carlos / platform Public

provision: census for the final review's fix round 2

Root reads: serve (startPaging) and SelfServeRecoveryPending (the bounded
context) re-pinned in place; the cmd/console, internal/console and
internal/provision envelopes re-pinned; the seal moves to f7f1a9f9. Record
writes: SetRecordMoveAt (Expect.Stamp), selfServeRun and
readOfflineEvidence re-pinned. The index sweep's judged-ETag delete and the
hourly sweep are recorded in the inventory comment and the census note.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude 1 day ago d9811bc725cd5903e46241f68caef5c00dc8685c parent e6e4bb7

4 files changed, +35 −12

docs/superpowers/notes/census-proposal-self-serve-moves-2.md +2 −0
internal/provision/plan14_root_reads_test.go +5 −2
internal/provision/self_serve_moves2_census_test.go +20 −3
internal/provision/testdata/plan14-root-reads-self-serve-moves-2.tsv +8 −7

diff --git a/docs/superpowers/notes/census-proposal-self-serve-moves-2.md b/docs/superpowers/notes/census-proposal-self-serve-moves-2.md

index de44d2883..9927d2404 100644

--- a/docs/superpowers/notes/census-proposal-self-serve-moves-2.md

+++ b/docs/superpowers/notes/census-proposal-self-serve-moves-2.md

@@ -51,3 +51,5 @@ Task 10b (the fourteen named end-to-end witnesses) adds no root read, class or t

Task 10b fix round 1 changes how the end-to-end bridge arms a box's instance id. Each box now arms it as `armMovesPass` arms the agent's: a per-process cache of the metadata answer, shaped like `cachedInstanceID`, read once at arm and then lazily through `throttledInstanceID`. `E2E.status` publishes the cached id in the status block, as the agent's status tick does. In the root-read overlay `E2E.status` is re-pinned in place (tests only, no new read site) and the internal/host envelope is re-pinned in place. The seal moves to `9193bc80…`. The record-write inventory and the writers list are unchanged.

The final review's fix round (console half) adds no root read, class or task and no record write, and adds one bucket writer. In the root-read overlay `Store.issueSelfServeRequest` (it also stores a queue request's staging coordinates, F10), `Store.migrateSelfServe` (three additive columns, `announce_seq`, `request_stage_bucket` and `request_stage_region`, F9 and F10) and `Store.selfServeRequest` (the coordinates read back) are re-pinned in place with their bases extended. `ConfirmSelfServeRequest`'s statement moved to `ConfirmSelfServeRequestLanded`, which also records the landed record_seq as owed its serial bump (F9), frozen accepted-legacy; `ConfirmSelfServeRequest` stays declared with no direct read, so its row is removed under a proposed H3 disposition. The internal/console, internal/moves and internal/alerting (`alerting.Armed`, F13) envelopes are re-pinned, and the internal/host envelope for the host implementer's commits (036528e6..e43e415e: F5 host half, F7, F17's clock comment; then a2abea21: F6 host half). The seal moves to `1b87d203…`. In the record-write inventory five units are re-pinned in place with their writes unchanged: `Server.selfServeRun` (the owed announcement), `Server.reserveBoxes` (two lost races with no holder observed answer unreadable, F14), `Server.offlineOpenRecord` (a guard immediately before its create-only Put, the job's lease-bound context, F11), `Server.handleAPIInstanceOfflineReturn` (the request carries `target_box_id`, F6) and the host's `movesWorker.writeReturnReport` (an unreadable request is the scan's error, F5; it answers only a request whose `target_box_id` is the box's own BoxID, F6). The host's `answerReturn`, which deleted the index entry with `DeleteIfMatch` after the report, is removed (F6): no box deletes an index entry. The new writer, PROPOSED: `Server.deleteReturnIndexEntry` in `offlinereturn.go` deletes a return index entry (`control/offline-moves/@returns/<region>/<host>/<forward id>.json`) with `DeleteIfMatch` on the ETag it read, called when a return is staged or started (`offlineReturnIndexDone`) and by the pass's sweep of entries whose request is past its deadline (`selfServeReturnSweep`, once per tick under the lease, at most 32 entries). It never touches a record. The record-write census scans the Put family only (`censusMethods`), so the deleter has no inventory row; it is recorded here and in the inventory's comment. The writers list is otherwise unchanged.

+The final review's fix round 2 adds no root read, class or task and no record write. In the root-read overlay `serve` (paging armed through `startPaging` from the start scan's own evidence, then the bootstrap orphan page) and `Store.SelfServeRecoveryPending` (`QueryRowContext` under the evidence read's 30 s bound) are re-pinned in place with their bases extended; the cmd/console, internal/console and internal/provision envelopes are re-pinned in place, and the seal moves to `f7f1a9f9…`. In the record-write inventory `SetRecordMoveAt` (the request's proposed stamp as the move's updated_at under `Expect.Stamp`, so a replay writes the same bytes; operator doors pass none), `Server.selfServeRun` (passes that stamp) and `Server.readOfflineEvidence` (judged at the pass's clock; a key-site) are re-pinned. The return index deleter now deletes the sweep's judged entry only (`deleteReturnIndexEntryAt`, `DeleteIfMatch` on the ETag the sweep read), and the expiry pass's hourly store sweep (`trashSweep`) also runs the index sweep (`returnSweepHourly`, 256 entries and 30 s at most) whatever the self-serve mode; neither is a Put-family unit, so neither has an inventory row. The writers list is otherwise unchanged.

diff --git a/internal/provision/plan14_root_reads_test.go b/internal/provision/plan14_root_reads_test.go

index f0a70fa83..214dd9ed2 100644

--- a/internal/provision/plan14_root_reads_test.go

+++ b/internal/provision/plan14_root_reads_test.go

@@ -1369,8 +1369,11 @@ func TestPlan14RootReadCensus(t *testing.T) {

// owed announcement, F9 and F10), freezes ConfirmSelfServeRequestLanded

// (ConfirmSelfServeRequest's statement, which also records the landed

// sequence; ConfirmSelfServeRequest's row under a proposed H3

- // disposition), which moves it once more.

- seal = "1b87d203a51b2f58017d43ee3d83baddf4014aaf04f43558816b4afb468d1afd"

+ // disposition), which moves it once more. Its fix round 2 re-pins serve

+ // (startPaging: paging armed from the start scan's evidence before the

+ // bootstrap page) and SelfServeRecoveryPending (the bounded context) in

+ // place, which moves it again.

+ seal = "f7f1a9f9e33fac5247c181ac88a6888a33be2793fbb68ca5392f6bae1afffeb7"

errs := append(compareRootReads(got, inv), checkRootReadLegacy(inv, seal)...)

errs = append(errs, checkRootReadDeclarations(got, inv)...)

if len(errs) > 0 {

diff --git a/internal/provision/self_serve_moves2_census_test.go b/internal/provision/self_serve_moves2_census_test.go

index 4a12847a6..dbe1b3f81 100644

--- a/internal/provision/self_serve_moves2_census_test.go

+++ b/internal/provision/self_serve_moves2_census_test.go

@@ -203,6 +203,23 @@ package provision

// their request's deadline (selfServeReturnSweep). Never a record. The

// census scans the Put family only (censusMethods), so it has no row

// here; it is listed in the census note.

+//

+// The final review's fix round 2: no record write is added or made raw;

+// three units are re-pinned in place.

+// - provision.go:SetRecordMoveAt stays a record-writer and is re-pinned:

+// Expect.Stamp, when set (the job's persisted request's proposed

+// stamp), is the move's updated_at instead of the attempt's clock, so a

+// replay writes the first attempt's bytes (item 4). The operator doors

+// pass no Stamp; their writes are unchanged.

+// - selfserve_apply.go:Server.selfServeRun is re-pinned: it passes the

+// request's proposed stamp as Expect.Stamp.

+// - apiinstancemove_offline.go:Server.readOfflineEvidence stays a

+// key-site and is re-pinned: its reports are judged at the pass's clock

+// (selfServeNow) when the job reads them (item 7); it writes nothing.

+// - The return index deleter gains deleteReturnIndexEntryAt (if-match on

+// the ETag the sweep judged, item 1), the door's cleanup is bounded

+// (item 2) and the hourly store sweep calls the index sweep (item 3);

+// like the deleter, none is a Put-family unit.

func plan14SelfServeMoves2WriteCensusInventory() []censusEntry {

removed := []struct{ file, unit string }{

{"internal/console/apiinstancemove.go", "Server.handleAPIInstanceMoveRequest"},

@@ -223,7 +240,7 @@ func plan14SelfServeMoves2WriteCensusInventory() []censusEntry {

{"internal/provision/provision.go", "updateRecord", "record-writer", "key:updateRecord", "c02b077b70a5d064bc4a602974fd11b8729365b22353aae31e04978d94f7e122"},

{"internal/provision/provision.go", "updateRecordSeeding", "record-writer", "key:RecordKey,key:WriteRecord", "6c67de6c105824040c297fe23838b9c4de80bdbfce065b1ce80ef46f4f422be0"},

{"internal/provision/seed.go", "SetRecordSeed", "record-writer", "key:SetRecordSeed", "b9b7e479f5217f26356e31e1568e1d1aa0f31c8d0f719633e7f2b15f25119d60"},

- {"internal/provision/provision.go", "SetRecordMoveAt", "record-writer", "key:SetRecordMoveAt", "e818d6acd4429185c5fc11db4100a73b2d83409b9f6f32435e88aac7f9012f41"},

+ {"internal/provision/provision.go", "SetRecordMoveAt", "record-writer", "key:SetRecordMoveAt", "c933a9f84f4b574d4530a6adf6de84a4ce17c48d99ef636a594991974f101976"},

{"internal/moves/offline.go", "OpenRecordKey", "key-site", "key:OpenRecordKey", "ebb4f0dcd050b5d183b642829423ba71740bf6d86427af2cba64475d54276be9"},

{"internal/console/apiinstancemove_offline.go", "Server.offlineApplyBound", "record-writer", "key:SetRecordMoveAt", "039573bfd1f3ec621474e9c761f55ce301227d812f4dd6a7d206dad0c18b9980"},

// Re-pinned by Task 5 fix round 2: an operator operation's own

@@ -246,11 +263,11 @@ func plan14SelfServeMoves2WriteCensusInventory() []censusEntry {

{"internal/host/e2e_bridge.go", "sealWorld.arm", "testsupport", "sel:Put", "501199f1f33a0539bb0e97782f87f7e8fd8b2fe345530881670e6cfb0423709f"},

{"internal/host/e2e_bridge.go", "const sealPrefix", "reference", "lit:instances", "c78134a7cd1306c1655db52559840e9e94956991b4a83d27521801fa85ad566c"},

// Task 7: the job's one record write, every transition through it.

- {"internal/console/selfserve_apply.go", "Server.selfServeRun", "record-writer", "key:SetRecordMoveAt", "26998a3066d61bead04f7a3c195d690c006ca35e995baadfa7f025cf37f94201"},

+ {"internal/console/selfserve_apply.go", "Server.selfServeRun", "record-writer", "key:SetRecordMoveAt", "a2d705793fd1377cc09c6bda6b4646d249f9dd99b3fdcbdd568372470b47db89"},

// Task 8: the open record, the operator return's request and

// report, their readers, and the return door's route.

{"internal/console/apiinstancemove_offline.go", "Server.offlineOpenRecord", "foreign-recordkey", "key:OpenRecordKey,sel:Put", "a81e93f3b42072a6a2c13cd3fcf31cdda42952cd619cdd89bac628e7c821ab90"},

- {"internal/console/apiinstancemove_offline.go", "Server.readOfflineEvidence", "key-site", "key:OpenRecordKey", "09b3dd97c2e4fb9828d04e09a451a4380b1a9dc321640f6d57f18a217547af12"},

+ {"internal/console/apiinstancemove_offline.go", "Server.readOfflineEvidence", "key-site", "key:OpenRecordKey", "b1104ae2cb9779ac31f55a649bbdfc6d7415f9bc1378104434e03b39fd2339b3"},

{"internal/console/offlinereturn.go", "Server.handleAPIInstanceOfflineReturn", "nonrecord", "sel:Put", "371ac237cfeaa2df7daa9c9c5d12ed3be3a5c81092d627f66998073824811446"},

{"internal/console/offlinereturn.go", "Server.offlineReturnIndex", "nonrecord", "sel:Put", "38f5e6d1f0781f11491d7b116a43dd8fb42d5fb3e60c66419513ec1cfb646792"},

{"internal/console/offlinereturn.go", "Server.readOpenRecord", "key-site", "key:OpenRecordKey", "809cf07d965d8bd136a1d463e5df3c435c086598359432630fa9d5fea6cd8950"},

diff --git a/internal/provision/testdata/plan14-root-reads-self-serve-moves-2.tsv b/internal/provision/testdata/plan14-root-reads-self-serve-moves-2.tsv

index f42c3f609..fd6187ded 100644

--- a/internal/provision/testdata/plan14-root-reads-self-serve-moves-2.tsv

+++ b/internal/provision/testdata/plan14-root-reads-self-serve-moves-2.tsv

@@ -1,7 +1,7 @@

# Census overlay self-serve-moves-2, marked rev3=PROPOSED-self-serve-moves-2 (not an accepted ruling; docs/superpowers/notes/census-proposal-self-serve-moves-2.md). Loaded after the self-serve-moves-1 overlay.

# Task 1 (the move-capable token and the self-serve gate), rev3=PROPOSED-self-serve-moves-2: no record envelope changes and no root read, class or task is added. Eight accepted-legacy units are re-pinned in place with reviewed bases and take new frozen fingerprints (the seal moves): the cli_tokens moves column (migrateCLIAuth), its writer and readers (claimRawNewAppToken, CLITokens, ServicePrincipals, CLIPrincipal), the tokens page template, serve (CARLOS_SELF_SERVE_MOVES) and the request door's dispatch. Envelopes re-pinned: cmd/console, internal/console (selfserve_gate.go, the shared instance rails, the mint door's moves field) and internal/console/templates.

-@legacy 2107e4464500907572f1d145aa4e0421e7641269cc224b17832f52bbfb7d1b8b cmd/console/main.go serve legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=the console (cmd/console serve under console.service, user carlos-console): plan 1's body (Task 0 starts the lifetimes cutover watch, Task 3 the lifetime recovery pass and Task 5 the incarnation migration pass, off unless CARLOS_LIFETIMES_MIGRATE=1) and plan 2 Task 1 reads CARLOS_SELF_SERVE_MOVES into Config.SelfServeMoves, an environment string; plan 2 Task 4 passes the console store to the paging arm (armMovesPaging reads the self-serve journal and the bucket's active.json) and starts the self-serve moves pass as a recorded worker; the same three data path literals; no privileged reader is added data-literal@4077,data-literal@5178,data-literal@5415 cecee2685e8802c2d9223141b57359203c0fba5b29b2e04f173cd37420f8de13

-cmd/console/main.go serve legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=the console (cmd/console serve under console.service, user carlos-console): plan 1's body (Task 0 starts the lifetimes cutover watch, Task 3 the lifetime recovery pass and Task 5 the incarnation migration pass, off unless CARLOS_LIFETIMES_MIGRATE=1) and plan 2 Task 1 reads CARLOS_SELF_SERVE_MOVES into Config.SelfServeMoves, an environment string; plan 2 Task 4 passes the console store to the paging arm (armMovesPaging reads the self-serve journal and the bucket's active.json) and starts the self-serve moves pass as a recorded worker; the same three data path literals; no privileged reader is added data-literal@4077,data-literal@5178,data-literal@5415 cecee2685e8802c2d9223141b57359203c0fba5b29b2e04f173cd37420f8de13

+@legacy aa4d824a56e75201bd6b8ef6d457167782688d7efd675ab597264b0283b974e1 cmd/console/main.go serve legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=the console (cmd/console serve under console.service, user carlos-console): plan 1's body (Task 0 starts the lifetimes cutover watch, Task 3 the lifetime recovery pass and Task 5 the incarnation migration pass, off unless CARLOS_LIFETIMES_MIGRATE=1) and plan 2 Task 1 reads CARLOS_SELF_SERVE_MOVES into Config.SelfServeMoves, an environment string; plan 2 Task 4 passes the console store to the paging arm (armMovesPaging reads the self-serve journal and the bucket's active.json) and starts the self-serve moves pass as a recorded worker; the same three data path literals; no privileged reader is added; fix round 2 (item 6): paging is armed through startPaging from the start scan's own evidence, then the bootstrap orphan page is sent data-literal@4077,data-literal@5178,data-literal@5415 11264d1ce6dfd08c3a52250a1d9120fcb8b38cf1ccd7ea8c2f230427c8a66147

+cmd/console/main.go serve legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=the console (cmd/console serve under console.service, user carlos-console): plan 1's body (Task 0 starts the lifetimes cutover watch, Task 3 the lifetime recovery pass and Task 5 the incarnation migration pass, off unless CARLOS_LIFETIMES_MIGRATE=1) and plan 2 Task 1 reads CARLOS_SELF_SERVE_MOVES into Config.SelfServeMoves, an environment string; plan 2 Task 4 passes the console store to the paging arm (armMovesPaging reads the self-serve journal and the bucket's active.json) and starts the self-serve moves pass as a recorded worker; the same three data path literals; no privileged reader is added; fix round 2 (item 6): paging is armed through startPaging from the start scan's own evidence, then the bootstrap orphan page is sent data-literal@4077,data-literal@5178,data-literal@5415 11264d1ce6dfd08c3a52250a1d9120fcb8b38cf1ccd7ea8c2f230427c8a66147

@legacy 74173dd0410354dc3c0e4d80bec910c2107355d36b6b7bf30e719fdf6c20a1a9 internal/console/apiinstancemove.go Server.handleAPIInstanceMoveRequest legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=the console (cmd/console serve under console.service, user carlos-console): the census-ruling-region-ha-2a body unchanged; with Phase 1 off the dispatch sends self-serve mode to selfServeMoveRequest (the self-serve gate: binding SQL only, no bucket read, no record read; Task 1's body answers the family's 404) and every other request to the legacy body as before; read sites unchanged, offsets moved file:Exec@10257,file:Exec@10434,file:Exec@10585,file:Exec@11585,file:Exec@9178,file:Exec@9266,file:Read@7664,file:Read@9976 6be4b2d5ed59e3e42c47589039daba2cdb4081db45e0258d8889ef8477290591

internal/console/apiinstancemove.go Server.handleAPIInstanceMoveRequest legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=the console (cmd/console serve under console.service, user carlos-console): the census-ruling-region-ha-2a body unchanged; with Phase 1 off the dispatch sends self-serve mode to selfServeMoveRequest (the self-serve gate: binding SQL only, no bucket read, no record read; Task 1's body answers the family's 404) and every other request to the legacy body as before; read sites unchanged, offsets moved file:Exec@10257,file:Exec@10434,file:Exec@10585,file:Exec@11585,file:Exec@9178,file:Exec@9266,file:Read@7664,file:Read@9976 6be4b2d5ed59e3e42c47589039daba2cdb4081db45e0258d8889ef8477290591

@legacy 5aa23d2f21436a1f9ad50c36a41b12e53bbd234e3fafb2eaaab7b4597d83d4b4 internal/console/authstore.go Store.CLITokens legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: lists one address's live cli_tokens rows from the console SQLite store, now with the moves column; no bucket or root action file:Query@78 5c231bb3848378ec9ec9edf92d35e57927557b521d4bfed415f24ace0fb78689

@@ -16,14 +16,14 @@ internal/console/svcprincipal.go Store.CLIPrincipal legacy accepted-legacy accep

internal/console/svcprincipal.go Store.ServicePrincipals legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: lists one account's live app and service cli_tokens rows from the console SQLite store, now with the moves column; no bucket or root action file:Query@87 6497829090bbca886acbd1a2fec6f2130ad9d0e9eb8474f36642f3f20abc41b6

@legacy 058a42b1f720a95b9590b30f143ba9892bb169f1c43a386caabdf1fca6b32829 internal/console/templates/settings.html external legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: the tokens page template marks a move-capable app token beside its app; it renders the rows its handler read and reads nothing of its own file:external@0 4e903910a7001a43e9f206a7d43cdf9d1fbf1e0af331f6b08f194b21681e05e4

internal/console/templates/settings.html external legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: the tokens page template marks a move-capable app token beside its app; it renders the rows its handler read and reads nothing of its own file:external@0 4e903910a7001a43e9f206a7d43cdf9d1fbf1e0af331f6b08f194b21681e05e4

-@coverage cmd/console 82b97d3333df4e52b486d98f22b469cbdb0b83d36276e5832d686cfa6c832199

+@coverage cmd/console 321a9b361efb12ae6af6df6cd64501dfd3776e0c204a11c1c4612bea6a9034cc

@coverage internal/console/templates d3e4b3b103e9a9966a8c91e6683c241b2e53ce55a24f6511c53266586b7f1c5d

# Task 2 (the queued state, the receipts, the caller's stamps, the bound write and the open record), rev3=PROPOSED-self-serve-moves-2: no root read, class or task is added. offlineBegin (the shared body of OfflineStart, OfflineStage and now OfflineQueue) is re-pinned in place with a reviewed basis and takes a new frozen fingerprint, which moves the seal; its one site moved. The other new transitions, ProposeStamp, Receipt, SetRecordMoveAt and moves.OpenRecordKey read no file. Envelopes re-pinned: internal/console (the operator doors propose their stamps, the queued state in the verb and the view, the abort door's OfflineAbortAt; Task 1's row replaced in place), internal/moves (OpenRecord, OpenRecordKey) and internal/provision (the record fields, the transitions, the bound write). The new record fields need no @fields row: the census's field rule covers internal/registry structs only.

@legacy 94b21acdfb6eb3f8ee0a3dd937605e18edd852766f1091d7d664e4bc566f4ad2 internal/provision/offline_move.go offlineBegin legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=root-input (J4, as OfflineStart); the console (cmd/console serve under console.service, user carlos-console): self-serve moves 1 Task 7's body (OfflineStart's, the state a parameter; a direct start advances move_seq and stamps move.seq, refusing ErrLifetimeExhausted at MaxInt64 before any write), and it now also creates the self-serve move in offline-queued for OfflineQueue (queued_at, staged_at and precheck_at at the caller's stamp, move.seq set to the record's move_seq, no advance) and records return_of; a stage and a queue hold nothing; its one site is still rec.ActiveRun.Open(), a method on the record's run state (RunState.Open), not a file read; self-serve moves 2 Task 2 file:Open@208 0a9b432ddf2f39a977c0651e377258b35c1d05635e9979583eeac6253d6c0ec8

internal/provision/offline_move.go offlineBegin legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=root-input (J4, as OfflineStart); the console (cmd/console serve under console.service, user carlos-console): self-serve moves 1 Task 7's body (OfflineStart's, the state a parameter; a direct start advances move_seq and stamps move.seq, refusing ErrLifetimeExhausted at MaxInt64 before any write), and it now also creates the self-serve move in offline-queued for OfflineQueue (queued_at, staged_at and precheck_at at the caller's stamp, move.seq set to the record's move_seq, no advance) and records return_of; a stage and a queue hold nothing; its one site is still rec.ActiveRun.Open(), a method on the record's run state (RunState.Open), not a file read; self-serve moves 2 Task 2 file:Open@208 0a9b432ddf2f39a977c0651e377258b35c1d05635e9979583eeac6253d6c0ec8

-@coverage internal/provision d018e5699137db933be2142f7526d0d1d10b08170525886bd9c424cde5578b55

+@coverage internal/provision c05f991c074ee6bf4a79352116c2402a479eae8cb43371b9316abe0baaf49d2d

# Task 3 (per-box reservations with a legacy projection and a sentinel, the fenced reclaim and the operator doors' bound admission), rev3=PROPOSED-self-serve-moves-2: no root read, class or task is added and no accepted-legacy unit is re-pinned, so the seal does not move. The new units (moves.ParseOfflineActive, moves.OfflineActiveBody, the console's offlinereserve.go, the doors' offlineApplyBound and offlineAdvanceBound) read no file: their reads are the bucket's control/offline-moves/active.json and the instance record through the judged readers and fenceRecord. Envelopes re-pinned in place (Task 2's rows replaced): internal/console (offlinereserve.go, the start and stage doors, the Server's two evidence fields) and internal/moves (the reservation table in offline.go).

-@coverage internal/console 7a8316dd7a5333ff7b7c10a23b077de58baf4e308a768fdfe1e6e72869ad00b6

+@coverage internal/console 2f4405c9670410b0a160e5d36f63466c4a12100a9ae15f52b9708a28b76f46e0

@coverage internal/moves bcac95270e69cdea56c9af080d134cc13586be1a0b7d079928372aded9df17ac

# Task 4 (the journal, the events table, the console lease and the pass skeleton), rev3=PROPOSED-self-serve-moves-2: no root read, class or task is added. The console SQLite journal (selfserve_store.go) adds twenty-two units, each frozen accepted-legacy with a reviewed basis (console SQL as carlos-console, no bucket or root action), and the lease's console name adds one crypto/rand read (Server.selfServeConsoleID); serve (in place: the paging arm takes the store, the pass is started), NewServer (the row evidence and the recovery-mode scan) and Store.migrate (migrateSelfServe) are re-pinned. The seal moves. The lease and the pass read control/offline-moves/console.json and active.json from the bucket, not a file. Envelopes re-pinned in place: cmd/console, internal/console and internal/provision (WithWriteGuard in WriteRecord).

@legacy a8dd51a494ab3cd2ad371ded2850b6d78492569729527ea82cd8dd0f2b418a78 internal/console/selfserve_lease.go Server.selfServeConsoleID legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: reads crypto/rand once per process for the random console name the self-serve moves lease carries; randomness grants no root authority file:Read@110 3303b18ec5c77ccaf662064801f94276bfe947c31378cc1ecb8c4fe509d5d4d1

@@ -50,8 +50,8 @@ internal/console/selfserve_store.go Store.MoveTerminalOrAbsent legacy accepted-l

internal/console/selfserve_store.go Store.RequestSelfServeAbort legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: marks an abort requested on a self-serve row in one of the given phases; no bucket or root action; self-serve moves 2 Task 5: the predicate also requires cut_requested_at = 0, so a cancel never lands after a cut file:Exec@372 91993864428e5e973cd658994504ee6414aa65f2f9f7bdc6cf28b2c2691b7db2

@legacy 44c2b0be5f7e536d50699223225b253a8b805c834a35138f44232ca9a83dea34 internal/console/selfserve_store.go Store.SelfServeMove legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: reads one self-serve move row from the console SQLite store; no bucket or root action file:QueryRow@96 607827d36fccc1f64607427fce954cf9f6f1e2a5e005e50f72bed50d1944152d

internal/console/selfserve_store.go Store.SelfServeMove legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: reads one self-serve move row from the console SQLite store; no bucket or root action file:QueryRow@96 607827d36fccc1f64607427fce954cf9f6f1e2a5e005e50f72bed50d1944152d

-@legacy 20dc8f1831efbb9568fbc0c6cf830c21aaa6a0df1d996c3404823e81c53a57f9 internal/console/selfserve_store.go Store.SelfServeRecoveryPending legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: counts the self-serve rows and undelivered events the pass still owes, for recovery mode; no bucket or root action file:QueryRow@78 2f1f0f6502aead50b7e0ae48179b7babd36bca3a1537b09aa7bd6fe59fd3be31

-internal/console/selfserve_store.go Store.SelfServeRecoveryPending legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: counts the self-serve rows and undelivered events the pass still owes, for recovery mode; no bucket or root action file:QueryRow@78 2f1f0f6502aead50b7e0ae48179b7babd36bca3a1537b09aa7bd6fe59fd3be31

+@legacy 82f9289be30dada8796419e4ee2c089cb00ae3797db5a39eb0be964f74372eeb internal/console/selfserve_store.go Store.SelfServeRecoveryPending legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: counts the self-serve rows and undelivered events the pass still owes, for recovery mode; no bucket or root action; fix round 2 (item 5): the read takes the evidence read's bounded context (QueryRowContext), the connection wait included file:QueryRowContext@97 072ec159c92c19da6a480eeffb122235a6ca9364062c4a1d6f42005e994aa8ba

+internal/console/selfserve_store.go Store.SelfServeRecoveryPending legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: counts the self-serve rows and undelivered events the pass still owes, for recovery mode; no bucket or root action; fix round 2 (item 5): the read takes the evidence read's bounded context (QueryRowContext), the connection wait included file:QueryRowContext@97 072ec159c92c19da6a480eeffb122235a6ca9364062c4a1d6f42005e994aa8ba

@legacy 98d0f21730dc4441280f9f8f55310393eab6ad37ec0cd0ee533b94e23a6a5a23 internal/console/selfserve_store.go Store.SetSelfServeExpiry legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: records an expiry bound to a self-serve row's phase and the deadline read; no bucket or root action file:Exec@368 d095c79c42af88f5865e3e4e1dc123028ccf6741489c918768979eae5102d578

internal/console/selfserve_store.go Store.SetSelfServeExpiry legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: records an expiry bound to a self-serve row's phase and the deadline read; no bucket or root action file:Exec@368 d095c79c42af88f5865e3e4e1dc123028ccf6741489c918768979eae5102d578

@legacy bc152b81b20eb8142d84c8db3493e16c6b9b3c2b83a8c6a5768cf1f2d8f99ec3 internal/console/selfserve_store.go Store.UnemittedSelfServeEvents legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: lists undelivered self-serve events from the console SQLite store; no bucket or root action file:Query@94 be88efeaf911708fdc26a7ab288ff49ac04768ce0a657f1107ceb4eb4fd65d2a

@@ -239,3 +239,4 @@ internal/console/selfserve_estimate.go Store.moveTimings legacy accepted-legacy

internal/console/selfserve_store.go Store.ConfirmSelfServeRequestLanded legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: ConfirmSelfServeRequest's UPDATE, which also records the landed record_seq as owed its serial bump (announce_seq = MAX(announce_seq, ?), final review F9), predicated on its nonce and unconsumed, unvoided, unconfirmed flags; no bucket or root action file:Exec@326 e7523e0d723468ac13dbbf021dcd54cc58fa10c57e2908d3c4979ba8a95216b4

@removed internal/console/selfserve_store.go Store.ConfirmSelfServeRequest H3 census-ruling-PROPOSED-self-serve-moves-2;rev3=PROPOSED-self-serve-moves-2;basis=remains declared but has no direct read; its statement moved to ConfirmSelfServeRequestLanded, classified above, which ConfirmSelfServeRequest calls with no landed sequence (its UPDATE as before) and the job calls with the landed record_seq; proposed removal only

@coverage internal/alerting d70d1997f5fb0d2e8b948c56b4e9e65159ea7e9488a95cc737715ebe2bedd675

+# Final review fix round 2, rev3=PROPOSED-self-serve-moves-2: no root read, class or task is added. serve (startPaging: the arm from the start scan's evidence, then the bootstrap orphan page, item 6) and Store.SelfServeRecoveryPending (QueryRowContext under the evidence read's bound, item 5) are re-pinned in place with their bases extended, sites unchanged in kind. The cmd/console, internal/console and internal/provision envelopes are re-pinned in place. The seal moves.