carlos / platform Public

provision: census for the final review's fix round 3

The internal/console envelope re-pinned in place; no unit row changes and
the seal stands.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude 1 day ago f1b05a28e17acc035c3d9c101e1887306cebe9eb parent 9ee2cf3

2 files changed, +4 −1

docs/superpowers/notes/census-proposal-self-serve-moves-2.md +2 −0
internal/provision/testdata/plan14-root-reads-self-serve-moves-2.tsv +2 −1

diff --git a/docs/superpowers/notes/census-proposal-self-serve-moves-2.md b/docs/superpowers/notes/census-proposal-self-serve-moves-2.md

index 9927d2404..682cb64a8 100644

--- a/docs/superpowers/notes/census-proposal-self-serve-moves-2.md

+++ b/docs/superpowers/notes/census-proposal-self-serve-moves-2.md

@@ -53,3 +53,5 @@ Task 10b fix round 1 changes how the end-to-end bridge arms a box's instance id.

The final review's fix round (console half) adds no root read, class or task and no record write, and adds one bucket writer. In the root-read overlay `Store.issueSelfServeRequest` (it also stores a queue request's staging coordinates, F10), `Store.migrateSelfServe` (three additive columns, `announce_seq`, `request_stage_bucket` and `request_stage_region`, F9 and F10) and `Store.selfServeRequest` (the coordinates read back) are re-pinned in place with their bases extended. `ConfirmSelfServeRequest`'s statement moved to `ConfirmSelfServeRequestLanded`, which also records the landed record_seq as owed its serial bump (F9), frozen accepted-legacy; `ConfirmSelfServeRequest` stays declared with no direct read, so its row is removed under a proposed H3 disposition. The internal/console, internal/moves and internal/alerting (`alerting.Armed`, F13) envelopes are re-pinned, and the internal/host envelope for the host implementer's commits (036528e6..e43e415e: F5 host half, F7, F17's clock comment; then a2abea21: F6 host half). The seal moves to `1b87d203…`. In the record-write inventory five units are re-pinned in place with their writes unchanged: `Server.selfServeRun` (the owed announcement), `Server.reserveBoxes` (two lost races with no holder observed answer unreadable, F14), `Server.offlineOpenRecord` (a guard immediately before its create-only Put, the job's lease-bound context, F11), `Server.handleAPIInstanceOfflineReturn` (the request carries `target_box_id`, F6) and the host's `movesWorker.writeReturnReport` (an unreadable request is the scan's error, F5; it answers only a request whose `target_box_id` is the box's own BoxID, F6). The host's `answerReturn`, which deleted the index entry with `DeleteIfMatch` after the report, is removed (F6): no box deletes an index entry. The new writer, PROPOSED: `Server.deleteReturnIndexEntry` in `offlinereturn.go` deletes a return index entry (`control/offline-moves/@returns/<region>/<host>/<forward id>.json`) with `DeleteIfMatch` on the ETag it read, called when a return is staged or started (`offlineReturnIndexDone`) and by the pass's sweep of entries whose request is past its deadline (`selfServeReturnSweep`, once per tick under the lease, at most 32 entries). It never touches a record. The record-write census scans the Put family only (`censusMethods`), so the deleter has no inventory row; it is recorded here and in the inventory's comment. The writers list is otherwise unchanged.

The final review's fix round 2 adds no root read, class or task and no record write. In the root-read overlay `serve` (paging armed through `startPaging` from the start scan's own evidence, then the bootstrap orphan page) and `Store.SelfServeRecoveryPending` (`QueryRowContext` under the evidence read's 30 s bound) are re-pinned in place with their bases extended; the cmd/console, internal/console and internal/provision envelopes are re-pinned in place, and the seal moves to `f7f1a9f9…`. In the record-write inventory `SetRecordMoveAt` (the request's proposed stamp as the move's updated_at under `Expect.Stamp`, so a replay writes the same bytes; operator doors pass none), `Server.selfServeRun` (passes that stamp) and `Server.readOfflineEvidence` (judged at the pass's clock; a key-site) are re-pinned. The return index deleter now deletes the sweep's judged entry only (`deleteReturnIndexEntryAt`, `DeleteIfMatch` on the ETag the sweep read), and the expiry pass's hourly store sweep (`trashSweep`) also runs the index sweep (`returnSweepHourly`, 256 entries and 30 s at most) whatever the self-serve mode; neither is a Put-family unit, so neither has an inventory row. The writers list is otherwise unchanged.

+The final review's fix round 3 adds no root read, class or task, no record write and no writer, and re-pins no unit row. The return door's index cleanup now runs detached after the serial bump and the 202 (counted in the server's `detached` WaitGroup, which `Server.Shutdown` waits for), the hourly index sweep takes the shared mutex with TryLock-or-skip and lists one page of at most 256 keys through `release.PageLister`, and the journal half of the evidence read is abandoned at its deadline (`journalPending`). Only the internal/console envelope is re-pinned in place, and the seal stands at `f7f1a9f9…`. The writers list is unchanged.

diff --git a/internal/provision/testdata/plan14-root-reads-self-serve-moves-2.tsv b/internal/provision/testdata/plan14-root-reads-self-serve-moves-2.tsv

index fd6187ded..eaf649ef7 100644

--- a/internal/provision/testdata/plan14-root-reads-self-serve-moves-2.tsv

+++ b/internal/provision/testdata/plan14-root-reads-self-serve-moves-2.tsv

@@ -23,7 +23,7 @@ internal/console/templates/settings.html external legacy accepted-legacy accepte

internal/provision/offline_move.go offlineBegin legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=root-input (J4, as OfflineStart); the console (cmd/console serve under console.service, user carlos-console): self-serve moves 1 Task 7's body (OfflineStart's, the state a parameter; a direct start advances move_seq and stamps move.seq, refusing ErrLifetimeExhausted at MaxInt64 before any write), and it now also creates the self-serve move in offline-queued for OfflineQueue (queued_at, staged_at and precheck_at at the caller's stamp, move.seq set to the record's move_seq, no advance) and records return_of; a stage and a queue hold nothing; its one site is still rec.ActiveRun.Open(), a method on the record's run state (RunState.Open), not a file read; self-serve moves 2 Task 2 file:Open@208 0a9b432ddf2f39a977c0651e377258b35c1d05635e9979583eeac6253d6c0ec8

@coverage internal/provision c05f991c074ee6bf4a79352116c2402a479eae8cb43371b9316abe0baaf49d2d

# Task 3 (per-box reservations with a legacy projection and a sentinel, the fenced reclaim and the operator doors' bound admission), rev3=PROPOSED-self-serve-moves-2: no root read, class or task is added and no accepted-legacy unit is re-pinned, so the seal does not move. The new units (moves.ParseOfflineActive, moves.OfflineActiveBody, the console's offlinereserve.go, the doors' offlineApplyBound and offlineAdvanceBound) read no file: their reads are the bucket's control/offline-moves/active.json and the instance record through the judged readers and fenceRecord. Envelopes re-pinned in place (Task 2's rows replaced): internal/console (offlinereserve.go, the start and stage doors, the Server's two evidence fields) and internal/moves (the reservation table in offline.go).

-@coverage internal/console 2f4405c9670410b0a160e5d36f63466c4a12100a9ae15f52b9708a28b76f46e0

+@coverage internal/console 17ba046f9a80b899eda3be28bd904b4d5475c1f0602a07a2e2d9e90e11c92821

@coverage internal/moves bcac95270e69cdea56c9af080d134cc13586be1a0b7d079928372aded9df17ac

# Task 4 (the journal, the events table, the console lease and the pass skeleton), rev3=PROPOSED-self-serve-moves-2: no root read, class or task is added. The console SQLite journal (selfserve_store.go) adds twenty-two units, each frozen accepted-legacy with a reviewed basis (console SQL as carlos-console, no bucket or root action), and the lease's console name adds one crypto/rand read (Server.selfServeConsoleID); serve (in place: the paging arm takes the store, the pass is started), NewServer (the row evidence and the recovery-mode scan) and Store.migrate (migrateSelfServe) are re-pinned. The seal moves. The lease and the pass read control/offline-moves/console.json and active.json from the bucket, not a file. Envelopes re-pinned in place: cmd/console, internal/console and internal/provision (WithWriteGuard in WriteRecord).

@legacy a8dd51a494ab3cd2ad371ded2850b6d78492569729527ea82cd8dd0f2b418a78 internal/console/selfserve_lease.go Server.selfServeConsoleID legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: reads crypto/rand once per process for the random console name the self-serve moves lease carries; randomness grants no root authority file:Read@110 3303b18ec5c77ccaf662064801f94276bfe947c31378cc1ecb8c4fe509d5d4d1

@@ -240,3 +240,4 @@ internal/console/selfserve_store.go Store.ConfirmSelfServeRequestLanded legacy a

@removed internal/console/selfserve_store.go Store.ConfirmSelfServeRequest H3 census-ruling-PROPOSED-self-serve-moves-2;rev3=PROPOSED-self-serve-moves-2;basis=remains declared but has no direct read; its statement moved to ConfirmSelfServeRequestLanded, classified above, which ConfirmSelfServeRequest calls with no landed sequence (its UPDATE as before) and the job calls with the landed record_seq; proposed removal only

@coverage internal/alerting d70d1997f5fb0d2e8b948c56b4e9e65159ea7e9488a95cc737715ebe2bedd675

# Final review fix round 2, rev3=PROPOSED-self-serve-moves-2: no root read, class or task is added. serve (startPaging: the arm from the start scan's evidence, then the bootstrap orphan page, item 6) and Store.SelfServeRecoveryPending (QueryRowContext under the evidence read's bound, item 5) are re-pinned in place with their bases extended, sites unchanged in kind. The cmd/console, internal/console and internal/provision envelopes are re-pinned in place. The seal moves.

+# Final review fix round 3, rev3=PROPOSED-self-serve-moves-2: no root read, class, task or unit row changes. The return door's index cleanup runs detached after the answer (Server.Shutdown waits for it), the hourly index sweep is TryLock-or-skip and lists one bounded page, and the journal read is abandoned at the evidence read's deadline (journalPending); none adds a read site. The internal/console envelope is re-pinned in place; the seal stands.