carlos / platform Public

Merge remote-tracking branch 'origin/main' into feat/hostclaim-activation

Paul Campbell pushed by claude 2 weeks ago c48c7b9042ca39dbbcb51f765b285e91cf10c0b7 parent ef3c4bfparent 17d5960

8 files changed, +324 −235

docs/superpowers/plans/2026-10-06-moves-phase1-copy.md +223 −200
internal/console/apiinstancemove.go +3 −1
internal/host/movesfloor.go +10 −2
internal/host/systemapply.go +7 −5
internal/moves/archive/archive.go +33 −10
internal/moves/readiness.go +3 −4
internal/provision/provision.go +31 −10
internal/stopevidence/fdholders_alias_linux_test.go +14 −3

diff --git a/docs/superpowers/plans/2026-10-06-moves-phase1-copy.md b/docs/superpowers/plans/2026-10-06-moves-phase1-copy.md

index 75f1ada2f..b56d80ec7 100644

--- a/docs/superpowers/plans/2026-10-06-moves-phase1-copy.md

+++ b/docs/superpowers/plans/2026-10-06-moves-phase1-copy.md

@@ -26,187 +26,187 @@ Columns: id, file, text, status.

| M-C22 | move.go | <host> is waiting for a box in <region>. Its last box was terminated before the move finished. Its data up to the last completed upload is kept in <region>. It will start when a box joins the region, and any writes after that upload will be reported then. | pending |

## Plan 1

|---|---|---|---|

-| MV-N94 | internal/host/systemapply.go | <refusal>; the root passes paused for the install could not be started again: <error>, and the retry could not be recorded: <error>. the journal stays for the next recovery | pending |

+| MV-N94 | internal/host/systemapply.go | <refusal>; the root passes paused for the install could not be started again: <error>, and the retry could not be recorded: <error>. the journal stays for the next recovery | approved |

## Plan 2

@@ -214,20 +214,20 @@ Columns: id, file, text, status.

|---|---|---|---|

## Plan 3

@@ -235,11 +235,11 @@ Columns: id, file, text, status.

|---|---|---|---|

## Plan 4

@@ -247,19 +247,19 @@ Columns: id, file, text, status.

|---|---|---|---|

## Plan 5

@@ -268,3 +268,26 @@ Columns: id, file, text, status.

## Plan 6

(completed by Plan 6 Task 7)

+## Review of 2026-10-09

+Paul approved the wording of all 205 rows then pending (M-C1 to M-C22 and MV-N1 to MV-N183), with no edits. 160 are marked approved above: their code already speaks the approved text.

+The other 45 were `pending` only because the copy gate requires an approved row's text to appear in its file. Their wording is approved and final. 24 are now `approved`: their code was brought back to the approved text (18 rows: MV-N12, MV-N13, MV-N14, MV-N15, MV-N40 to MV-N45, MV-N52, MV-N59, MV-N77, MV-N80, MV-N86, MV-N92, MV-N105, MV-N106), or the row's File cell was corrected to the file that says it (6 rows, now `internal/host/movesphase1.go`: M-C14, M-C15, M-C16, MV-N72, MV-N79, MV-N81).

+21 stay `pending`. Each flips to approved, verbatim, in the commit that makes its file speak it.

+Not built yet (18):

+- M-C1 to M-C12, M-C18 and M-C22 (14 rows, `move.go`): the `carlos move` CLI is Plan 6, and no `move.go` exists.

+- M-C13 and M-C19 (`internal/console/apiinstancemove.go`, `internal/console/apiinstances.go`): the abort refusal after the cut started and the delete door's refusal during a move. Plan 5 Task 8 lists both as Plan 6 copy; no code says either.

+- M-C20 (`internal/host/movespaging.go`): the paging sentence is Plan 5, and no `movespaging.go` exists.

+- MV-N11 (`internal/console/apiinstancemove.go`): the declare-lost door is Plan 4 Task 10. `resolve` answers "nothing to resolve yet" to anything but a retry.

+Built, but the gate cannot read the row (3), so the row stays pending until Paul rules on how it is gated:

+- MV-N54: the row ends in a list template, `<sqid> ("<name>"), ...`. The code builds that list at run time (`apicli.go`) and joins it into the sentence, so the sentence is never one literal ending in `, ...`. Making it so would print a literal `...`.

+- MV-N129: the same, `<NAME (kind)>, ...`; `t3Differs` in `internal/host/movesreport.go` joins the names it found.

+- MV-N146: the row's text carries a note, `(MV-N68 with a new <which>)`. The code says `no fresh rate measurement for the disk's per-file sync` through MV-N68's `NoFreshRate`, which is correct; the note is not a part of any sentence the code could say.

+The 16 rows added after that review (MV-N184 to MV-N186, MV-N300 to MV-N312) were approved by Paul on 2026-10-09 with no edits.

diff --git a/internal/console/apiinstancemove.go b/internal/console/apiinstancemove.go

index ac38b9e06..6ff8122ee 100644

--- a/internal/console/apiinstancemove.go

+++ b/internal/console/apiinstancemove.go

@@ -118,7 +118,9 @@ func phase1MoveCopy() moveCopy {

ambiguous: func(seg, alts string) string {

return fmt.Sprintf("account %q is ambiguous. pass --account-id with one of: %s", seg, alts)

- tooMany: func(noun string) string { return "too many " + noun + " requests. wait a minute and try again" },

+ // moveGate asks the family's gate for the noun "instance" and no

+ // other, so the recorded sentence (MV-N52) is written whole.

+ tooMany: func(string) string { return "too many instance requests. wait a minute and try again" },

noBucket: "this console has no deployment bucket, so it cannot answer this",

kind: func(k string) string { return "only exec-backed instances move. this route is kind " + k },

diff --git a/internal/host/movesfloor.go b/internal/host/movesfloor.go

index 8203cabbe..11b378d61 100644

--- a/internal/host/movesfloor.go

+++ b/internal/host/movesfloor.go

@@ -200,6 +200,14 @@ func floorRegression(local, remote *moves.Floor) error {

// less than what is published.

var errFloorWrite = errors.New("could not write it on this box")

+// floorWriteError is errFloorWrite with what the write said. Its text is

+// what it always was ("could not write it on this box: <cause>"); armFloor

+// reads cause to say the recorded sentence whole (copy record MV-N92).

+type floorWriteError struct{ cause error }

+func (e *floorWriteError) Error() string { return fmt.Sprintf("%v: %v", errFloorWrite, e.cause) }

+func (e *floorWriteError) Is(target error) bool { return target == errFloorWrite }

// syncLocalFloor is the rule root's apply and the agent's refresh share:

// read the published floor and make the local files say the same. It

// returns the floor on disk afterwards, nil when none is armed.

@@ -250,14 +258,14 @@ func syncLocalFloor(ctx context.Context, s release.Store, dataDir string) (*move

}

if err := writeFloorFiles(d, *remote); err != nil {

out, _ = readLocalFloor(dataDir)

- return fmt.Errorf("%w: %v", errFloorWrite, err)

+ return &floorWriteError{cause: err}

}

out = remote

return nil

})

if !ran {

out, _ = readLocalFloor(dataDir)

- return out, fmt.Errorf("%w: %v", errFloorWrite, err)

+ return out, &floorWriteError{cause: err}

}

return out, err

}

diff --git a/internal/host/systemapply.go b/internal/host/systemapply.go

index 1a60fdb7b..0ca5d6bc5 100644

--- a/internal/host/systemapply.go

+++ b/internal/host/systemapply.go

@@ -836,8 +836,9 @@ func (a *systemApplier) armFloor(ctx context.Context) error {

if err == nil {

return nil

}

- if errors.Is(err, errFloorWrite) {

- return fmt.Errorf("%w: moves protocol floor: %v", errSystemDeferred, err)

+ var fw *floorWriteError

+ if errors.As(err, &fw) {

+ return fmt.Errorf("%w: %s", errSystemDeferred, fmt.Sprintf("moves protocol floor: could not write it on this box: %v", fw.cause))

}

onDisk := "none"

if f != nil {

@@ -968,7 +969,7 @@ func (a *systemApplier) activationGuard(target, running string, fn func() error)

return err

}

if errors.Is(err, errFloorLockBusy) {

- return activationDeferred{fmt.Errorf("moves protocol floor: %v; this waits for the next run", errFloorLockBusy)}

+ return activationDeferred{errors.New("moves protocol floor: another writer holds the floor lock on this box; this waits for the next run")}

}

if floorLockCannotExist(err) && !a.floorArmed() {

a.ops.logf("system apply: moves protocol floor lock: %v (no floor is armed, and none can be on this box; continuing)", err)

@@ -1627,9 +1628,10 @@ func (a *systemApplier) restoreFiles(ctx context.Context, j *systemJournal) (boo

// before any early refusal. The caller keeps the journal.

if !renamed {

if rerr := a.rearm(prior); rerr != nil {

- err = fmt.Errorf("%w; the root passes paused for the restore could not be started again: %v", err, rerr)

if nerr := a.notePendingRearm(prior); nerr != nil {

- err = fmt.Errorf("%w, and the retry could not be recorded: %v", err, nerr)

+ err = fmt.Errorf("%w; the root passes paused for the restore could not be started again: %v, and the retry could not be recorded: %v", err, rerr, nerr)

+ } else {

+ err = fmt.Errorf("%w; the root passes paused for the restore could not be started again: %v", err, rerr)

}

diff --git a/internal/moves/archive/archive.go b/internal/moves/archive/archive.go

index 08fa24ece..648743084 100644

--- a/internal/moves/archive/archive.go

+++ b/internal/moves/archive/archive.go

@@ -48,7 +48,7 @@ var (

// (errors.Is sees it), Path the file as Build names it (relative to the

// files directory, or the env file's base name). It lets a caller say

// which file in its own words without reading the error's text; Error() is

-// the text the sentinel's rows record (MV-N77, MV-N81, MV-N86).

+// the text the sentinel's rows record (MV-N77, MV-N80, MV-N81, MV-N86).

type PathError struct {

Err error

Path string

@@ -63,8 +63,28 @@ func (e *PathError) Error() string {

}

func (e *PathError) Unwrap() error { return e.Err }

-func pathError(sentinel error, path, suffix string) error {

- return &PathError{Err: sentinel, Path: path, msg: sentinel.Error() + ": " + path + suffix}

+// The refusals that name a file, each one whole recorded sentence (copy

+// record MV-N77, MV-N80, MV-N81 and MV-N86) so the copy gate can read it.

+// Err is the sentinel errors.Is sees; the text is the sentinel's, a colon

+// and the path, as the rows say.

+func specialFileError(path string) error {

+ return &PathError{Err: ErrSpecialFile, Path: path, msg: fmt.Sprintf("archive: only regular files and directories move: %s", path)}

+func hardLinkError(path string) error {

+ return &PathError{Err: ErrSpecialFile, Path: path, msg: fmt.Sprintf("archive: only regular files and directories move: %s is a hard link", path)}

+func changedError(path string) error {

+ return &PathError{Err: ErrChanged, Path: path, msg: fmt.Sprintf("archive: a file changed while it was being archived: %s", path)}

+// The row says 4096, so the sentence does; this fails to compile if

+// MaxPathLen is ever changed without the row.

+const _ = uint(MaxPathLen-4096) + uint(4096-MaxPathLen)

+func longPathError(path string) error {

+ return &PathError{Err: ErrBadPath, Path: path, msg: fmt.Sprintf("archive: refused path: %s is longer than 4096 bytes", path)}

}

// The limits as enforced. Variables only so tests can lower them; nothing

@@ -142,10 +162,10 @@ func walk(root *os.Root, envPath string) ([]item, error) {

return err

}

if !info.Mode().IsRegular() && !info.IsDir() {

- return pathError(ErrSpecialFile, p, "")

+ return specialFileError(p)

}

if len(p) > MaxPathLen {

- return pathError(ErrBadPath, p, fmt.Sprintf(" is longer than %d bytes", MaxPathLen))

+ return longPathError(p)

}

return add(item{name: FilesPrefix + p, rel: p, root: root, info: info})

})

@@ -160,7 +180,7 @@ func walk(root *os.Root, envPath string) ([]item, error) {

case err != nil:

return nil, err

case !info.Mode().IsRegular():

- return nil, pathError(ErrSpecialFile, filepath.Base(envPath), "")

+ return nil, specialFileError(filepath.Base(envPath))

default:

if err := add(item{name: EnvEntry, path: envPath, info: info}); err != nil {

return nil, err

@@ -199,7 +219,7 @@ func openItemChecked(it item) (io.ReadCloser, error) {

}

if !got.Mode().IsRegular() || !os.SameFile(it.info, got) {

f.Close()

- return nil, fmt.Errorf("%w: %s", ErrChanged, displayName(it))

+ return nil, changedError(displayName(it))

}

// Phase 1 does not carry hard links. os.Root constrains names, not

// inodes: a pre-existing link to a file outside the instance directory

@@ -207,7 +227,7 @@ func openItemChecked(it item) (io.ReadCloser, error) {

// carry the outside inode to the target. Counted on the opened file.

if linkCount(got) > 1 {

f.Close()

- return nil, pathError(ErrSpecialFile, displayName(it), " is a hard link")

+ return nil, hardLinkError(displayName(it))

}

return f, nil

}

@@ -262,6 +282,8 @@ func openFilesRoot(filesDir string) (*os.Root, error) {

return nil, err

}

if !info.IsDir() {

+ // The files root itself is not a directory: untyped, so the caller

+ // reports it as the files failing to archive, never as a <path>.

return nil, fmt.Errorf("%w: %s", ErrSpecialFile, filesDir)

}

root, err := os.OpenRoot(filesDir)

@@ -275,6 +297,7 @@ func openFilesRoot(filesDir string) (*os.Root, error) {

}

if !os.SameFile(info, got) {

root.Close()

+ // The root itself, not a file in it: untyped, as above.

return nil, fmt.Errorf("%w: %s", ErrChanged, filesDir)

}

return root, nil

@@ -345,7 +368,7 @@ func copyItem(tw io.Writer, it item, size int64) (Entry, error) {

fh := sha256.New()

n, err := io.CopyN(io.MultiWriter(tw, fh), rc, size)

if errors.Is(err, io.EOF) {

- return Entry{}, fmt.Errorf("%w: %s", ErrChanged, displayName(it))

+ return Entry{}, changedError(displayName(it))

}

if err != nil {

return Entry{}, err

@@ -353,7 +376,7 @@ func copyItem(tw io.Writer, it item, size int64) (Entry, error) {

var one [1]byte

m, err := io.ReadFull(rc, one[:])

if m > 0 {

- return Entry{}, fmt.Errorf("%w: %s", ErrChanged, displayName(it))

+ return Entry{}, changedError(displayName(it))

}

if err != io.EOF {

return Entry{}, err

diff --git a/internal/moves/readiness.go b/internal/moves/readiness.go

index 4dfa55cef..937f49c4b 100644

--- a/internal/moves/readiness.go

+++ b/internal/moves/readiness.go

@@ -164,11 +164,10 @@ func (r TargetReport) Passing() (bool, string) {

return false, id + " was not reported"

}

if !c.OK {

- reason := c.Reason

- if reason == "" {

- reason = "did not pass"

+ if c.Reason == "" {

+ return false, id + ": did not pass"

}

- return false, id + ": " + reason

+ return false, id + ": " + c.Reason

}

return true, ""

diff --git a/internal/provision/provision.go b/internal/provision/provision.go

index 9a7e89e90..cda7ff114 100644

--- a/internal/provision/provision.go

+++ b/internal/provision/provision.go

@@ -1152,6 +1152,19 @@ const (

// re-reads.

var ErrMoveConflict = errors.New("provision: move state conflict")

+// The move refusals that name no value (copy record MV-N12, MV-N14, MV-N15,

+// MV-N40, MV-N41 and, for the legacy abort, MV-N45). Each is a whole recorded

+// sentence, so the copy gate can read it; the ones that name a value (MV-N13,

+// MV-N42, MV-N43, MV-N44) are written in place as one format.

+const (

+ refusedNoMove = "no move in flight"

+ refusedNoJournaledMove = "no journaled move in flight"

+ refusedMalformedStart = "malformed move start"

+ refusedPastNoReturn = "past the point of no return. the cut completes forward or moves back on its own"

+ refusedCutNotReady = "cut is only legal from ready"

+ refusedAlreadyAborting = "already aborting"

// SetRecordMove applies one guarded move transition: the same narrow

// read-CAS-write with one retry that SetRecordRegion uses (and for the same

// reason — re-reading and re-applying a transition on a lost race changes

@@ -1210,16 +1223,16 @@ type MoveStart struct {

func MoveStartTransition(p MoveStart) func(*Record) error {

return func(rec *Record) error {

if rec.Move != nil {

- return fmt.Errorf("%w: a move to %s is already %s", ErrMoveConflict, rec.Move.To, rec.Move.State)

+ return fmt.Errorf("%w: %s", ErrMoveConflict, fmt.Sprintf("a move to %s is already %s", rec.Move.To, rec.Move.State))

}

if !moveIDShape.MatchString(p.ID) || len(p.Incarnation) != 64 || (p.Cut != "auto" && p.Cut != "manual") || p.Now.IsZero() {

- return fmt.Errorf("%w: malformed move start", ErrMoveConflict)

+ return fmt.Errorf("%w: %s", ErrMoveConflict, refusedMalformedStart)

}

if rec.Region == p.To || p.From != rec.Region {

return fmt.Errorf("%w: the instance is already in %s", ErrMoveConflict, rec.Region)

}

if rec.Role != "" {

- return fmt.Errorf("%w: a %s does not move. delete it and create one in the new region", ErrMoveConflict, rec.Role)

+ return fmt.Errorf("%w: %s", ErrMoveConflict, fmt.Sprintf("a %s does not move. delete it and create one in the new region", rec.Role))

}

rec.Move = &MoveState{ID: p.ID, Incarnation: p.Incarnation, From: p.From, To: p.To, Cut: p.Cut, State: MovePreparing, RequestedBy: p.By, RequestedAt: p.Now.UTC()}

return nil

@@ -1251,10 +1264,10 @@ type MoveGuard struct{ ID, Incarnation string }

func (g MoveGuard) check(rec *Record) error {

if rec.Move == nil || rec.Move.Legacy() {

- return fmt.Errorf("%w: no journaled move in flight", ErrMoveConflict)

+ return fmt.Errorf("%w: %s", ErrMoveConflict, refusedNoJournaledMove)

}

if rec.Move.ID != g.ID || rec.Move.Incarnation != g.Incarnation {

- return fmt.Errorf("%w: the record's move is %s for incarnation %s", ErrMoveConflict, rec.Move.ID, rec.Move.Incarnation)

+ return fmt.Errorf("%w: %s", ErrMoveConflict, fmt.Sprintf("the record's move is %s for incarnation %s", rec.Move.ID, rec.Move.Incarnation))

}

return nil

}

@@ -1283,7 +1296,7 @@ func MoveGuardedCut(g MoveGuard) func(*Record) error {

return err

}

if rec.Move.State != MoveReady {

- return fmt.Errorf("%w: cut is only legal from ready", ErrMoveConflict)

+ return fmt.Errorf("%w: %s", ErrMoveConflict, refusedCutNotReady)

}

// Spec §7.4 pins at readiness: a ready move with no pinned inputs

// (after a back-to-ready, until the repin) has nothing for the

@@ -1336,12 +1349,12 @@ func MoveGuardedAbort(g MoveGuard) func(*Record) error {

case MovePreparing, MoveReady:

case MoveCutting:

if rec.Move.CutPhase != CutRequested {

- return fmt.Errorf("%w: past the point of no return. the cut completes forward or moves back on its own", ErrMoveConflict)

+ return fmt.Errorf("%w: %s", ErrMoveConflict, refusedPastNoReturn)

}

case MoveAborting:

- return fmt.Errorf("%w: already aborting", ErrMoveConflict)

+ return fmt.Errorf("%w: %s", ErrMoveConflict, refusedAlreadyAborting)

default:

- return fmt.Errorf("%w: a move in state %q cannot be aborted", ErrMoveConflict, rec.Move.State)

+ return fmt.Errorf("%w: %s", ErrMoveConflict, fmt.Sprintf("a move in state \"%s\" cannot be aborted", quotedInner(rec.Move.State)))

}

rec.Move.State = MoveAborting

return nil

@@ -2387,7 +2400,7 @@ func MoveMarkCutting() func(*Record) error {

func MoveAbort() func(*Record) error {

return func(rec *Record) error {

if rec.Move == nil {

- return fmt.Errorf("%w: no move in flight", ErrMoveConflict)

+ return fmt.Errorf("%w: %s", ErrMoveConflict, refusedNoMove)

}

switch rec.Move.State {

case MovePreparing, MoveReady:

@@ -2741,3 +2754,11 @@ func PutManifestIfMatch(ctx context.Context, s release.Store, acct, app string,

})

return

}

+// quotedInner is strconv.Quote without the surrounding quotes: the approved

+// sentence (MV-N42) carries its own quotes, and the state inside them keeps

+// %q's escaping of quotes, backslashes and control characters.

+func quotedInner(s string) string {

+ q := strconv.Quote(s)

+ return q[1 : len(q)-1]

diff --git a/internal/stopevidence/fdholders_alias_linux_test.go b/internal/stopevidence/fdholders_alias_linux_test.go

index 6c9971286..b0ee488ce 100644

--- a/internal/stopevidence/fdholders_alias_linux_test.go

+++ b/internal/stopevidence/fdholders_alias_linux_test.go

@@ -132,14 +132,25 @@ func TestFDIdentityFindsAHolderInAnotherMountNamespace(t *testing.T) {

t.Cleanup(func() { cmd.Process.Kill(); cmd.Wait() })

pid := cmd.Process.Pid

fd3 := filepath.Join("/proc", strconv.Itoa(pid), "fd", "3")

+ // Until sh has run the mount and exec'd sleep, fd 3 can be some other

+ // file (the dynamic loader's libc, while unshare or sh starts), so wait

+ // for fd 3 to be the database itself, by identity: stat through the

+ // magic link reaches the file the descriptor holds in any namespace.

+ want, err := os.Stat(db)

+ if err != nil {

+ t.Fatal(err)

+ }

var target string

+ held := false

for deadline := time.Now().Add(5 * time.Second); time.Now().Before(deadline); time.Sleep(20 * time.Millisecond) {

- if target, _ = os.Readlink(fd3); target != "" {

+ if fi, err := os.Stat(fd3); err == nil && os.SameFile(fi, want) {

+ target, _ = os.Readlink(fd3)

+ held = true

break

}

- if target == "" {

- t.Skip("the namespace holder never came up (unprivileged user namespaces refused?)")

+ if !held {

+ t.Skip("the namespace holder never came up holding the database (unprivileged user namespaces refused?)")

}

if target != aliased {

t.Logf("descriptor text %q (expected the bind path %q)", target, aliased)