for bab/hello: mint key grant: invalid name "deploy.bad name!" (letters, digits, . _ - ; up to 64)
2026/10/22 21:01:13 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:13 console: attach story.carlosframework.com: existing record is not this door's to adopt (read: provision: record bab/story/story.carlosframework.com: provision: record is corrupt: provision: invalid maintenance projection or protected fields)
2026/10/22 21:01:13 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:13 console: attach story.carlosframework.com: record write: opStore: timed out after the object landed
2026/10/22 21:01:13 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:13 console: attach story.carlosframework.com: record write: opStore: bucket unavailable
2026/10/22 21:01:13 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:13 console: could not notify alice@keymail.dev of a CLI token issue: keymail: grant revoked or invalid
2026/10/22 21:01:13 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:13 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:14 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:14 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:14 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:14 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:14 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:14 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:14 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:14 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:14 console: edge proof: first signed request from the edge — X-Forwarded-For from loopback now needs a proof
2026/10/22 21:01:14 console: a loopback request carried X-Forwarded-For with no valid edge proof; counting it against the peer address. Expected now and then from a process on this box; on every request it means the edge no longer signs (rolled back?) and every client shares one rate limit
2026/10/22 21:01:14 console: a loopback request carried X-Forwarded-For with no valid edge proof; counting it against the peer address. Expected now and then from a process on this box; on every request it means the edge no longer signs (rolled back?) and every client shares one rate limit
2026/10/22 21:01:14 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:14 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:14 console: expiry pass: bab/tmp-a is marked as the control plane; not purging it
2026/10/22 21:01:14 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:14 console: expiry pass: bab/tmp-a has email estate; not purging it
2026/10/22 21:01:14 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:14 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:14 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:14 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:14 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:14 console: geoip feed test-feed: edition 2026-10 rejected: wrong type
2026/10/22 21:01:14 console: geoip feed status unreadable; this check's outcome was not recorded
2026/10/22 21:01:14 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:14 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:15 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:15 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:15 console: instance store bab/shop/canary: seed sd_aaaaaaaaaaaaaaaaaaaaaaaaaa declaration not rolled back: the record was written since (its grant block or another writer), left as it is
2026/10/22 21:01:15 console: instance store provision bab/shop/canary: objstore: ensure user carlos-store-bab-shop-canary: iam is down
2026/10/22 21:01:15 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:15 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:15 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:15 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:15 console: backfilled account manifest for bab (ops)
2026/10/22 21:01:15 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:15 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:15 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:15 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:15 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:15 console: materialized account bac (Kass) from the bucket
2026/10/22 21:01:15 console: materialized account bac (Testco) from the bucket
2026/10/22 21:01:15 console: reaped account bac (Testco) — its manifest is tombstoned
2026/10/22 21:01:15 console: materialized account bac (Testco) from the bucket
2026/10/22 21:01:15 console: bac/alpha is in the trash in the bucket — marking it trashed here
2026/10/22 21:01:15 console: bac/beta has no trash marker and still has objects — restoring it here
2026/10/22 21:01:15 console: bac/gamma is gone from the bucket — releasing the name here
2026/10/22 21:01:15 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:16 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:16 console: moves: warning: acme.go.tito.io: the log of move mv_retired at done is held: the writer refuses it (hostops: identity mismatch); its entry is kept until its incarnation is purged
2026/10/22 21:01:16 console: moves: warning: acme.go.tito.io: the log of move mv_earlier at done is held: the writer refuses it (hostops: identity mismatch); its entry is kept until its incarnation is purged
2026/10/22 21:01:16 console: audit instance-delete titogo: hostops: pending
2026/10/22 21:01:25 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:26 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:26 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:26 console: backfilled account manifest for bab (ops)
2026/10/22 21:01:26 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:26 console: execute promote fc48dd81c37da18320bcb3ce1bda0a8f: 1 of 2 confirmations counted (1 rows, quorum stored 2)
2026/10/22 21:01:26 console: execute promote ccf66d10c76a93354c363c0da1851566: change belongs to 1/"kass", not 1/"widget"
2026/10/22 21:01:26 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:26 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:26 console: could not notify paul@keymail.dev of a CLI token issue: keymail: lookup paul@keymail.dev: Get "http://127.0.0.1:40627/api/federation/lookup?addr=paul%40keymail.dev&from=console%40127.0.0.1%3A36631": dial tcp 127.0.0.1:40627: connect: connection refused
2026/10/22 21:01:26 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:26 console: app region bab/bakeapp:  (default)
2026/10/22 21:01:26 console: backfilled account manifest for bab (ops)
2026/10/22 21:01:26 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:26 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:26 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:26 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:27 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:27 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:27 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:27 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:28 console: claim SQL receipt database moved from instance i-original to i-replacement; it has a new database ID, and effects bound to the old one stay unsettled
2026/10/22 21:01:28 console: claim SQL receipt database moved from instance i-replacement to i-original; it has a new database ID, and effects bound to the old one stay unsettled
2026/10/22 21:01:28 console: alert watch: no keymail grant for ops-b@keymail.dev — not notified (they must sign in to the console once)
2026/10/22 21:01:28 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:28 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:28 console: plan limits: bab: bucket unavailable
2026/10/22 21:01:28 console: plan limits: byv: bucket unavailable
2026/10/22 21:01:28 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:28 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:28 console: api instances create bab/titogo: incomplete edges or snapshot read, region uk unconfirmed
2026/10/22 21:01:29 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:29 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:29 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:29 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:29 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:29 console: relay enabled bab/titogo in eu-west-1 by alice@keymail.dev (incarnation b91ae190cde9c5d5, op 1)
2026/10/22 21:01:29 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:29 console: relay enabled bab/titogo in eu-west-1 by alice@keymail.dev (incarnation 39855fa8675ca921, op 1)
2026/10/22 21:01:29 console: relay rotated eu-west-1 to kid k2, re-issued 1 app(s)
2026/10/22 21:01:29 console: relay rotated eu-west-1 to kid k3, re-issued 1 app(s)
2026/10/22 21:01:29 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:29 console: api instances list bab/kass: 1 record(s) unreadable [pi-host.example.test]; every fleet counts toward the rollout join
2026/10/22 21:01:29 status: fleet: skipping status/boxes/broken.json: corrupt snapshot: invalid character 'n' looking for beginning of object key string
2026/10/22 21:01:29 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:29 status: fleet: skipping status/boxes/broken.json: corrupt snapshot: invalid character 'n' looking for beginning of object key string
2026/10/22 21:01:29 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:29 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:29 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:29 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:30 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:30 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:30 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:30 console: scan drain: bab/kass: queue dropped — this store may no longer be scanned
2026/10/22 21:01:30 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:30 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:30 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:30 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:30 console: a clamd address is configured but object scanning is not enabled — run `carlos system antivirus enable`
2026/10/22 21:01:30 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:30 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000000 txid.db=0000000000000001
2026/10/22 21:01:30 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000001 maxTXID=0000000000000001 size=720
2026/10/22 21:01:30 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000001
2026/10/22 21:01:30 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000002
2026/10/22 21:01:30 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000002 maxTXID=0000000000000002 size=370
2026/10/22 21:01:30 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000002 txid.db=0000000000000002
2026/10/22 21:01:30 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000002 txid.db=0000000000000003
2026/10/22 21:01:30 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000003 maxTXID=0000000000000003 size=454
2026/10/22 21:01:30 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000003 txid.db=0000000000000003
2026/10/22 21:01:30 console: instance bab/shop/other.shop.example.com binds environment "canary": the store seed sd_652tvnb45ujyendmusdrlndltm made (bucket carlos-bab-shop-canary) is no longer that seed's, and its finish leaves it standing
2026/10/22 21:01:30 console: finished seed sd_652tvnb45ujyendmusdrlndltm of bab/shop/canary.shop.example.com
2026/10/22 21:01:30 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:30 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000000 txid.db=0000000000000001
2026/10/22 21:01:30 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000001 maxTXID=0000000000000001 size=720
2026/10/22 21:01:30 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000001
2026/10/22 21:01:30 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000002
2026/10/22 21:01:30 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000002 maxTXID=0000000000000002 size=370
2026/10/22 21:01:30 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000002 txid.db=0000000000000002
2026/10/22 21:01:30 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000002 txid.db=0000000000000003
2026/10/22 21:01:30 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000003 maxTXID=0000000000000003 size=454
2026/10/22 21:01:30 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000003 txid.db=0000000000000003
2026/10/22 21:01:30 console: instance bab/shop/other.shop.example.com binds environment "canary": the store seed sd_zyqjbn75qnzscrjce7absgblmi made (bucket carlos-bab-shop-canary) is no longer that seed's, and its finish leaves it standing
2026/10/22 21:01:30 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:30 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000000 txid.db=0000000000000001
2026/10/22 21:01:30 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000001 maxTXID=0000000000000001 size=720
2026/10/22 21:01:30 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000001
2026/10/22 21:01:30 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000002
2026/10/22 21:01:30 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000002 maxTXID=0000000000000002 size=370
2026/10/22 21:01:30 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000002 txid.db=0000000000000002
2026/10/22 21:01:30 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000002 txid.db=0000000000000003
2026/10/22 21:01:30 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000003 maxTXID=0000000000000003 size=454
2026/10/22 21:01:30 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000003 txid.db=0000000000000003
2026/10/22 21:01:30 console: finish seed sd_w723qbakgoommpnvcz4k7ftlny of canary.shop.example.com: its replica is outside this console's data bucket; not deleting it
2026/10/22 21:01:30 console: finished seed sd_w723qbakgoommpnvcz4k7ftlny of bab/shop/canary.shop.example.com
2026/10/22 21:01:30 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:30 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000000 txid.db=0000000000000001
2026/10/22 21:01:30 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000001 maxTXID=0000000000000001 size=720
2026/10/22 21:01:30 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000001
2026/10/22 21:01:30 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000002
2026/10/22 21:01:30 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000002 maxTXID=0000000000000002 size=370
2026/10/22 21:01:30 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000002 txid.db=0000000000000002
2026/10/22 21:01:30 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000002 txid.db=0000000000000003
2026/10/22 21:01:30 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000003 maxTXID=0000000000000003 size=454
2026/10/22 21:01:30 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000003 txid.db=0000000000000003
2026/10/22 21:01:31 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:31 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:31 console: could not notify paul@keymail.dev of a CLI token issue: keymail: lookup paul@keymail.dev: Get "http://127.0.0.1:45007/api/federation/lookup?addr=paul%40keymail.dev&from=console%40127.0.0.1%3A37801": dial tcp 127.0.0.1:45007: connect: connection refused
2026/10/22 21:01:31 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:31 console: seeds pass: off on a host-claim console, where every seed door refuses
2026/10/22 21:01:31 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:31 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000000 txid.db=0000000000000001
2026/10/22 21:01:31 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000001 maxTXID=0000000000000001 size=720
2026/10/22 21:01:31 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000001
2026/10/22 21:01:31 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000002
2026/10/22 21:01:31 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000002 maxTXID=0000000000000002 size=370
2026/10/22 21:01:31 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000002 txid.db=0000000000000002
2026/10/22 21:01:31 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000002 txid.db=0000000000000003
2026/10/22 21:01:31 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000003 maxTXID=0000000000000003 size=454
2026/10/22 21:01:31 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000003 txid.db=0000000000000003
2026/10/22 21:01:31 console: seeds pass: deleted seeds/canary.shop.example.com/sd_5aqmbcewuyibwkkpnf3shcsq3u/snapshot.db
2026/10/22 21:01:31 console: seeds pass: finish seed sd_5aqmbcewuyibwkkpnf3shcsq3u of canary.shop.example.com: finish seed sd_5aqmbcewuyibwkkpnf3shcsq3u of canary.shop.example.com: this console has no storage backend to tear its store down with
2026/10/22 21:01:31 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:31 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:31 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:31 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:31 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:32 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:32 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:32 console: backfilled account manifest for bab (ops)
2026/10/22 21:01:32 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:32 console: backfilled account manifest for bab (ops)
2026/10/22 21:01:32 console: steering hostname "*.oncarlos.com" is not a valid domain — custom-domain guidance keeps the A-record form
2026/10/22 21:01:32 console: steering hostname "not a host" is not a valid domain — custom-domain guidance keeps the A-record form
2026/10/22 21:01:32 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:32 console: fleet hosts: bucket list refused
2026/10/22 21:01:32 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:32 console: backfilled account manifest for bab (ops)
2026/10/22 21:01:32 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:32 console: backfilled account manifest for bab (ops)
2026/10/22 21:01:32 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:32 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:32 console: ses events: signature verification failed: fake: signature does not verify
2026/10/22 21:01:32 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:32 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:32 console: store decision bab: keymail to paul@keymail.dev: delivery failed
2026/10/22 21:01:32 console: store application bab: keymail to paul@keymail.dev: delivery failed
2026/10/22 21:01:32 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:32 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:33 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:33 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:33 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:33 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:33 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:33 console: account telemetry bab: dirstore: invalid key "apps/bab//telemetry.json"
2026/10/22 21:01:33 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:34 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
--- FAIL: TestEveryClosedDoorRefusesAServiceCredential (0.13s)
    svcroutes_test.go:1011: walked 64 closed doors, want all 64 (and 63 today: instance-token, three door-key doors, the routes door, instances-manifest, the app update policy, sidecars-manifest, the route-channel move, three instance update settings doors, two db replica doors, six fleets, four services, two email credentials, email pause, the build probe, the swap policy, the live tenancy read, the layout read, the activation-cancel door, nine system doors, three deployment-wide antivirus, three platform geoip doors, two pointer digest doors, the channel resign, two release authorize doors, four store-entitlement doors, two account plan doors, and the five run doors)
2026/10/22 21:01:34 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:34 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:34 console: could not notify paul@keymail.dev of a CLI token issue: Post "http://127.0.0.1:43611/api/app/send": dial tcp 127.0.0.1:43611: connect: connection refused
2026/10/22 21:01:34 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:34 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:34 console: app region bab/four:  (default)
2026/10/22 21:01:34 console: backfilled account manifest for bab (ops)
2026/10/22 21:01:34 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:34 console: backfilled account manifest for bab (ops)
2026/10/22 21:01:34 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/22 21:01:35 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
FAIL
FAIL	github.com/carlosframework/platform/internal/console	43.913s
FAIL
=== internal_console@3 (52 s)
ok  	github.com/carlosframework/platform/internal/console	49.244s
=== internal_console@4 (54 s)
ok  	github.com/carlosframework/platform/internal/console	52.196s
=== internal_console@5 (50 s)
ok  	github.com/carlosframework/platform/internal/console	48.072s
=== internal_console@6 (55 s)
ok  	github.com/carlosframework/platform/internal/console	53.255s
=== internal_console@7 (55 s)
ok  	github.com/carlosframework/platform/internal/console	52.458s
=== root@0 (49 s)
ok  	github.com/carlosframework/platform	45.561s
=== root@1 (52 s)
ok  	github.com/carlosframework/platform	49.309s
=== root@2 (55 s)
ok  	github.com/carlosframework/platform	52.365s

FAILED: rest internal_console@2
make: *** [Makefile:19: test] Error 1

amadan: step gate failed: exit status 2

amadan: job failed at step gate — its output is above, not at the tail of this log
diff --git a/docs/superpowers/plans/2026-10-22-self-serve-moves-1-lifetimes-and-order.md b/docs/superpowers/plans/2026-10-22-self-serve-moves-1-lifetimes-and-order.md
index 4f0609870..e8f51a627 100644
--- a/docs/superpowers/plans/2026-10-22-self-serve-moves-1-lifetimes-and-order.md
+++ b/docs/superpowers/plans/2026-10-22-self-serve-moves-1-lifetimes-and-order.md
@@ -23,7 +23,7 @@ Rev 22, 2026-10-22. Rev 21's confirming review (`selfserve-plan1-review21.md`) f
- No console write to a bucket outside the deployment bucket. On the box, `ClaimRootHTTP`'s claims-on readers are untouched; root's proof and restart record readers take the judge (Task 6).
- Census: `TestPlan14RootReadCensus` and `TestPlan9B8RecordWriteCensus` are the authority on what they cover. The root-read overlay is `internal/provision/testdata/plan14-root-reads-self-serve-moves-1.tsv`, loaded last (before the comparison) by a new block at the end of the test, `rev3=PROPOSED-self-serve-moves-1`, with an `@fields` line naming the new record fields and registry columns, rows for every changed unit and envelope the test names, reviewed dispositions for changed frozen units, and the note `docs/superpowers/notes/census-proposal-self-serve-moves-1.md`. The record-write inventory is `plan14SelfServeMoves1WriteCensusInventory()`, wrapping `plan14ClaimRosterBindingWriteCensusInventory()` with every added, changed and removed site the scanner reports, each reviewed. Both tests green.
- The new SQLite tables are classified in `claimSQLTables` (`internal/console/store_gate.go`) so a claims-on store still opens.
-- Copy: the new sentences are copy rows pending Paul's review: "the instance changed. read it again and try the delete once more"; "another change to this instance is still settling. try again in a minute"; "the console is switching on instance lifetimes. try again in a minute" (draining); "the console is starting. try again in a minute" (the marker not yet read); "this console runs host claims; lifetimes are not for it"; "the cutover marker exists but cannot be read. repair control/lifetimes-cutover.json by hand"; the CLI's output lines "instance lifetimes: switching on; N unit(s) of earlier work still finishing" and "instance lifetimes: on since <time>". Existing sentences are reused where the plan says so. No tenant names: `shop.example.com`, account `bab`, app `shop`.
+- Copy: the new sentences are copy rows (approved by Paul 2026-10-22; later additions pending): "the instance changed. read it again and try the delete once more"; "another change to this instance is still settling. try again in a minute"; "the console is switching on instance lifetimes. try again in a minute" (draining); "the console is starting. try again in a minute" (the marker not yet read); "this console runs host claims; lifetimes are not for it"; "the cutover marker exists but cannot be read. repair control/lifetimes-cutover.json by hand"; the CLI's output lines "instance lifetimes: switching on; N unit(s) of earlier work still finishing" and "instance lifetimes: on since <time>". Existing sentences are reused where the plan says so. No tenant names: `shop.example.com`, account `bab`, app `shop`.
- Boxes roll before the console (the roll order rule); the migration pass is behind `CARLOS_LIFETIMES_MIGRATE=1`, default off, until every box of a deployment runs this code.
- Counters: `incarnation` and `move_seq` are `uint64` on the record and `INTEGER` (int64) in SQLite and the registry; a value that would exceed `math.MaxInt64` is refused before any write (`ErrLifetimeExhausted`), never wrapped; a stored value above `math.MaxInt64` is `ErrLifetimeExhausted` at read (the doors answer 502, reconcile protects the row).
- **Cutover (the late legacy delete).** An older console's `RetireRecord` deletes a record unconditionally and must never run beside this code; nor may this console let a legacy mutation admitted before the cutover land after lifetimes start. The cutover is an **admission gate plus a marker** (Task 0). The marker `control/lifetimes-cutover.json` (`{"at": <time>, "by": <operator>}`) is written create-only by the operator door `POST /api/cli/system/lifetimes/cutover` (`carlos system lifetimes cutover`), run **after** the old console process has stopped (one console process per deployment; a unit restart stops the old process before the new one starts). **Admission:** every claims-off unit of record work on the console (an API or browser request that may mutate or read a record; a detached continuation such as the import upload's; one iteration of a worker: the seed sweep, the import pass, the runs pass, the placement pass, the recovery and migration passes) begins with `unit, ok := s.lifetimesAdmit(ctx)` and ends with `unit.done()`; the unit runs in the **mode it was admitted in** for its whole life (a detached continuation inherits its request's unit and ends it when the continuation ends). **States:** `unknown` (startup, the marker not yet read successfully): every claims-off record door, read or mutation, answers 503 "the console is starting. try again in a minute" and workers idle; `before` (the marker read and absent): units are admitted without a judge and behave exactly as main; `draining` (the marker exists, or the door has just written it): no new unit is admitted (mutations and reads that would mutate answer 503 "the console is switching on instance lifetimes. try again in a minute"; plain reads are admitted **judged**, since a read never lands a write); activation requires a **successfully validated marker** (`markerSeen`), the admitted-before count at zero, and `lifetimeSettle` (60 s) elapsed since the **latest** of the marker's `at`, this process's start, and the instant the last `before` unit called `done()` (a legacy request that was fully received by storage before its client timed out completes within the settle, so nothing admitted before the marker lands after activation); `on`: units are admitted with the judge (`provision.WithLifetimes`), the passes run. `on` is **latched** in the process: once reached, no later marker read, failure or decode error leaves it; a process that starts into an existing marker, however old, enters `draining` with no units and activates `lifetimeSettle` after its own start (the previous process's fully received requests complete within that window). A marker that cannot be read or does not decode: in `unknown` the state stays `unknown` (503s) and pages once per hour; in `before`/`draining` the state becomes `draining` (no new units) **but `markerSeen` stays false, so activation cannot happen on uncertainty**; a later successful absent read returns `draining`-by-uncertainty to `before`; in `on` nothing changes. The storage assumption, stated: S3 applies a mutation before it acknowledges it and never after the client's connection closed before the request was fully received, and a fully received request completes within seconds; with the old process gone, every admitted-before unit of this process finished, and the settle passed, no legacy mutation is outstanding when lifetimes turn on. (b) the recovery and migration passes do no work unless admitted in `on`; (c) an older console is never reintroduced once the marker exists. The cutover is a rollout prerequisite and an addition to the design, stated beside the uncached slot read. Within it a key never disappears under a live owned slot except through this code's conditional deletes, so a record's `record_seq` is a non-repeating revision.
diff --git a/docs/superpowers/plans/2026-10-22-self-serve-moves-2-door-token-job.md b/docs/superpowers/plans/2026-10-22-self-serve-moves-2-door-token-job.md
index f449e398b..12ce307af 100644
--- a/docs/superpowers/plans/2026-10-22-self-serve-moves-2-door-token-job.md
+++ b/docs/superpowers/plans/2026-10-22-self-serve-moves-2-door-token-job.md
@@ -12,7 +12,7 @@ Builds on plan 1 (`2026-10-22-self-serve-moves-1-lifetimes-and-order.md`, rev 13
**Tech Stack:** Go. `internal/console`, `internal/provision`, `internal/moves`, `internal/host`, `internal/moves/archive`, `internal/alerting`, `internal/status`, `internal/lease`, `internal/boxid`. Tests: the console in-process with `release.NewDirStore`; integrated witnesses in `internal/e2e/selfserve` (build tag `e2e`) over the exported bridge `host.E2E` and the console's exported test hooks.
-**Spec:** `docs/superpowers/specs/2026-10-21-self-serve-offline-moves-design.md` §4, §5, §6.1 to §6.3, §7 (except §7.4's probe mode and §7.6), §7.5's operator return, §8, §11. Stated deviations: the record's `self_serve` is an object; the pre-request estimate input is the replica size alone; the claims-off "move log" is the console's `self_serve_events` table; **in self-serve mode the legacy move mutations are not served** (a plain instance token gets the family's 404 at prepare, cut and cancel; the status read stays open), because the dispatch must be decided before any evidence is read (Paul's ruling owed, amadan #343).
+**Spec:** `docs/superpowers/specs/2026-10-21-self-serve-offline-moves-design.md` §4, §5, §6.1 to §6.3, §7 (except §7.4's probe mode and §7.6), §7.5's operator return, §8, §11. Stated deviations: the record's `self_serve` is an object; the pre-request estimate input is the replica size alone; the claims-off "move log" is the console's `self_serve_events` table; **in self-serve mode the legacy move mutations are not served** (a plain instance token gets the family's 404 at prepare, cut and cancel; the status read stays open), because the dispatch must be decided before any evidence is read (ruled by Paul 2026-10-22, amadan #343).
## Global Constraints
@@ -24,7 +24,7 @@ Builds on plan 1 (`2026-10-22-self-serve-moves-1-lifetimes-and-order.md`, rev 13
- Refusals before writes; the record checks run again from the fresh judged record immediately before the queue write and before the start.
- **Participants** are pinned at admission as `{BoxID, Label, InstanceID string; Verified bool}` (`BootID` is not pinned: it has no claims-off producer and a reboot does not change the machine's identity). **One resolver** (`moves.ParticipantRole`) decides a box's role in every box path and every console gate from `BoxID` **and** `InstanceID`; **one identity check** (`moves.ParticipantStillPresent`, Task 6) at every gate. A participant pinned with an empty `InstanceID` (the operator path on a box without a fresh report) matches **any instance of its `BoxID`** (the label) and forces the sentinel reservation; there is no region fallback for a pinned participant (only a move without `Participants` keeps the region rule). A move without `Participants` keeps today's region rule everywhere.
- Timestamps in SQLite are Unix nanoseconds; request identities are the **nonce** persisted before the write and read back from the record's receipt.
-- Copy rows pending Paul's review (every sentence in quotes in Tasks 5, 7 and 8). No tenant names: `shop.example.com`, account `bab`, app `shop`, display name "Shop's account".
+- Copy rows (approved by Paul 2026-10-22; later additions pending) (every sentence in quotes in Tasks 5, 7 and 8). No tenant names: `shop.example.com`, account `bab`, app `shop`, display name "Shop's account".
- Census: `internal/provision/testdata/plan14-root-reads-self-serve-moves-2.tsv` loaded by a new `loadRootReadInventory(..., true)` block in `internal/provision/plan14_root_reads_test.go` after every existing overlay and before `compareRootReads`, `rev3=PROPOSED-self-serve-moves-2`, `@fields` for the new record fields (`self_serve`, `participants`, `queued_at`, `precheck_at`, `return_of`), reviewed dispositions for the changed envelopes (`internal/host`, `internal/status`, `internal/moves`, `internal/console`, `internal/lease`); `TestPlan9B8RecordWriteCensus` takes `plan14SelfServeMoves2WriteCensusInventory()` wrapping plan 1's with every added or changed writer: the new transitions, the box's report writers (lane, precheck, ready, staged, reverting, return-ready), the console's `open.json`, the return request writer, the console lease, `active.json`'s table form, the write guard; both green.
- Local tests: touched packages with `-run`; CI runs the full suite **and** `go test -tags e2e ./internal/e2e/...` (Task 10 adds the step to `.amadan/test-gate.sh`).
diff --git a/docs/superpowers/plans/2026-10-22-self-serve-moves-4-cleanup.md b/docs/superpowers/plans/2026-10-22-self-serve-moves-4-cleanup.md
index e0cbc431a..ffd482dc8 100644
--- a/docs/superpowers/plans/2026-10-22-self-serve-moves-4-cleanup.md
+++ b/docs/superpowers/plans/2026-10-22-self-serve-moves-4-cleanup.md
@@ -24,7 +24,7 @@ Builds on plans 1 to 3: `withHostname`/`admit` (plan 1), `moves.Reserve`/`Releas
- The reservation helper lives in `internal/moves` (`Reserve`, `Release`) with typed options and errors; the console's `reserveBoxes`/`releaseBoxes` (plan 2) are thin wrappers.
- Every deletion, skip and refusal is durable in `retired.json` (`Keys`) and published in the cleanup report under `control/offline-moves/<host>/<cleanup id>/cleanup/<box>.json`.
- Census: the box's cleanup units and root's handler take rows in `plan14-root-reads-self-serve-moves-4.tsv`, loaded last by a new block at the end of `TestPlan14RootReadCensus`, `rev3=PROPOSED-self-serve-moves-4`, with rows for the actual readers (the record, the lock state, the registry, the versions listing, the request file) at the `authority` class with the evidence basis each needs, not the wrapper's label; both census tests green.
-- Copy rows pending Paul's review: "the previous instance at this hostname is still being cleaned up. try again later". No tenant names in tests.
+- Copy rows (approved by Paul 2026-10-22; later additions pending): "the previous instance at this hostname is still being cleaned up. try again later". No tenant names in tests.
- Local tests: touched packages with `-run`; CI runs the full suite.
## Review Focus
diff --git a/docs/superpowers/specs/2026-10-21-self-serve-offline-moves-design.md b/docs/superpowers/specs/2026-10-21-self-serve-offline-moves-design.md
index 23b26d23e..5b7e3a1f2 100644
--- a/docs/superpowers/specs/2026-10-21-self-serve-offline-moves-design.md
+++ b/docs/superpowers/specs/2026-10-21-self-serve-offline-moves-design.md
@@ -1,6 +1,6 @@
# Self-serve offline moves: a tenant's customer moves their own instance
-Rev 16, 2026-10-22. Status: Astra READY at rev 16 (`after236/selfserve-spec-review16.md`, sixteen rounds); awaiting Paul's approval, with §10 Q3 the one ruling it changes. Built behind `CARLOS_SELF_SERVE_MOVES` meanwhile, off by default. Branch `design-self-serve-offline-moves`. Rev 1 (062387a1) was reviewed by Astra (`after236/selfserve-spec-review.md`, NOT READY, 14 findings) and by a cold builder check (7 questions); rev 2 (0e58e51d) answered them and was reviewed again (`selfserve-spec-review2.md`, NOT READY, 12 findings). Rev 2's automatic return after `open` was the source of most of round 2: whether the new region ever accepted a write cannot be proven from the bucket (litestream releases the lease even when its final sync failed; file-only changes leave no LTX; an absent lock does not tell "never taken" from "released"), and a safe post-open revert would need a new admission barrier and stop protocol for the target, which is Phase 1's work. **Rev 3 narrows the promise to what is provable**: every failure before `open` returns the account to the old region automatically and losslessly, everything checkable is checked before `open`, and a failure after `open` is paged with the holding page kept until the app answers, the return being an operator's run of the same offline move the other way. This changes one of Paul's rulings and is §10 Q3. Rev 3 (b77c01a9) was reviewed again (`selfserve-spec-review3.md`, NOT READY, 8 findings, the abort boundary accepted); rev 4 answers them: which failures stay after `open` (§7.5), the job's durable admission order (§7), cleanup's own reservation and the root handoff (§7.6), the holding entries' causal ordering (§6.4), the probe mode (§7.4), deadlines as initiate-and-retry with blocked states (§7.2), and the stale contradictions. Rev 4 (20fdcf18) was reviewed again (`selfserve-spec-review4.md`, NOT READY, 2 P1 and 2 P2: holding entries ordered by move identity cannot order consecutive moves or show an abort completed; a timed-out root cleanup request could run after its reservation was released; the queued handshake's producers; stale text). Rev 5 answers them with a per-host `move_seq` published with every route and holding entry (§6.4), a root request that ends only with root's `done` or acknowledged `cancelled` (§7.6), queued defined as no copying with the participants' reports allowed (§7), and the stale passages aligned. Rev 5 (89e0f37a) was reviewed again (`selfserve-spec-review5.md`, NOT READY, 1 P1 and 2 P2: a serving row rebuilt by ordinary reconciliation after a finished move would carry sequence 0 and lose to a stale holding entry, and a recreated host's publications need separating from a previous life's; the queued table order; two stale sentences). Rev 6 answers them: reconciliation persists the record's sequence with a row it mints after a move (§6.4), a per-record `move_lineage` separates lives (§6.4), the table order and the two sentences are fixed. Rev 6 (bc5e2d97) was reviewed again (`selfserve-spec-review6.md`, NOT READY, 1 P1: a random lineage identifies but does not order lifetimes, and a lineage-less publication retained by an edge through a read failure can coexist with the first move's holding entry). Rev 7 replaces the lineage with a durable per-hostname incarnation number the console allocates and never reuses, so every publication orders as (incarnation, sequence) and a publication without one loses (§6.4). Rev 7 (f2feed6c) was reviewed again (`selfserve-spec-review7.md`, NOT READY, 1 P1: a custom domain repointed from one instance to another compares two unrelated counters). Rev 8 gives alias bindings their own durable revision from the domains record, published with the target hostname; edges pick the newest binding first and compare the target's pair within it (§6.4). Rev 8 (05f4c353) was reviewed again (`selfserve-spec-review8.md`, NOT READY, 1 P1: aliases derived from a wildcard catch-all have no binding record to carry a revision; 1 P2: retaining a detached domains record changes what a claim listing means). Rev 9 narrows: holding entries list explicit aliases only and derived aliases keep today's answer during a move; the binding revision lives in a console table that survives the domains record, so detach stays a delete (§6.4). Rev 9 (3bcea70e) was reviewed again (`selfserve-spec-review9.md`, NOT READY: a detached explicit alias can fall back to a derived one beneath a retained explicit holding entry; the revision table and the bucket write need a crash-safe protocol). Every remaining round-8 and round-9 finding was about a holding entry an edge keeps as last-good through a read failure and later orders against a new binding. **Rev 10 stops tolerating that case instead of ordering it:** a holding entry is never last-good, it is honoured only from a publication fetched within the last five minutes, and the alias revision machinery is dropped; the incarnation number is allocated durably before it is exposed (§6.4). Rev 10 (82023a80) was reviewed again (`selfserve-spec-review10.md`, NOT READY, 2 P1 and 1 P2: two concurrent creates of one hostname can commit incarnations out of order; a fresh hold must not displace a retained ready route for an alias that now names another instance; alias publications need the target hostname). Rev 11 answers them: creates and deletes of a hostname are serialised through a pending allocation that only a completed record write commits (§6.4); for an alias, any eligible ready route naming a different target wins over a holding entry, pairs are compared only within one target, and the five-minute bound is stated as a bound on reader disconnection, not publisher death (§6.4); every alias publication carries its target hostname (§6.4). Rev 11 (9ae3902f) was reviewed again (`selfserve-spec-review11.md`, NOT READY, 1 P1: recovery after a console crash could abandon an outstanding create whose record write later lands, because the record's "absent" precondition recurs after a deletion). Rev 12 makes the incarnation an authoritative bucket slot that never returns to absent and that every consumer checks the record against, so a late write materialises nothing (§6.4). Rev 12 (35bd391d) was reviewed again (`selfserve-spec-review12.md`, NOT READY, 2 P1: recovery that advances the slot would invalidate a create whose record did land; the ordinary delete is unconditional and a delayed one could erase a successor). Rev 13 answers them: recovery replays the create's own intent to completion at its allocated number and never advances a slot to abandon; deletes are conditional on the observed record ETag and retire only the captured slot revision, with persisted intent (§6.4). Rev 13 (696cb374) was reviewed again (`selfserve-spec-review13.md`, NOT READY, 1 P1: a retirement that exposes the record's absence before the slot is retired lets a late original create restore an obsolete record, and an ETag difference alone was read as a successor; 1 P2: allocation recovery omitted the crash before the slot write and a stale record under the key). Rev 14 answers them: retirement first replaces the record with a non-servable tombstone, so absence is never exposed while the slot is live, and every recovery branch of the create and the retirement is listed (§6.4). Rev 14 (bb05348f) was reviewed again (`selfserve-spec-review14.md`, NOT READY, 1 P1: a record without the incarnation field was accepted beside any existing slot, so an old console's outstanding create could land after a retirement; 1 P2: two retirement recovery states had no terminal disposition). Rev 15 answers them: a fieldless record beside a slot is valid only under a live migration intent bound to that record's key and ETag, and both retirement states get terminal outcomes (§6.4). Rev 15 (dd094a27) was reviewed again (`selfserve-spec-review15.md`, NOT READY, 1 P1: an ordinary record write that wins between the migration's read and its CAS left a legitimate fieldless record that the new rule treated as stale). Rev 16 answers it: migration first marks the record by CAS, which fences every writer, and binds the slot to the marked record (§6.4).
+Rev 16, 2026-10-22. Status: Astra READY at rev 16 (`after236/selfserve-spec-review16.md`, sixteen rounds); **approved by Paul 2026-10-22 with §10 Q3 ruled as stated** (amadan #343). Built behind `CARLOS_SELF_SERVE_MOVES` meanwhile, off by default. Branch `design-self-serve-offline-moves`. Rev 1 (062387a1) was reviewed by Astra (`after236/selfserve-spec-review.md`, NOT READY, 14 findings) and by a cold builder check (7 questions); rev 2 (0e58e51d) answered them and was reviewed again (`selfserve-spec-review2.md`, NOT READY, 12 findings). Rev 2's automatic return after `open` was the source of most of round 2: whether the new region ever accepted a write cannot be proven from the bucket (litestream releases the lease even when its final sync failed; file-only changes leave no LTX; an absent lock does not tell "never taken" from "released"), and a safe post-open revert would need a new admission barrier and stop protocol for the target, which is Phase 1's work. **Rev 3 narrows the promise to what is provable**: every failure before `open` returns the account to the old region automatically and losslessly, everything checkable is checked before `open`, and a failure after `open` is paged with the holding page kept until the app answers, the return being an operator's run of the same offline move the other way. This changes one of Paul's rulings and is §10 Q3. Rev 3 (b77c01a9) was reviewed again (`selfserve-spec-review3.md`, NOT READY, 8 findings, the abort boundary accepted); rev 4 answers them: which failures stay after `open` (§7.5), the job's durable admission order (§7), cleanup's own reservation and the root handoff (§7.6), the holding entries' causal ordering (§6.4), the probe mode (§7.4), deadlines as initiate-and-retry with blocked states (§7.2), and the stale contradictions. Rev 4 (20fdcf18) was reviewed again (`selfserve-spec-review4.md`, NOT READY, 2 P1 and 2 P2: holding entries ordered by move identity cannot order consecutive moves or show an abort completed; a timed-out root cleanup request could run after its reservation was released; the queued handshake's producers; stale text). Rev 5 answers them with a per-host `move_seq` published with every route and holding entry (§6.4), a root request that ends only with root's `done` or acknowledged `cancelled` (§7.6), queued defined as no copying with the participants' reports allowed (§7), and the stale passages aligned. Rev 5 (89e0f37a) was reviewed again (`selfserve-spec-review5.md`, NOT READY, 1 P1 and 2 P2: a serving row rebuilt by ordinary reconciliation after a finished move would carry sequence 0 and lose to a stale holding entry, and a recreated host's publications need separating from a previous life's; the queued table order; two stale sentences). Rev 6 answers them: reconciliation persists the record's sequence with a row it mints after a move (§6.4), a per-record `move_lineage` separates lives (§6.4), the table order and the two sentences are fixed. Rev 6 (bc5e2d97) was reviewed again (`selfserve-spec-review6.md`, NOT READY, 1 P1: a random lineage identifies but does not order lifetimes, and a lineage-less publication retained by an edge through a read failure can coexist with the first move's holding entry). Rev 7 replaces the lineage with a durable per-hostname incarnation number the console allocates and never reuses, so every publication orders as (incarnation, sequence) and a publication without one loses (§6.4). Rev 7 (f2feed6c) was reviewed again (`selfserve-spec-review7.md`, NOT READY, 1 P1: a custom domain repointed from one instance to another compares two unrelated counters). Rev 8 gives alias bindings their own durable revision from the domains record, published with the target hostname; edges pick the newest binding first and compare the target's pair within it (§6.4). Rev 8 (05f4c353) was reviewed again (`selfserve-spec-review8.md`, NOT READY, 1 P1: aliases derived from a wildcard catch-all have no binding record to carry a revision; 1 P2: retaining a detached domains record changes what a claim listing means). Rev 9 narrows: holding entries list explicit aliases only and derived aliases keep today's answer during a move; the binding revision lives in a console table that survives the domains record, so detach stays a delete (§6.4). Rev 9 (3bcea70e) was reviewed again (`selfserve-spec-review9.md`, NOT READY: a detached explicit alias can fall back to a derived one beneath a retained explicit holding entry; the revision table and the bucket write need a crash-safe protocol). Every remaining round-8 and round-9 finding was about a holding entry an edge keeps as last-good through a read failure and later orders against a new binding. **Rev 10 stops tolerating that case instead of ordering it:** a holding entry is never last-good, it is honoured only from a publication fetched within the last five minutes, and the alias revision machinery is dropped; the incarnation number is allocated durably before it is exposed (§6.4). Rev 10 (82023a80) was reviewed again (`selfserve-spec-review10.md`, NOT READY, 2 P1 and 1 P2: two concurrent creates of one hostname can commit incarnations out of order; a fresh hold must not displace a retained ready route for an alias that now names another instance; alias publications need the target hostname). Rev 11 answers them: creates and deletes of a hostname are serialised through a pending allocation that only a completed record write commits (§6.4); for an alias, any eligible ready route naming a different target wins over a holding entry, pairs are compared only within one target, and the five-minute bound is stated as a bound on reader disconnection, not publisher death (§6.4); every alias publication carries its target hostname (§6.4). Rev 11 (9ae3902f) was reviewed again (`selfserve-spec-review11.md`, NOT READY, 1 P1: recovery after a console crash could abandon an outstanding create whose record write later lands, because the record's "absent" precondition recurs after a deletion). Rev 12 makes the incarnation an authoritative bucket slot that never returns to absent and that every consumer checks the record against, so a late write materialises nothing (§6.4). Rev 12 (35bd391d) was reviewed again (`selfserve-spec-review12.md`, NOT READY, 2 P1: recovery that advances the slot would invalidate a create whose record did land; the ordinary delete is unconditional and a delayed one could erase a successor). Rev 13 answers them: recovery replays the create's own intent to completion at its allocated number and never advances a slot to abandon; deletes are conditional on the observed record ETag and retire only the captured slot revision, with persisted intent (§6.4). Rev 13 (696cb374) was reviewed again (`selfserve-spec-review13.md`, NOT READY, 1 P1: a retirement that exposes the record's absence before the slot is retired lets a late original create restore an obsolete record, and an ETag difference alone was read as a successor; 1 P2: allocation recovery omitted the crash before the slot write and a stale record under the key). Rev 14 answers them: retirement first replaces the record with a non-servable tombstone, so absence is never exposed while the slot is live, and every recovery branch of the create and the retirement is listed (§6.4). Rev 14 (bb05348f) was reviewed again (`selfserve-spec-review14.md`, NOT READY, 1 P1: a record without the incarnation field was accepted beside any existing slot, so an old console's outstanding create could land after a retirement; 1 P2: two retirement recovery states had no terminal disposition). Rev 15 answers them: a fieldless record beside a slot is valid only under a live migration intent bound to that record's key and ETag, and both retirement states get terminal outcomes (§6.4). Rev 15 (dd094a27) was reviewed again (`selfserve-spec-review15.md`, NOT READY, 1 P1: an ordinary record write that wins between the migration's read and its CAS left a legitimate fieldless record that the new rule treated as stale). Rev 16 answers it: migration first marks the record by CAS, which fences every writer, and binds the slot to the marked record (§6.4).
Builds on the offline operator move (`docs/superpowers/plans/2026-10-20-offline-operator-move.md`, shipped in v0.28.5 to v0.28.7) and its runbook (`docs/superpowers/plans/2026-10-21-offline-move-runbook.md`). Supersedes nothing: Phase 1 (`docs/superpowers/specs/2026-10-02-move-any-app-design.md`) stays the live-move path for claims-on deployments, and the M1 to M18 rulings stand. M18 ("Tito waits; move mutations are operator-only") is answered here for one door, not lifted: §5 says exactly what the customer's request may do.
@@ -13,7 +13,7 @@ A Tito customer opens Account settings, Data residency, in Tito's dashboard, see
**Paul's rulings, 2026-10-21:**
- The customer confirms the downtime themselves; nobody at Tito approves.
- No size cap: the estimate is shown and the customer decides. (Qualified in §6.3: the archive's 256 MiB files limit, M5, is a separate ruling this design does not lift; §10 Q5.)
-- A failure after the account has gone offline puts it back in the old region automatically. (Kept for every failure before `open`, where the final copy, the archive, the config render and the landing's verification happen, as an abort the job initiates and retries; Paul is asked to accept that after `open` the return is an operator's run, §10 Q3, because a lossless automatic return after the new region has started cannot be proven with the claims-off machinery, and some failures stay after `open` by the offline move's design, §7.5.)
+- A failure after the account has gone offline puts it back in the old region automatically. (Kept for every failure before `open`, where the final copy, the archive, the config render and the landing's verification happen, as an abort the job initiates and retries; Paul ruled 2026-10-22 that after `open` the return is an operator's run, §10 Q3, because a lossless automatic return after the new region has started cannot be proven with the claims-off machinery, and some failures stay after `open` by the offline move's design, §7.5.)
- Scheduling is nice to have, not needed first.
- Offline moves stay available to Tito as an operator-run option regardless.
@@ -202,7 +202,7 @@ Every wait has a deadline derived from the estimate's terms with a floor; a stag
- **The opened report is missing:** the job stays in `opening`, pages, and retries each tick; it never calls `finish` without the gate's evidence. The operator's recovery is to supply the missing prerequisite (the runbook: the target's archive-prefix deletion that `opened` waits on, a box that stopped reporting) and let the job or the operator's `finish` door complete it; no door bypasses the gate.
- **The operator's return** is the offline move the other way, run with the operator doors and the runbook, after reading the target's state by hand. It needs the reverse lane (§9), the originating box passing the target-ready facts of §7.3 with the forward move's leftovers in place. Those leftovers are: the park directory `<fwd id>/source/` and `<fwd id>/sealer/`, the lifted `lock.json` (owner `moved:<fwd id>`), the root-owned live link and `/data/programs/<host>.json` naming the build, for a nested source the empty `/data/.instances/<host>` and `/data/instances/<host>` and its mount view (`retirePaths`, runbook §8), and the old replica objects under `instances/<host>/` older than the forward's `open_at`. The target-ready report lists each as a fact; **the operator's start door accepts exactly that set for a return of move `<fwd id>`** (the report names the move id each leftover belongs to) and refuses anything else. That acceptance is also the contract an automatic return would need, so it is built now, and used by an operator.
-The customer-facing promise is therefore: the account comes back to the old region on its own for any failure up to the point its data is verified and landed in the new region; after that, it is in the new region, a failure to answer is caught within minutes and paged, and a person moves it back if that is the right call. §10 Q3 asks Paul to accept this over rev 2's broader promise.
+The customer-facing promise is therefore: the account comes back to the old region on its own for any failure up to the point its data is verified and landed in the new region; after that, it is in the new region, a failure to answer is caught within minutes and paged, and a person moves it back if that is the right call. Paul accepted this over rev 2's broader promise on 2026-10-22 (§10 Q3).
### 7.6 Cleanup: who deletes what, from what evidence
@@ -243,7 +243,7 @@ Infra: both staging lanes for every region pair the console arms (today IE to UK
- **Q1.** The move-capable token (§5) as the answer to M18 for this door, app-wide and owner-minted. Default: yes.
- **Q2.** Cancel during `cutting` is refused. Default: refused; the customer confirmed.
-- **Q3 (changes a ruling).** The account returns automatically only for failures before `open`; after `open` a failure is caught and paged within minutes and the return is an operator's run of the offline move back. The failures that stay after `open` are the target's executable stage, the replica's promotion, a missing certificate and the app's own start (§7.5). Default: as stated. The alternatives are (a) materialising and verifying the build, the promotion and the certificate on the held target before it opens (a change to the offline move's data path), or (b) an admission barrier and a target stop protocol for a post-open revert (Phase 1's claim); say if you want either built first and the self-serve move waits for it.
+- **Q3 (changes a ruling; ruled 2026-10-22: as stated).** The account returns automatically only for failures before `open`; after `open` a failure is caught and paged within minutes and the return is an operator's run of the offline move back. The failures that stay after `open` are the target's executable stage, the replica's promotion, a missing certificate and the app's own start (§7.5). Default: as stated. The alternatives are (a) materialising and verifying the build, the promotion and the certificate on the held target before it opens (a change to the offline move's data path), or (b) an admission barrier and a target stop protocol for a post-open revert (Phase 1's claim); say if you want either built first and the self-serve move waits for it.
- **Q4.** The source replica deletion 24 hours after done, by the source box, with the runbook's checks. Default: automatic.
- **Q5.** The archive's 256 MiB files limit (M5) stays and is a refusal before confirming. Raising it is separate work; say if you want it in this version.
- **Q6.** The display name is Tito-supplied per request, validated, shown to unauthenticated visitors. Default: yes.