carlos / platform Public

offline-move: census overlay, PROPOSED-moves-offline

The root-read overlay plan14-root-reads-moves-offline.tsv loads last,
after bootstrap-carlos-follows-316: 39 new units and 4 changed legacy
units proposed accepted legacy (43 frozen declarations, so the seal
moves to 833ae5ae), 2 authority units re-pinned at main's class, and ten
envelopes re-pinned. The record-write overlay adds 9 sites (3 typed
record writers, 5 non-record Puts, 1 reference) and refreshes 4 at
main's class. Every row is rev3=PROPOSED-moves-offline; the proposal,
with each unit's executing identity, is
docs/superpowers/notes/census-proposal-moves-offline.md, for platform-1c
to rule.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude 4 days ago ae122d78c5ca96b8dd51bea1a192641caff375a7 parent 38dfe4d

5 files changed, +312 −1

docs/superpowers/notes/census-proposal-moves-offline.md +141 −0
internal/provision/moves_offline_census_test.go +54 −0
internal/provision/plan14_root_reads_test.go +15 −0
internal/provision/plan9_b8_census_test.go +1 −1
internal/provision/testdata/plan14-root-reads-moves-offline.tsv +101 −0

CI cancelled — superseded by a newer push — run details

diff --git a/docs/superpowers/notes/census-proposal-moves-offline.md b/docs/superpowers/notes/census-proposal-moves-offline.md

new file mode 100644

index 000000000..a470110a0

--- /dev/null

+++ b/docs/superpowers/notes/census-proposal-moves-offline.md

@@ -0,0 +1,141 @@

+# Census: the offline operator move

+Status: PROPOSED. Every row carries `rev3=PROPOSED-moves-offline`. The ruling

+is asked of the claim owner, platform-1c, as census owner for this branch.

+The branch is `moves-offline` (the plan is

+`docs/superpowers/plans/2026-10-20-offline-operator-move.md`). It adds two

+census overlays:

+- `internal/provision/testdata/plan14-root-reads-moves-offline.tsv`, loaded

+ last in `TestPlan14RootReadCensus`, after bootstrap-carlos-follows-316.

+ It has 45 rows: 39 new units and 4 changed legacy units, all proposed

+ accepted legacy (43 `@legacy` frozen declarations), and 2 authority units

+ re-pinned at main's class and task. It also re-pins ten source envelopes:

+ `.`, `internal/cgroup`, `internal/console`, `internal/host`,

+ `internal/layout`, `internal/lease`, `internal/lease/leasetest`,

+ `internal/moves`, `internal/moves/archive` and `internal/provision`.

+- `internal/provision/moves_offline_census_test.go`, the record-write (9B8)

+ overlay on claim-step6-artifacts' inventory: 9 new sites and 4 changed

+ ones. `TestPlan9B8RecordWriteCensus` now reads

+ `plan14MovesOfflineWriteCensusInventory`.

+The legacy seal moves from `53b3cbb6…5b2d7` (main, after 316) to

+`833ae5ae924d4e26453bcf04d8b6572e1449d792fb456f5a19026bc591dff196`, because

+the accepted-legacy rows add 43 frozen declarations. The test checks main's

+seal first and then the new one, so a change on main's side still shows on

+its own.

+## What the ruling is asked to decide

+1. **The footing.** Every new root-read unit runs as the box agent

+ (`/opt/carlos/carlos agent`, carlos-edge.service, `User=carlos`), the

+ console (cmd/console serve, user carlos-console) or the carlos CLI on an

+ operator's machine. None makes a root decision. So each is proposed

+ accepted legacy on census-ruling-carlos-run's footing, at the

+ disposition main gives its moves siblings: J1 (root-route) for registry

+ and route reads, J4 (root-input) for file reads, and J1,J4 where a unit

+ does both, as main's `sourceFinal.run`.

+2. **Root reachability.** The offline code is reached only through the

+ armed moves worker. `armMovesPass` is called only from `runAgent`

+ (`internal/host/agent.go:600`). The two `reconcileSerialized` callers

+ are the agent's loops (`agent.go:2682`, `agent.go:3267`). In a root

+ process (`carlos adopt`, `carlos system apply`) `armedMovesWorker` is

+ nil, so `reconcileSerializedWith` adds no offline hook. One thing needs

+ a ruling: `agentRunsAsRoot` (`agent.go`) admits an agent run as root, as

+ on older boxes. On such a box every agent row below runs as root. The

+ proposal treats that as main already does for the Phase 1 moves units:

+ the identity is the shipped unit's (`User=carlos`).

+3. **The 9B8 classes** below: three typed record writers and five

+ non-record Put sites.

+## Root-read census

+### New root-read units (39), each proposed accepted legacy

+|---|---|---|---|---|

+| `internal/cgroup/hostprocs_linux.go:countProcs` | file:Lstat, file:ReadDir | box agent as carlos | root-input J4 | through moveCfg.Procs (armOffline): counts the pids in the host's exec cgroup and nested slice in cgroupfs, never following a link; the count goes in the source report (-1 when unknown) and never starts, stops or kills anything |

+| `internal/console/apiinstancemove_offline.go:Server.offlineClaimEvidence` | file:Read | console (carlos-console) | root-input J4 | reads the host claim, the record's acquisition, a domains claim and the app's admission only to refuse an offline start (MV-O29, MV-O20); a failed read refuses with a 502, never reads as absence; deny-only |

+| `internal/host/movesoffline.go:heldBy` | registry:HoldOp, registry:Status, whole:Route | box agent as carlos | root-route J1 | reads a registry row's hold op and status to answer whether this move holds it; an absent row counts as held, since nothing can serve a host with no row |

+| `internal/host/movesoffline.go:movesWorker.localState` | file:ReadDir, registry:DBPath x2, whole:Route x3 | box agent as carlos | route-and-input J1,J4 | reads what this box keeps for the host (database, litestream meta, files directory, env files) under both layouts, for the source report; reads only |

+| `internal/host/movesoffline_land.go:movesWorker.landReport` | registry:HoldOp, registry:NextDue, registry:Replication, registry:Status, whole:Route x9 | box agent as carlos | root-route J1 | ensures each landing item against the held row and returns the target report |

+| `internal/host/movesoffline_seal.go:movesWorker.offlineFilesOf` | file:ReadDir, registry:Host, whole:Route x3 | box agent as carlos | route-and-input J1,J4 | reads the row and lists the nested instance directory for the files, env and config paths; an app entry beside the files directory refuses the seal |

+| `internal/host/movesoffline_seal.go:movesWorker.offlineTakeSeal` | registry:DBPath, registry:NextDue x2, registry:Replication x2, whole:Route x6, whole:Timer x5 | box agent as carlos | root-route J1 | seal steps 1 to 9 from the row: database path, next due, replication rung and timer rows, read for the seal |

+| `internal/lease/tombstone.go:readLock` | file:ReadAll | box agent as carlos | root-input J4 | through lease.Tombstone, Reassert and LiftTombstone (the offline sealer and landing): reads the litestream lock object with its ETag; a garbled or expiry-less lock is an error, never free |

+### Changed legacy units (4), re-frozen at main's disposition

+|---|---|---|---|

+| `internal/host/edgesfile.go:edgesFileLoop` | file:Read | box agent as carlos | main's body (census-ruling-seeded-instances) with offline-move-1 joining the published capabilities each pass while the armed moves worker is capable (withOfflineCapability), and headroom asked of region HA's capability alone; read site unchanged, offset moved; a report, not a decision |

+| `internal/lease/leasetest/s3server.go:NewS3Server` | file:Query | tests only | main's fixture (census-ruling-FS-R10) with ListObjectsV2 and If-Match on DeleteObject added, as S3 answers them; simulated ETags and conditional writes grant no production root authority |

+| `internal/moves/archive/archive.go:walk` | file:Lstat x2, file:WalkDir | box agent as carlos | main's body (census-ruling-moves-overcap-cut-236, root-input J4) with a skip filter that only leaves paths out (nil from every caller today); reads stay on the os.Root, and its binding condition holds: no read falls back to a path-based open |

+### Changed authority units (2), re-pinned at main's class and task

+|---|---|---|---|---|

+| `internal/host/agent.go:fastConvergeLoop` | B3 | whole:Route x2 | box agent as carlos | main's body (census-ruling-carlos-run) with the offline keep view read before the first reconcile pass (refreshOfflineView); read sites unchanged, offsets moved; main's B3 authority retained |

+| `internal/host/movespass.go:armMovesPass` | B,C | file:Read, registry:Provisioned, whole:Route | box agent as carlos | main's construction with newMovesWorker, the box label and version store set whatever the switch says, and armOffline called after armPhase1; read sites unchanged, offsets moved; main's B,C authority retained |

+## Record-write census (9B8)

+|---|---|---|---|---|

+| `internal/provision/provision.go:updateRecordSeeding` | key:RecordKey,key:WriteRecord | record-writer (main's) | console and agent, as on main | a mutation that reports the record unchanged (`errRecordUnchanged`) now returns with no write and no sequence advance; every write still goes through `WriteRecord` |

+## How the overlay was made

+A throwaway `_test.go` in `internal/provision` ran `rootReadProduction`,

+loaded every overlay in the test's own order, and printed each new or

+changed unit with its scan kinds and digest, the changed envelopes, and the

+dispositions of the sibling moves units. The rows were written from that

+output, the `@legacy` fingerprints computed with `rootReadLegacyFingerprint`'s

+formula, and the seal read back with the overlay loaded. The throwaway was

+deleted. Any change to a unit above, comments included, needs the overlay

+regenerated the same way.

diff --git a/internal/provision/moves_offline_census_test.go b/internal/provision/moves_offline_census_test.go

new file mode 100644

index 000000000..4131e9cdc

--- /dev/null

+++ b/internal/provision/moves_offline_census_test.go

@@ -0,0 +1,54 @@

+package provision

+// plan14MovesOfflineWriteCensusOverlay is the offline operator move's

+// record-write sites (docs/superpowers/plans/2026-10-20-offline-operator-move.md),

+// PROPOSED-moves-offline: the ruling is asked of the census owner

+// (platform-1c; docs/superpowers/notes/census-proposal-moves-offline.md).

+//

+// The three record writers reach the store only through the typed

+// provision.SetRecordMove: the console's door (offlineApply, user

+// carlos-console) and the agent's sealer and landing (offlineKeepStop,

+// offlineLand, user carlos). The five Put sites write no record key: the

+// console's one-move lock (control/offline-moves/active.json, create-only,

+// released at its etag), the boxes' reports under control/offline-moves/

+// (writeOfflineReport, putOfflineCreateOnly), and the sealed archive, its

+// manifest, the timers snapshot and the env report under the move's

+// moves/@offline/ prefix in the target data bucket (offlineArchive,

+// offlineTakeSeal). Hence nonrecord. OfflineManifest names record paths in

+// prose and builds no key: reference. The four changed sites keep main's

+// class; their changes add the offline verb, route and name, and no write.

+var plan14MovesOfflineWriteCensusOverlay = []censusEntry{

+ {"internal/console/authcli.go", "Server.registerCLIRoutes", "key-site", "lit:instances,lit:sidecars", "2d415897086483fbedf03497573c2a659c21099c1aecb285b3a8dafd208d0b2c"},

+ {"internal/layout/extras.go", "var platformNames", "key-site", "lit:instances", "5e7d7b72d9c70c3c5eef748e7af90c8e0c960fba0fd544d95268644e9acaa05b"},

+ {"internal/provision/provision.go", "updateRecordSeeding", "record-writer", "key:RecordKey,key:WriteRecord", "0b9146b53aaa29b7436f9dc165c3c15cf1cddd6f8994b3c8657533a5c469c51e"},

+ {"move.go", "moveMain", "key-site", "lit:instances", "df49e358a39d3b4a212282231eb5ef3599e0c7befc14a31342c5e63997437941"},

+ {"internal/console/apiinstancemove_offline.go", "Server.offlineApply", "record-writer", "key:SetRecordMove", "0ee1115f8dcac6cb69280e7f5d9f931e262e24d9ae5e0d43439f6fc2b4bc8d77"},

+ {"internal/console/apiinstancemove_offline.go", "Server.offlineTakeLock", "nonrecord", "sel:Put", "3afefdbb0a0584e0b3addcc0974a2fb18b6b7f1f15ed3d75837a77ddb62a646f"},

+ {"internal/host/movesoffline.go", "putOfflineCreateOnly", "nonrecord", "sel:Put", "303094d7293045486936215263bf4ea28a1967488424fe8cf27bebd66b960b14"},

+ {"internal/host/movesoffline.go", "writeOfflineReport", "nonrecord", "sel:PutReplace", "37502f0f956b65609b6704f5df00824043d9f324367924598643362ba8a4d70e"},

+ {"internal/host/movesoffline_land.go", "movesWorker.offlineLand", "record-writer", "key:SetRecordMove", "55f5aaa04c83ad343ab44d477274b89f3e1a8efe29fc7ccb60251fef4ac7fe87"},

+ {"internal/host/movesoffline_seal.go", "movesWorker.offlineArchive", "nonrecord", "sel:Put", "58b241315fc036eb41593a7685fba1dcc091960d0583bfaabd3833917d5f27ef"},

+ {"internal/host/movesoffline_seal.go", "movesWorker.offlineKeepStop", "record-writer", "key:SetRecordMove", "c6d413dda550eabb77274227613a33cdcde5923003aff77034a852e5b4175f32"},

+ {"internal/host/movesoffline_seal.go", "movesWorker.offlineTakeSeal", "nonrecord", "sel:Put", "efe8259f5e704fbc7c1aed79c8d6934ae9d74de8aae2e88dd169736e98a67dad"},

+ {"internal/moves/offline.go", "var OfflineManifest", "reference", "lit:instances", "507fd6615d9d38be634644f9313ef2195742c8696889dc8cd0ad664528b75e83"},

+// plan14MovesOfflineWriteCensusInventory is claim-step6-artifacts' inventory

+// with the moves-offline overlay: a changed site replaces its entry, a new

+// one is added.

+func plan14MovesOfflineWriteCensusInventory() []censusEntry {

+ entries := append([]censusEntry(nil), plan14ClaimStep6ArtifactsWriteCensusInventory()...)

+ for _, replacement := range plan14MovesOfflineWriteCensusOverlay {

+ found := false

+ for i, entry := range entries {

+ if entry.File == replacement.File && entry.Unit == replacement.Unit {

+ entries[i], found = replacement, true

+ break

+ }

+ if !found {

+ entries = append(entries, replacement)

+ }

+ return entries

diff --git a/internal/provision/plan14_root_reads_test.go b/internal/provision/plan14_root_reads_test.go

index 1175ecad9..aaf97112d 100644

--- a/internal/provision/plan14_root_reads_test.go

+++ b/internal/provision/plan14_root_reads_test.go

@@ -950,6 +950,21 @@ func TestPlan14RootReadCensus(t *testing.T) {

t.Fatal(err)

}

seal = "53b3cbb6f46d657ce32f49dad84dae79316c80da949ccf37273833eef5c5b2d7"

+ if errs := checkRootReadLegacy(inv, seal); len(errs) != 0 {

+ t.Fatal(errs)

+ }

+ // Census overlay moves-offline (the offline operator move), loaded last.

+ // PROPOSED-moves-offline; ruling asked of the census owner (platform-1c;

+ // docs/superpowers/notes/census-proposal-moves-offline.md). Its 39 new

+ // units run as the agent, the console or the CLI and make no root

+ // decision, so they are proposed accepted legacy at their moves

+ // siblings' dispositions; four changed legacy units are re-frozen and

+ // two authority units re-pinned at main's class. 43 frozen declarations

+ // are added, so the seal moves.

+ if err = loadRootReadInventory(filepath.Join(root, "internal/provision/testdata/plan14-root-reads-moves-offline.tsv"), &inv, true); err != nil {

+ t.Fatal(err)

+ }

+ seal = "833ae5ae924d4e26453bcf04d8b6572e1449d792fb456f5a19026bc591dff196"

errs := append(compareRootReads(got, inv), checkRootReadLegacy(inv, seal)...)

errs = append(errs, checkRootReadDeclarations(got, inv)...)

if len(errs) > 0 {

diff --git a/internal/provision/plan9_b8_census_test.go b/internal/provision/plan9_b8_census_test.go

index de6143aaf..ae43d812b 100644

--- a/internal/provision/plan9_b8_census_test.go

+++ b/internal/provision/plan9_b8_census_test.go

@@ -366,7 +366,7 @@ func TestPlan9B8RecordWriteCensus(t *testing.T) {

if len(got) < 100 {

t.Fatalf("census found only %d units under %s; the walk is broken", len(got), root)

}

- inventory := plan14ClaimStep6ArtifactsWriteCensusInventory()

+ inventory := plan14MovesOfflineWriteCensusInventory()

problems := append(censusDiff(inventory, got), censusPolicy(inventory)...)

if len(problems) > 0 {

t.Fatalf("record-write census rejected %d site(s); update the explicit inventory only after reviewing the source:\n %s", len(problems), strings.Join(problems, "\n "))

diff --git a/internal/provision/testdata/plan14-root-reads-moves-offline.tsv b/internal/provision/testdata/plan14-root-reads-moves-offline.tsv

new file mode 100644

index 000000000..f81cede1d

--- /dev/null

+++ b/internal/provision/testdata/plan14-root-reads-moves-offline.tsv

@@ -0,0 +1,101 @@

+# Census overlay moves-offline (the offline operator move: docs/superpowers/plans/2026-10-20-offline-operator-move.md), loaded LAST, after bootstrap-carlos-follows-316. PROPOSED; every row is rev3=PROPOSED-moves-offline, and the ruling is asked of the census owner (platform-1c). The proposal, with each unit's executing identity: docs/superpowers/notes/census-proposal-moves-offline.md.

+# Every new root-read unit runs as the agent (carlos-edge.service, user carlos), the console (user carlos-console) or the carlos CLI on a person's machine, and makes no root decision, so each is proposed accepted legacy on census-ruling-carlos-run's footing, at the disposition main gives its moves siblings (J1 root-route for registry and route reads, J4 root-input for file reads). In a root process the armed moves worker is nil, so reconcileSerializedWith adds no offline hook there.

+# Four changed legacy units are re-frozen at main's disposition with the change named in their basis (edgesFileLoop, NewS3Server, archive.walk, mover.roundTrip). Two authority units (fastConvergeLoop B3, armMovesPass B,C) are re-pinned at main's class and task. The accepted-legacy rows add 43 frozen declarations, so the seal moves. Ten source envelopes are re-pinned.

+@coverage . 1d5649fef5f08e01c5b974b164e2aae3c5178f281601f6ffcb2df89fb1ab5fc2

+@coverage internal/cgroup 59eaf7077de51aad79f5370fd21972e2b8782ffc76f7223f95e3efab4e47c0ed

+@coverage internal/console f500b73a74639435526caee7592de07ce79936a3b09870203c379dc70255c999

+@coverage internal/host 4cb244f10264f758b41ef0b24879b6c79892622b374e36428764742eda76420b

+@coverage internal/layout ad22438dbe7560e52e57fa201f94cebab357cfc0627965c9aae89fdfcf52043a

+@coverage internal/lease 6b6e9501d36079f0efbfc3a3739b09ff0e40837f2cb986a1ce6638dc3cd1bd87

+@coverage internal/lease/leasetest 36f174cae2871a12582d804ac8887ca43ae51ad4421bd645eaabbbac4c5387fd

+@coverage internal/moves 3c7de98d4a1783d542039d050b0ebee0c159f416b89cb3cae2461d7560b7867b

+@coverage internal/moves/archive 5ca2e60aedefb3ef43fb7a334e2e8c659e3ef504ede415a93521e32540e00014

+@coverage internal/provision 560826e175f37f4a7b96b9b6a4871360fec5063cb11a783347b721db7dd49b8a

+@legacy 6511194eb47a1852d17ac52926fb5b89e753cfe1bdaa4ad58b0c43ae0afef55a internal/host/edgesfile.go edgesFileLoop legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body (census-ruling-seeded-instances) with offline-move-1 joining the published capabilities each pass while the armed moves worker is capable (withOfflineCapability), and headroom asked of region HA's capability alone; read site unchanged, offset moved; a report, not a decision file:Read@2741 a764d80b75c3cf046ba499363f278c3411c5cb0c2b528322525e4dce292fb8b5

+internal/host/edgesfile.go edgesFileLoop legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body (census-ruling-seeded-instances) with offline-move-1 joining the published capabilities each pass while the armed moves worker is capable (withOfflineCapability), and headroom asked of region HA's capability alone; read site unchanged, offset moved; a report, not a decision file:Read@2741 a764d80b75c3cf046ba499363f278c3411c5cb0c2b528322525e4dce292fb8b5

+@legacy c4f6d4ca140434b71fdeeb11cf4f39afb74ef0de17bd6e7dc3bc62ec111f9432 internal/lease/leasetest/s3server.go NewS3Server legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=tests only (internal/lease/leasetest, imported by no production package): main's fixture (census-ruling-FS-R10) with ListObjectsV2 and If-Match on DeleteObject added, as S3 answers them; simulated ETags and conditional writes grant no production root authority file:Query@479 8a28a1d7654bd91cfa9af1396293ec4c872b0f549852240cb3f4a1a4c0a336f0

+internal/lease/leasetest/s3server.go NewS3Server legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=tests only (internal/lease/leasetest, imported by no production package): main's fixture (census-ruling-FS-R10) with ListObjectsV2 and If-Match on DeleteObject added, as S3 answers them; simulated ETags and conditional writes grant no production root authority file:Query@479 8a28a1d7654bd91cfa9af1396293ec4c872b0f549852240cb3f4a1a4c0a336f0

+@legacy 95fe2c704ec4f1aa2c9794836235c172f638f94233cee9ae0bad3f67458edcac internal/moves/archive/archive.go walk legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body (census-ruling-moves-overcap-cut-236, root-input J4) with a skip filter that only leaves paths out (nil from every caller today); reads stay on the os.Root, and its binding condition holds: no read falls back to a path-based open file:Lstat@1263,file:Lstat@842,file:WalkDir@270 0bead43f30e65920959de7ddd56f0de2a5648a8eb1d2647a264f7fd333a6d8ec

+internal/moves/archive/archive.go walk legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body (census-ruling-moves-overcap-cut-236, root-input J4) with a skip filter that only leaves paths out (nil from every caller today); reads stay on the os.Root, and its binding condition holds: no read falls back to a path-based open file:Lstat@1263,file:Lstat@842,file:WalkDir@270 0bead43f30e65920959de7ddd56f0de2a5648a8eb1d2647a264f7fd333a6d8ec

+@legacy 65b97953142a7ae639935a3423ab718bd88935920a42b4a683b31e99dfb28bbd move.go mover.roundTrip legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=the carlos CLI on a person's machine, as that person (no box unit): main's body with the offline status view's waiting sentence read from the reply (WireWaiting); read site unchanged, offset moved file:ReadAll@881 9c212d3401dd41bb1e7fa849f5f7b9a648ffc94d6e1c7cb8ea14cff1e97633e4

+move.go mover.roundTrip legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=the carlos CLI on a person's machine, as that person (no box unit): main's body with the offline status view's waiting sentence read from the reply (WireWaiting); read site unchanged, offset moved file:ReadAll@881 9c212d3401dd41bb1e7fa849f5f7b9a648ffc94d6e1c7cb8ea14cff1e97633e4

+@legacy 0bf2ad4fa784b15ec7a612ad6a987f9bed2f1a38c7c4bc1b600edbbc7e9e8cdb internal/cgroup/hostprocs_linux.go countProcs legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-input (J4, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, through moveCfg.Procs (armOffline): counts the pids in the host's exec cgroup and nested slice in cgroupfs, never following a link; the count goes in the source report (-1 when unknown) and never starts, stops or kills anything file:Lstat@194,file:ReadDir@500 2588e00f3fd1b0d29268040153dbfb62419d45fe10efd7bbe1ceed787879c0e3

+internal/cgroup/hostprocs_linux.go countProcs legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-input (J4, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, through moveCfg.Procs (armOffline): counts the pids in the host's exec cgroup and nested slice in cgroupfs, never following a link; the count goes in the source report (-1 when unknown) and never starts, stops or kills anything file:Lstat@194,file:ReadDir@500 2588e00f3fd1b0d29268040153dbfb62419d45fe10efd7bbe1ceed787879c0e3

+@legacy bc75ef1084da81e3f2a1b743518cc86991f0830361f83be02c90ff2894e7ea01 internal/cgroup/hostprocs_linux.go readProcsFile legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-input (J4, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, counts the lines of one cgroup.procs for countProcs; a file gone mid-listing lists nothing file:Open@58,file:Stat@398 3799fc0eef74c36cd1a9eb5612fc917ee9c3cb08fff90d3ccec34f415183fa5c

+internal/cgroup/hostprocs_linux.go readProcsFile legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-input (J4, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, counts the lines of one cgroup.procs for countProcs; a file gone mid-listing lists nothing file:Open@58,file:Stat@398 3799fc0eef74c36cd1a9eb5612fc917ee9c3cb08fff90d3ccec34f415183fa5c

+@legacy 5188a42e95a2172fac0c46f367af8748f9b4227825f61739fac93733f519b77c internal/console/apiinstancemove_offline.go Server.offlineClaimEvidence legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-input (J4, as main's moves units); the console (cmd/console serve under console.service, user carlos-console): new, reads the host claim, the record's acquisition, a domains claim and the app's admission only to refuse an offline start (MV-O29, MV-O20); a failed read refuses with a 502, never reads as absence; deny-only file:Read@399 9c860bffcf6550244fde8c514d903ae77f234dccb8b3799975b129aacfcacce5

+internal/console/apiinstancemove_offline.go Server.offlineClaimEvidence legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-input (J4, as main's moves units); the console (cmd/console serve under console.service, user carlos-console): new, reads the host claim, the record's acquisition, a domains claim and the app's admission only to refuse an offline start (MV-O29, MV-O20); a failed read refuses with a 502, never reads as absence; deny-only file:Read@399 9c860bffcf6550244fde8c514d903ae77f234dccb8b3799975b129aacfcacce5

+@legacy 661905dbb650e950ece18ca492d2690fe92447312213a332a6cf143d2324b201 internal/host/movesoffline.go heldBy legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-route (J1, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, reads a registry row's hold op and status to answer whether this move holds it; an absent row counts as held, since nothing can serve a host with no row registry:HoldOp@72,registry:Status@107,whole:Route@58 bc3114ddfde2ee4a2875def845c48c439eba66203973c8e3d81de56a5dc187d3

+internal/host/movesoffline.go heldBy legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-route (J1, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, reads a registry row's hold op and status to answer whether this move holds it; an absent row counts as held, since nothing can serve a host with no row registry:HoldOp@72,registry:Status@107,whole:Route@58 bc3114ddfde2ee4a2875def845c48c439eba66203973c8e3d81de56a5dc187d3

+@legacy aeafc8b210a18f3d654ed5d8cde3957cbf379c89bb6e343ad8a1b80b391a44eb internal/host/movesoffline.go isDir legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-input (J4, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, an Lstat that never follows a link, for the source's local-state report and retire file:Lstat@40 5291be5379e83303efde4927bbff8520eeb56e062f138861992b92ddfa69140e

+internal/host/movesoffline.go isDir legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-input (J4, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, an Lstat that never follows a link, for the source's local-state report and retire file:Lstat@40 5291be5379e83303efde4927bbff8520eeb56e062f138861992b92ddfa69140e

+@legacy 4676cd85a596c1b295a3f4a4ba407a9fbf62237f4f34a038fbd98f32e64eb307 internal/host/movesoffline.go lexists legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-input (J4, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, an Lstat that never follows a link, for the source's local-state report and retire file:Lstat@41 ea07329ff26308b5957066177d25a36a3db3d7ea2c236268d76e2fc26e4cef9f

+internal/host/movesoffline.go lexists legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-input (J4, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, an Lstat that never follows a link, for the source's local-state report and retire file:Lstat@41 ea07329ff26308b5957066177d25a36a3db3d7ea2c236268d76e2fc26e4cef9f

+@legacy 28e1684b453ba37765749967603a11ecc7835c1a12fa333d39415849aabf8868 internal/host/movesoffline.go moveCfg.flatDBPath legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-route (J1, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, a flat row's database path from its registry row, else the default registry:DBPath@156,registry:DBPath@87,whole:Route@141,whole:Route@74 46ac1df2068f8793e86c76df552699b7bd27a661b155ebee13e07fc92e9bef46

+internal/host/movesoffline.go moveCfg.flatDBPath legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-route (J1, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, a flat row's database path from its registry row, else the default registry:DBPath@156,registry:DBPath@87,whole:Route@141,whole:Route@74 46ac1df2068f8793e86c76df552699b7bd27a661b155ebee13e07fc92e9bef46

+@legacy 5f48f51bf75a6569e0f26d899e6c4ce83bdc16dea5ac556150443b75a963a70a internal/host/movesoffline.go movesWorker.localState legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=route-and-input (J1,J4, as main's sourceFinal.run); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, reads what this box keeps for the host (database, litestream meta, files directory, env files) under both layouts, for the source report; reads only file:ReadDir@1126,registry:DBPath@1363,registry:DBPath@1393,whole:Route@140,whole:Route@189,whole:Route@293 21ee0b7667faa1c3adda2a9271118916d12002b6aebf60dc2402cb49bc079049

+internal/host/movesoffline.go movesWorker.localState legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=route-and-input (J1,J4, as main's sourceFinal.run); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, reads what this box keeps for the host (database, litestream meta, files directory, env files) under both layouts, for the source report; reads only file:ReadDir@1126,registry:DBPath@1363,registry:DBPath@1393,whole:Route@140,whole:Route@189,whole:Route@293 21ee0b7667faa1c3adda2a9271118916d12002b6aebf60dc2402cb49bc079049

+@legacy d8612e85b568e309a58be4f3e109e48e7b6416c6c56b7ca9ed24804fdde76400 internal/host/movesoffline.go movesWorker.offlineSourceGone legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-route (J1, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, reads the row at offline-finishing and reports gone once reconcile has removed it; lifts this move's own fence whole:Route@236 9a21409d0df7f38c59fc2fbe8b963b020f52fc7ecf66761f1479daec143f3b7a

+internal/host/movesoffline.go movesWorker.offlineSourceGone legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-route (J1, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, reads the row at offline-finishing and reports gone once reconcile has removed it; lifts this move's own fence whole:Route@236 9a21409d0df7f38c59fc2fbe8b963b020f52fc7ecf66761f1479daec143f3b7a

+@legacy 00604cdf3ba154ecb8b5b5b99766a3e52e57b2abf48d8e6c3704114470dc1081 internal/host/movesoffline.go movesWorker.offlineSourcePark legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-route (J1, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, reads the row, then renames the host's local paths into the move's park directory under the fence; deletes nothing whole:Route@1150,whole:Route@1700,whole:Route@466,whole:Route@943 45684e221106d3f30425a466892e58c0206a1dbcc508d5d6ae2ed1b54cb3d478

+internal/host/movesoffline.go movesWorker.offlineSourcePark legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-route (J1, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, reads the row, then renames the host's local paths into the move's park directory under the fence; deletes nothing whole:Route@1150,whole:Route@1700,whole:Route@466,whole:Route@943 45684e221106d3f30425a466892e58c0206a1dbcc508d5d6ae2ed1b54cb3d478

+@legacy 6434c4050fc214c574fbb6dd4004dc14d9450e259ee2103dcd26e29797e28244 internal/host/movesoffline.go movesWorker.offlineSourceRevert legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-route (J1, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, reads the row's hold and releases only this move's hold, under reconcileMu, on abort registry:HoldOp@562,whole:Route@549,whole:Route@701 102e6dab35e4c35c76ef0fa327166e6563f3128b9f504612831fc287bd5a5997

+internal/host/movesoffline.go movesWorker.offlineSourceRevert legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-route (J1, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, reads the row's hold and releases only this move's hold, under reconcileMu, on abort registry:HoldOp@562,whole:Route@549,whole:Route@701 102e6dab35e4c35c76ef0fa327166e6563f3128b9f504612831fc287bd5a5997

+@legacy 01dd7bc81f598934761a27a8490a6e174e62749b34c7dd43badab55cbfdf15d5 internal/host/movesoffline.go movesWorker.offlineSourceStop legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-route (J1, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, installs this move's fence, reads the row and rewrites the source report every pass whole:Route@274 750f72b0466febf4861d4dc74133b7d5d16d5f140d17518ed3ce90e197a72de3

+internal/host/movesoffline.go movesWorker.offlineSourceStop legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-route (J1, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, installs this move's fence, reads the row and rewrites the source report every pass whole:Route@274 750f72b0466febf4861d4dc74133b7d5d16d5f140d17518ed3ce90e197a72de3

+@legacy b1d8da0a156ea7be80912361853718cd14986d6d9b2d9846eaaf564ae0f21e12 internal/host/movesoffline.go movesWorker.retirePaths legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=route-and-input (J1,J4, as main's sourceFinal.run); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, lists the paths the source retire parks, from the row's layout and the nested instance directory's entries file:ReadDir@1688,whole:Route@128,whole:Route@177,whole:Route@417 a1531c5c3ee2d451010f3bdde1161aa90f918d6ca538c7cfac7c7fa9c32f7702

+internal/host/movesoffline.go movesWorker.retirePaths legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=route-and-input (J1,J4, as main's sourceFinal.run); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, lists the paths the source retire parks, from the row's layout and the nested instance directory's entries file:ReadDir@1688,whole:Route@128,whole:Route@177,whole:Route@417 a1531c5c3ee2d451010f3bdde1161aa90f918d6ca538c7cfac7c7fa9c32f7702

+@legacy f4722fb5ffe4fa2ee37eb5916e1a53c83e7d88556679fb0c1c12e4a451af13f8 internal/host/movesoffline.go movesWorker.sourceReport legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-route (J1, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, reads the row for the source report's evidence whole:Route@198,whole:Route@461,whole:Route@520 13bdb087ef507d0e7fdb9df9741702eea6ed71be7b92cee42ee97a709a590f10

+internal/host/movesoffline.go movesWorker.sourceReport legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-route (J1, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, reads the row for the source report's evidence whole:Route@198,whole:Route@461,whole:Route@520 13bdb087ef507d0e7fdb9df9741702eea6ed71be7b92cee42ee97a709a590f10

+@legacy 0f33699ebb34c6043ede1ac8d453c41f7cd3d976aaab3a1cff609187a878ac08 internal/host/movesoffline_land.go extractSealed legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-input (J4, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, opens the sealed archive the landing staged and extracts it as Phase 1's openAndExtract does file:Open@181 76b3a5287b4407112f3512c02bbdbad84fc6fba9cf3fb570936ddbec9aa10837

+internal/host/movesoffline_land.go extractSealed legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-input (J4, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, opens the sealed archive the landing staged and extracts it as Phase 1's openAndExtract does file:Open@181 76b3a5287b4407112f3512c02bbdbad84fc6fba9cf3fb570936ddbec9aa10837

+@legacy a9ef763a1367d1c89e61a7b5090175bfb9db166704bf23308fb009347b3063ba internal/host/movesoffline_land.go hexFileSHA256 legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-input (J4, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, the sha256 of a landed file for a seal check; empty when unreadable, which fails the check file:ReadFile@49 2a077cd00e7df24679ce320dc7a73b80a35e261698834e9414cbc3d9ba3ad3b3

+internal/host/movesoffline_land.go hexFileSHA256 legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-input (J4, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, the sha256 of a landed file for a seal check; empty when unreadable, which fails the check file:ReadFile@49 2a077cd00e7df24679ce320dc7a73b80a35e261698834e9414cbc3d9ba3ad3b3

+@legacy 6257b466c07eb5d2456de8fd2f7e8ba5cba2a594879eaa998391d00a96508bb2 internal/host/movesoffline_land.go landRun.config legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-route (J1, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, reads the held row to render its configuration through RenderHeld, which admits only a row held by this move whole:Route@198 68b981f301c53a6eaaa8bdabb62a3cc4a2f432af6a3e5613ffab08f8f5fef687

+internal/host/movesoffline_land.go landRun.config legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-route (J1, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, reads the held row to render its configuration through RenderHeld, which admits only a row held by this move whole:Route@198 68b981f301c53a6eaaa8bdabb62a3cc4a2f432af6a3e5613ffab08f8f5fef687

+@legacy 4b0e1749670b082b02a16a69da6c5aff72da31788576557f08c3a77a2baee669 internal/host/movesoffline_land.go landRun.env legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-input (J4, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, reads the landed env file and rendered configuration to compare with the seal's sha256s file:ReadFile@122,file:ReadFile@720 8c26fe55bec8d23180f0819b77d49b1a73f0ab0156f238f230d770cecc1e4da4

+internal/host/movesoffline_land.go landRun.env legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-input (J4, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, reads the landed env file and rendered configuration to compare with the seal's sha256s file:ReadFile@122,file:ReadFile@720 8c26fe55bec8d23180f0819b77d49b1a73f0ab0156f238f230d770cecc1e4da4

+@legacy 9550f6414ac5f746d8e44f60b85759f50cebd544dc637b384a87516c87ca9a37 internal/host/movesoffline_land.go landRun.envPin legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-route (J1, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, reads the held row for LaunchLayers' composed environment, compared with the seal's portable digest whole:Route@699 1033516d233bafb55febb2c02331e3afe5a9fd63a3bad540cc6ae712c56ac3d3

+internal/host/movesoffline_land.go landRun.envPin legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-route (J1, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, reads the held row for LaunchLayers' composed environment, compared with the seal's portable digest whole:Route@699 1033516d233bafb55febb2c02331e3afe5a9fd63a3bad540cc6ae712c56ac3d3

+@legacy 82c1ec491e63a27d7221f2e5166fb41d5a90a5d28c581bc2174cc42bf62d31a0 internal/host/movesoffline_land.go landRun.nextDue legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-route (J1, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, sets the held row's NextDue to the seal's and reads it back registry:NextDue@34,registry:NextDue@386,whole:Route@36,whole:Route@388 169ab1633a7a87651c56a87c7e419d263038fbb35185beb478c330824b0c7115

+internal/host/movesoffline_land.go landRun.nextDue legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-route (J1, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, sets the held row's NextDue to the seal's and reads it back registry:NextDue@34,registry:NextDue@386,whole:Route@36,whole:Route@388 169ab1633a7a87651c56a87c7e419d263038fbb35185beb478c330824b0c7115

+@legacy 335fbec67ca0b4affe901896c024e7858f70fe7c3e1b192933eafeb35f8ab98c internal/host/movesoffline_land.go landRun.release legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-route (J1, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, reads the held row's channel to compare its build with the seal's whole:Route@368 492cffa9ec2601d9dd15014bc493b4c7f3772237df269a245367e325455fae6d

+internal/host/movesoffline_land.go landRun.release legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-route (J1, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, reads the held row's channel to compare its build with the seal's whole:Route@368 492cffa9ec2601d9dd15014bc493b4c7f3772237df269a245367e325455fae6d

+@legacy 5d46fc2a166b3bd7d5dea43baf8bc71b59488f37fbe4421b4de2e308015e9aea internal/host/movesoffline_land.go landRun.replication legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-route (J1, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, sets the held row's replication rung to the seal's and reads it back registry:Replication@38,registry:Replication@430,whole:Route@40,whole:Route@432 0a01d500ad7df33b758fa029db808e15083e8fc0de6533f56ecdecddc2cddb6a

+internal/host/movesoffline_land.go landRun.replication legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-route (J1, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, sets the held row's replication rung to the seal's and reads it back registry:Replication@38,registry:Replication@430,whole:Route@40,whole:Route@432 0a01d500ad7df33b758fa029db808e15083e8fc0de6533f56ecdecddc2cddb6a

+@legacy c4acd194b6c3403f4130e5dbf967231636574e354e4555fab014c6a2f2dc2744 internal/host/movesoffline_land.go landRun.reread legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-route (J1, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, re-reads the row after a column write whole:Route@246,whole:Route@251,whole:Route@96 ebb86b70b728cfefc2c6962c1ed6d582e8259a6527e40e580196fd3cae807c57

+internal/host/movesoffline_land.go landRun.reread legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-route (J1, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, re-reads the row after a column write whole:Route@246,whole:Route@251,whole:Route@96 ebb86b70b728cfefc2c6962c1ed6d582e8259a6527e40e580196fd3cae807c57

+@legacy 8df5e44bfce28f333564cfb0785bc15c36e7aa79bef5a787d1e3d391b3238a3b internal/host/movesoffline_land.go landRun.row legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-route (J1, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, reads the reconciled row, its hold and status, and requires it held landing by this move at flat paths registry:HoldOp@130,registry:HoldOp@149,registry:HoldOp@236,registry:Status@259,whole:Route@35,whole:Route@397,whole:Route@54 08d3b3951fedf3765fb39cae164185021352e87f4226b640f6582f66f70f114c

+internal/host/movesoffline_land.go landRun.row legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-route (J1, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, reads the reconciled row, its hold and status, and requires it held landing by this move at flat paths registry:HoldOp@130,registry:HoldOp@149,registry:HoldOp@236,registry:Status@259,whole:Route@35,whole:Route@397,whole:Route@54 08d3b3951fedf3765fb39cae164185021352e87f4226b640f6582f66f70f114c

+@legacy d823c4db54bee7e31b77fdf64e879c0a968bd730c3744c280371e02955f44733 internal/host/movesoffline_land.go landRun.timers legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-route (J1, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, reads the held row's timer rows and replaces them from the digest-checked snapshot whole:Timer@1051,whole:Timer@1197,whole:Timer@473,whole:Timer@787,whole:Timer@948 c9e1defc12ad0e51868c0944a84b370c786a0d06f0094bba7bca3d4aac83e5ca

+internal/host/movesoffline_land.go landRun.timers legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-route (J1, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, reads the held row's timer rows and replaces them from the digest-checked snapshot whole:Timer@1051,whole:Timer@1197,whole:Timer@473,whole:Timer@787,whole:Timer@948 c9e1defc12ad0e51868c0944a84b370c786a0d06f0094bba7bca3d4aac83e5ca

+@legacy 10ba19c4a391fb9f8ce31bc6901ca70e5050ca89e13ffc7803116db0bba75356 internal/host/movesoffline_land.go landRun.warmPaths legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-route (J1, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, the row's database artifact paths, checked as a possible warm cache before extract registry:DBPath@127,registry:DBPath@148,registry:DBPath@192,whole:Route@114,whole:Route@129,whole:Route@150,whole:Route@194 482a8c60b9c7f357e972bef1fa4eaa3a5ab5f03aa1d96e56fa331652ddc52337

+internal/host/movesoffline_land.go landRun.warmPaths legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-route (J1, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, the row's database artifact paths, checked as a possible warm cache before extract registry:DBPath@127,registry:DBPath@148,registry:DBPath@192,whole:Route@114,whole:Route@129,whole:Route@150,whole:Route@194 482a8c60b9c7f357e972bef1fa4eaa3a5ab5f03aa1d96e56fa331652ddc52337

+@legacy f78c31ce76b18c283a562ef1854c943652560e98df58881fb2595e4e0e391d81 internal/host/movesoffline_land.go movesWorker.landReport legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-route (J1, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, ensures each landing item against the held row and returns the target report registry:HoldOp@1755,registry:NextDue@1986,registry:Replication@2000,registry:Status@1796,whole:Route@1742,whole:Route@1757,whole:Route@1798,whole:Route@1824,whole:Route@1941,whole:Route@1988,whole:Route@2002,whole:Route@395,whole:Route@400 cb7d8cd3372bd844e26e32dae853edf60332a5d9abf2822185a3cf43aa9b917a

+internal/host/movesoffline_land.go movesWorker.landReport legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-route (J1, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, ensures each landing item against the held row and returns the target report registry:HoldOp@1755,registry:NextDue@1986,registry:Replication@2000,registry:Status@1796,whole:Route@1742,whole:Route@1757,whole:Route@1798,whole:Route@1824,whole:Route@1941,whole:Route@1988,whole:Route@2002,whole:Route@395,whole:Route@400 cb7d8cd3372bd844e26e32dae853edf60332a5d9abf2822185a3cf43aa9b917a

+@legacy afb7f0631e9bc7157c798ca99ef436c917c989a2e67be54cd056d2f7e03d1da8 internal/host/movesoffline_land.go movesWorker.offlineTargetOpen legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-route (J1, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, releases this move's hold on the landed row only from this box's own all-OK report registry:HoldOp@1641,registry:HoldOp@1789,registry:HoldOp@417,registry:Status@1356,registry:Status@1676,registry:Status@1778,registry:Status@454,whole:Route@1261,whole:Route@1327,whole:Route@2958,whole:Route@315 9220f09e0f06db3712ce05ae14f1f8dcd71ee4323ef0f43e105174d8f108bf1c

+internal/host/movesoffline_land.go movesWorker.offlineTargetOpen legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-route (J1, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, releases this move's hold on the landed row only from this box's own all-OK report registry:HoldOp@1641,registry:HoldOp@1789,registry:HoldOp@417,registry:Status@1356,registry:Status@1676,registry:Status@1778,registry:Status@454,whole:Route@1261,whole:Route@1327,whole:Route@2958,whole:Route@315 9220f09e0f06db3712ce05ae14f1f8dcd71ee4323ef0f43e105174d8f108bf1c

+@legacy 862d465f3ab500420af72b4b1d85fd7e07b9c33039a01a097919ec3ff13643d1 internal/host/movesoffline_land.go movesWorker.offlineTargetRevert legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-route (J1, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, parks what the move extracted and deletes only a row this move holds registry:HoldOp@1572,registry:HoldOp@289,registry:HoldOp@627,registry:Status@326,registry:Status@616,whole:Route@1493,whole:Route@1559,whole:Route@1965,whole:Route@276,whole:Route@341 dd5f2df83b48c782ee4d369b5b84e3eb42ed3b1504be7f74f7182fac3ed158a2

+internal/host/movesoffline_land.go movesWorker.offlineTargetRevert legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-route (J1, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, parks what the move extracted and deletes only a row this move holds registry:HoldOp@1572,registry:HoldOp@289,registry:HoldOp@627,registry:Status@326,registry:Status@616,whole:Route@1493,whole:Route@1559,whole:Route@1965,whole:Route@276,whole:Route@341 dd5f2df83b48c782ee4d369b5b84e3eb42ed3b1504be7f74f7182fac3ed158a2

+@legacy 36ba2807bed3973c41fbd48edecf785d6a5a434cf59bec98a6dba26e5149df72 internal/host/movesoffline_land.go nonEmptyOrNotDir legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-input (J4, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, an Lstat and ReadDir of the files directory, refusing a non-empty one before extract file:Lstat@51,file:ReadDir@147 f81a1542575058327d8e7304d7d48eed4f73218c5ae017ae4e4c0a310e25d676

+internal/host/movesoffline_land.go nonEmptyOrNotDir legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-input (J4, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, an Lstat and ReadDir of the files directory, refusing a non-empty one before extract file:Lstat@51,file:ReadDir@147 f81a1542575058327d8e7304d7d48eed4f73218c5ae017ae4e4c0a310e25d676

+@legacy 374954849674241e9bb6e7c0366813f365cf640c9a299143f4d4853dbf7777d1 internal/host/movesoffline_seal.go movesWorker.offlineArchive legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-input (J4, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, builds the sealed archive of the files directory and env file in temporary files and puts it in the target bucket file:Create@1227,file:Create@741,file:ReadFile@1805 58b241315fc036eb41593a7685fba1dcc091960d0583bfaabd3833917d5f27ef

+internal/host/movesoffline_seal.go movesWorker.offlineArchive legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-input (J4, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, builds the sealed archive of the files directory and env file in temporary files and puts it in the target bucket file:Create@1227,file:Create@741,file:ReadFile@1805 58b241315fc036eb41593a7685fba1dcc091960d0583bfaabd3833917d5f27ef

+@legacy e06240d2165821d75ff7339dbb84b9bb19451749f9e64a911598dfe84495acaa internal/host/movesoffline_seal.go movesWorker.offlineFilesOf legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=route-and-input (J1,J4, as main's sourceFinal.run); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, reads the row and lists the nested instance directory for the files, env and config paths; an app entry beside the files directory refuses the seal file:ReadDir@349,registry:Host@905,whole:Route@247,whole:Route@287,whole:Route@873 7a235dfad329b1c541032ce1c8e90d3687b6d00e6b6b45ef6695bfbd943bf6e7

+internal/host/movesoffline_seal.go movesWorker.offlineFilesOf legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=route-and-input (J1,J4, as main's sourceFinal.run); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, reads the row and lists the nested instance directory for the files, env and config paths; an app entry beside the files directory refuses the seal file:ReadDir@349,registry:Host@905,whole:Route@247,whole:Route@287,whole:Route@873 7a235dfad329b1c541032ce1c8e90d3687b6d00e6b6b45ef6695bfbd943bf6e7

+@legacy 4aecd85b9097ccbfa2216858cff075186c3e21e3684f5d8f159dec662081af03 internal/host/movesoffline_seal.go movesWorker.offlineTakeSeal legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-route (J1, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, seal steps 1 to 9 from the row: database path, next due, replication rung and timer rows, read for the seal registry:DBPath@2134,registry:NextDue@11563,registry:NextDue@12475,registry:Replication@11468,registry:Replication@12450,whole:Route@10203,whole:Route@1713,whole:Route@2195,whole:Route@2976,whole:Route@4965,whole:Route@7739,whole:Timer@8890,whole:Timer@8955,whole:Timer@8961,whole:Timer@9220,whole:Timer@9319 efe8259f5e704fbc7c1aed79c8d6934ae9d74de8aae2e88dd169736e98a67dad

+internal/host/movesoffline_seal.go movesWorker.offlineTakeSeal legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-route (J1, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, seal steps 1 to 9 from the row: database path, next due, replication rung and timer rows, read for the seal registry:DBPath@2134,registry:NextDue@11563,registry:NextDue@12475,registry:Replication@11468,registry:Replication@12450,whole:Route@10203,whole:Route@1713,whole:Route@2195,whole:Route@2976,whole:Route@4965,whole:Route@7739,whole:Timer@8890,whole:Timer@8955,whole:Timer@8961,whole:Timer@9220,whole:Timer@9319 efe8259f5e704fbc7c1aed79c8d6934ae9d74de8aae2e88dd169736e98a67dad

+@legacy 31cea037c20cef483ef95439b05c36f997f0f3f306a08d2c505bb86e8078f66f internal/host/movesoffline_seal.go readOwnFile legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-input (J4, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, reads a regular file without following a link, as the agent reads every file a nested tenant can write file:Lstat@84,file:Open@319,file:ReadAll@575,file:Stat@407 9346c8327195aebd2b8c5bf810eaeeba53a255963aed42a2b313f5b0637eeedd

+internal/host/movesoffline_seal.go readOwnFile legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-input (J4, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, reads a regular file without following a link, as the agent reads every file a nested tenant can write file:Lstat@84,file:Open@319,file:ReadAll@575,file:Stat@407 9346c8327195aebd2b8c5bf810eaeeba53a255963aed42a2b313f5b0637eeedd

+@legacy 59c9a60ecc32fd9ec38470060467b2e694f4a80dbbcf4a16ee79dead0eb73649 internal/host/movespass.go armOffline legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-route (J1, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, arms the offline fields of the moves worker's config at agent start; closes over the registry and reads nothing itself whole:Route@1930 4129af3990fe73d3496e31a4e54f1af56eb2964011faa1929d7dadef755e5d6f

+internal/host/movespass.go armOffline legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-route (J1, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, arms the offline fields of the moves worker's config at agent start; closes over the registry and reads nothing itself whole:Route@1930 4129af3990fe73d3496e31a4e54f1af56eb2964011faa1929d7dadef755e5d6f

+@legacy cbdc8317ddccc99408ca9a83e93a7431cd425586c3e9ec2f10f0a274196d1c54 internal/host/movespass.go channelVersion legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-route (J1, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, resolves the row's channel pointer under the release key for the landing's release check; reads only registry:App@253,registry:Channel@130,whole:Route@248 072eaf78814ed5e9c1dacb58a41479c694dacd08d6e90193fecee55ee1927b92

+internal/host/movespass.go channelVersion legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-route (J1, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, resolves the row's channel pointer under the release key for the landing's release check; reads only registry:App@253,registry:Channel@130,whole:Route@248 072eaf78814ed5e9c1dacb58a41479c694dacd08d6e90193fecee55ee1927b92

+@legacy b1ddd7560f58db41d8f3368e76ea73c126bdd7b9ad0c99d8f6a8a8e9984601ec internal/layout/plan.go NestedPlatformNames legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-input (J4, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, called only from the agent's offline sealer and source retire (IsNestedPlatformName): a fixed list of names, reads nothing data-literal@84 79a4b08c26c1fa95f6bb6b5a177a9ff50059eb0e68fbe605c0a663047b0557af

+internal/layout/plan.go NestedPlatformNames legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-input (J4, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, called only from the agent's offline sealer and source retire (IsNestedPlatformName): a fixed list of names, reads nothing data-literal@84 79a4b08c26c1fa95f6bb6b5a177a9ff50059eb0e68fbe605c0a663047b0557af

+@legacy 938a26990f189d870e5b0d502c7597fff91aee2d943d17bf9f62690fec19e9ea internal/lease/tombstone.go readLock legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-input (J4, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, through lease.Tombstone, Reassert and LiftTombstone (the offline sealer and landing): reads the litestream lock object with its ETag; a garbled or expiry-less lock is an error, never free file:ReadAll@417 19def7e4df0da9f3a14f687447397e4c211e1182a0a76995fef5439181f82a35

+internal/lease/tombstone.go readLock legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-input (J4, as main's moves units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, through lease.Tombstone, Reassert and LiftTombstone (the offline sealer and landing): reads the litestream lock object with its ETag; a garbled or expiry-less lock is an error, never free file:ReadAll@417 19def7e4df0da9f3a14f687447397e4c211e1182a0a76995fef5439181f82a35

+@legacy a1036fd5ea9db3dba76eaad9c436216bc19a53457b446cda0de3b25265f00eb9 internal/provision/offline_move.go OfflineStart legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-input (J4, as main's moves units); the console (cmd/console serve under console.service, user carlos-console): new, the record transition the start door applies through SetRecordMove; its one site is rec.ActiveRun.Open(), a method, not a file read file:Open@184 2d3cd134dab7d467aad300e58a2b8c5f95fe7c706f3c31d4b55ad2b271a5f0fd

+internal/provision/offline_move.go OfflineStart legacy accepted-legacy accepted-legacy;rev3=PROPOSED-moves-offline;basis=root-input (J4, as main's moves units); the console (cmd/console serve under console.service, user carlos-console): new, the record transition the start door applies through SetRecordMove; its one site is rec.ActiveRun.Open(), a method, not a file read file:Open@184 2d3cd134dab7d467aad300e58a2b8c5f95fe7c706f3c31d4b55ad2b271a5f0fd

+internal/host/agent.go fastConvergeLoop authority B3 rev3=PROPOSED-moves-offline;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body (census-ruling-carlos-run) with the offline keep view read before the first reconcile pass (refreshOfflineView); read sites unchanged, offsets moved; main's B3 authority retained whole:Route@8896,whole:Route@9459 dac141dfbb9e82bf99cb8e9334418db792af872d72e954e4e43c2dbc7958bbb7

+internal/host/movespass.go armMovesPass authority B,C rev3=PROPOSED-moves-offline;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's construction with newMovesWorker, the box label and version store set whatever the switch says, and armOffline called after armPhase1; read sites unchanged, offsets moved; main's B,C authority retained file:Read@2973,registry:Provisioned@1749,whole:Route@1736 40c56169ae583a8bb24ffff424090cab82a214c2fbb34520a45284267fc19523