amadan

carlos / platform Public

provision: census re-pins for Task 7 fix round 1 (PROPOSED-self-serve-moves-2)

offlineClaimEvidence and participantIdentityFor re-pinned in place (their
unreadable refusals are built transient); the internal/console envelope
re-pinned; the seal moves. The two Task 7 removals' bases now say how the
moved statements changed.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
claude f2cfb111298b269c8b00fab624031fa276554bda parent 11f3d6c
3 files changed, +19 −13
  • docs/superpowers/notes/census-proposal-self-serve-moves-2.md +3 −1
  • internal/provision/plan14_root_reads_test.go +7 −4
  • internal/provision/testdata/plan14-root-reads-self-serve-moves-2.tsv +9 −8
diff --git a/docs/superpowers/notes/census-proposal-self-serve-moves-2.md b/docs/superpowers/notes/census-proposal-self-serve-moves-2.md
index 42dc96cf4..e212e8a29 100644
--- a/docs/superpowers/notes/census-proposal-self-serve-moves-2.md
+++ b/docs/superpowers/notes/census-proposal-self-serve-moves-2.md
@@ -30,4 +30,6 @@ Task 5 fix round 1 adds no root read. `selfServeBusy` and `Server.selfServeEstim
Task 5 fix round 2 adds no root read and moves no seal. `reserveBoxes` now accepts an operator operation's own reservation whatever its keys (entries it no longer wants stay held until the move's release removes every entry of its id; a sentinel it holds covers every box). Its one `Put` of `control/offline-moves/active.json` is unchanged, so in the record-write inventory it stays nonrecord (`sel:Put`) with a new digest. The internal/console root-read envelope is re-pinned in place.
-Task 7 (the job from requested to ready, and its reconciliation) adds no root read, class or task. In the root-read overlay nine accepted-legacy units are added under `rev3=PROPOSED-self-serve-moves-2`, each with a reviewed one-line basis, and frozen, so the seal moves: `newRequestNonce` (crypto/rand for a request's nonce, the receipt the job's record write carries), `targetDataPaths` (the `/data` literal of the fact set the job requires of a target's ready report; it reads no file), `selfServePhaseDeadline` (its matched `Open` is `est.Open`, the estimate's open term, a duration) and six console SQLite statements of the journal running as `carlos-console` (`AbortSelfServe`, `AdvanceSelfServeToStep`, `ConsumeSelfServeMaintenance`, `ExpireSelfServeRequest`, `VoidExpiredSelfServeRequest` and `issueSelfServeRequest`). `AdvanceSelfServe` and `IssueSelfServeRequest` remain declared with no direct read (their statements moved unchanged into `AdvanceSelfServeToStep` and `issueSelfServeRequest`, which they call), so their Task 4 rows are removed under a proposed H3 disposition, as Task 10a removed `statusTick`'s. The internal/console envelope is re-pinned in place. The job reads the record only through `observeRecord` and `fenceRecord`, judged under the context's judge (`TestNoUnjudgedRecordReads` stays green). In the record-write inventory `Server.selfServeRun` is added as a record-writer (`key:SetRecordMoveAt`): every transition the job writes (the queue, queued-to-staging, the restages and maintenance rounds, the precheck, the estimate, the abort, the queued abort and the abort's finish) is one `SetRecordMoveAt` bound to the incarnation and record_seq persisted with the request, under the lease's write context. Paul's ruling is still outstanding.
+Task 7 (the job from requested to ready, and its reconciliation) adds no root read, class or task. In the root-read overlay nine accepted-legacy units are added under `rev3=PROPOSED-self-serve-moves-2`, each with a reviewed one-line basis, and frozen, so the seal moves: `newRequestNonce` (crypto/rand for a request's nonce, the receipt the job's record write carries), `targetDataPaths` (the `/data` literal of the fact set the job requires of a target's ready report; it reads no file), `selfServePhaseDeadline` (its matched `Open` is `est.Open`, the estimate's open term, a duration) and six console SQLite statements of the journal running as `carlos-console` (`AbortSelfServe`, `AdvanceSelfServeToStep`, `ConsumeSelfServeMaintenance`, `ExpireSelfServeRequest`, `VoidExpiredSelfServeRequest` and `issueSelfServeRequest`). `AdvanceSelfServe` and `IssueSelfServeRequest` remain declared with no direct read (their statements moved into `AdvanceSelfServeToStep` and `issueSelfServeRequest`, which they call; both changed: the advance also stamps `staging_started_at` entering staging and `next_maintenance_at` entering ready in the same statement, and `IssueSelfServeRequestWithDeadline` sets the round's step deadline with the request), so their Task 4 rows are removed under a proposed H3 disposition, as Task 10a removed `statusTick`'s. The internal/console envelope is re-pinned in place. The job reads the record only through `observeRecord` and `fenceRecord`, judged under the context's judge (`TestNoUnjudgedRecordReads` stays green). In the record-write inventory `Server.selfServeRun` is added as a record-writer (`key:SetRecordMoveAt`): every transition the job writes (the queue, queued-to-staging, the restages and maintenance rounds, the precheck, the estimate, the abort, the queued abort and the abort's finish) is one `SetRecordMoveAt` bound to the incarnation and record_seq persisted with the request, under the lease's write context. Paul's ruling is still outstanding.
+
+Task 7 fix round 1 adds no root read, class or task. `offlineClaimEvidence` and `participantIdentityFor` are re-pinned in place with their bases extended: their unreadable refusals are now built with `offlineRefusal.transient` set (the job waits a transient refusal out rather than aborting), and every door's answer, status and sentence is unchanged; their read sites are unchanged and their offsets moved, so the seal moves. The internal/console envelope is re-pinned in place. The two Task 7 removals' bases are corrected: `AdvanceSelfServeToStep` also stamps `staging_started_at` and `next_maintenance_at` (a changed behaviour of `AdvanceSelfServe`), and `issueSelfServeRequest` gains the variant that sets the round's step deadline. The record-write inventory is unchanged. Paul's ruling is still outstanding.
diff --git a/internal/provision/plan14_root_reads_test.go b/internal/provision/plan14_root_reads_test.go
index 3bd0b655f..8a8262d4f 100644
--- a/internal/provision/plan14_root_reads_test.go
+++ b/internal/provision/plan14_root_reads_test.go
@@ -1332,10 +1332,13 @@ func TestPlan14RootReadCensus(t *testing.T) {
// nine accepted-legacy units (the request nonce, the fact set's data
// paths, the phase deadlines and six journal statements) and retires
// AdvanceSelfServe's and IssueSelfServeRequest's rows under a proposed
- // H3 disposition (their statements moved unchanged into
- // AdvanceSelfServeToStep and issueSelfServeRequest), which moves it once
- // more.
- seal = "78da0561aeb2076952e497706bbc32e421a0a4388937115863a388af053dc24f"
+ // H3 disposition (their statements moved into AdvanceSelfServeToStep,
+ // which also stamps the staging start and the idle interval, and
+ // issueSelfServeRequest, which gains the round's deadline), which moves
+ // it once more. Its fix round 1 re-pins offlineClaimEvidence and
+ // participantIdentityFor in place (their unreadable refusals are built
+ // transient), which moves it again.
+ seal = "08d7a469489fb430c28e89770e8a0ca1425230534f1c17b7f67532657442e05e"
errs := append(compareRootReads(got, inv), checkRootReadLegacy(inv, seal)...)
errs = append(errs, checkRootReadDeclarations(got, inv)...)
if len(errs) > 0 {
diff --git a/internal/provision/testdata/plan14-root-reads-self-serve-moves-2.tsv b/internal/provision/testdata/plan14-root-reads-self-serve-moves-2.tsv
index 7a8c86d7e..fe8fd0ce7 100644
--- a/internal/provision/testdata/plan14-root-reads-self-serve-moves-2.tsv
+++ b/internal/provision/testdata/plan14-root-reads-self-serve-moves-2.tsv
@@ -23,7 +23,7 @@ internal/console/templates/settings.html external legacy accepted-legacy accepte
internal/provision/offline_move.go offlineBegin legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=root-input (J4, as OfflineStart); the console (cmd/console serve under console.service, user carlos-console): self-serve moves 1 Task 7's body (OfflineStart's, the state a parameter; a direct start advances move_seq and stamps move.seq, refusing ErrLifetimeExhausted at MaxInt64 before any write), and it now also creates the self-serve move in offline-queued for OfflineQueue (queued_at, staged_at and precheck_at at the caller's stamp, move.seq set to the record's move_seq, no advance) and records return_of; a stage and a queue hold nothing; its one site is still rec.ActiveRun.Open(), a method on the record's run state (RunState.Open), not a file read; self-serve moves 2 Task 2 file:Open@208 0a9b432ddf2f39a977c0651e377258b35c1d05635e9979583eeac6253d6c0ec8
@coverage internal/provision 42588b9f64803b41c4463efb31e69fda0fc66573efd5d6a2d6e709682eeca385
# Task 3 (per-box reservations with a legacy projection and a sentinel, the fenced reclaim and the operator doors' bound admission), rev3=PROPOSED-self-serve-moves-2: no root read, class or task is added and no accepted-legacy unit is re-pinned, so the seal does not move. The new units (moves.ParseOfflineActive, moves.OfflineActiveBody, the console's offlinereserve.go, the doors' offlineApplyBound and offlineAdvanceBound) read no file: their reads are the bucket's control/offline-moves/active.json and the instance record through the judged readers and fenceRecord. Envelopes re-pinned in place (Task 2's rows replaced): internal/console (offlinereserve.go, the start and stage doors, the Server's two evidence fields) and internal/moves (the reservation table in offline.go).
-@coverage internal/console 15d866f96bd8172d527b9eb40c99c327deab70034c207506072d1ea7440ce631
+@coverage internal/console 4d4c15cada5899270ff8c8b7cfa93e04d3c162f9d11c7296592628aff5ec1107
@coverage internal/moves 6a68b01ef865d9356bb19971f4cd4a61f7694769b63cee1d8234f615d5e9c8ba
# Task 4 (the journal, the events table, the console lease and the pass skeleton), rev3=PROPOSED-self-serve-moves-2: no root read, class or task is added. The console SQLite journal (selfserve_store.go) adds twenty-two units, each frozen accepted-legacy with a reviewed basis (console SQL as carlos-console, no bucket or root action), and the lease's console name adds one crypto/rand read (Server.selfServeConsoleID); serve (in place: the paging arm takes the store, the pass is started), NewServer (the row evidence and the recovery-mode scan) and Store.migrate (migrateSelfServe) are re-pinned. The seal moves. The lease and the pass read control/offline-moves/console.json and active.json from the bucket, not a file. Envelopes re-pinned in place: cmd/console, internal/console and internal/provision (WithWriteGuard in WriteRecord).
@legacy a8dd51a494ab3cd2ad371ded2850b6d78492569729527ea82cd8dd0f2b418a78 internal/console/selfserve_lease.go Server.selfServeConsoleID legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: reads crypto/rand once per process for the random console name the self-serve moves lease carries; randomness grants no root authority file:Read@110 3303b18ec5c77ccaf662064801f94276bfe947c31378cc1ecb8c4fe509d5d4d1
@@ -153,10 +153,10 @@ internal/host/agent.go statusTickAt legacy accepted-legacy accepted-legacy;rev3=
# Task 5 (record eligibility, the split start validation, participant pinning, the self-serve door bodies and the view), rev3=PROPOSED-self-serve-moves-2: no root read class or task is added beyond accepted-legacy. Six units are new, each frozen accepted-legacy with a reviewed basis; none reads a file: the scanner's sites are a URL query, a method or struct field named Open, and the signed host roster read from the deployment bucket. handleAPIInstanceMoveStatus and offlineClaimEvidence are re-pinned here; AdmitSelfServeMove and RequestSelfServeAbort are re-pinned in place in their Task 4 rows. The status reports (status/boxes/<label>.json, through readOfflineFleet) and the identity records (boxid.Load under control/boxes/<box id>.json) the door reads are bucket objects read with the console's deployment credentials; the scanner names no site for them. The seal moves. The internal/console envelope is re-pinned in place.
@legacy 48698cf2605e14127b843f2d79a937c084afc93a626b68de22e32b7c9e23fcdb internal/console/apiinstancemove.go Server.handleAPIInstanceMoveStatus legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=root-input (J4); the console (cmd/console serve under console.service, user carlos-console): the poll door, unchanged with Phase 1 on; with it off on a claims-off console it joins the instance's self-serve rows from the console SQLite store (selfServeViewOf; no row is the flat view byte for byte, a failed read is a 502) and, while the switch admits, answers ?estimate=1 through selfServeEstimate; its sites are URL queries and the host claim read, unchanged in kind, offsets moved file:Query@1084,file:Query@577,file:Read@1316 78a6cd92507895a1b961903947249df4b49adf14b05a8fc5480d6bfbcad5738c
internal/console/apiinstancemove.go Server.handleAPIInstanceMoveStatus legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=root-input (J4); the console (cmd/console serve under console.service, user carlos-console): the poll door, unchanged with Phase 1 on; with it off on a claims-off console it joins the instance's self-serve rows from the console SQLite store (selfServeViewOf; no row is the flat view byte for byte, a failed read is a 502) and, while the switch admits, answers ?estimate=1 through selfServeEstimate; its sites are URL queries and the host claim read, unchanged in kind, offsets moved file:Query@1084,file:Query@577,file:Read@1316 78a6cd92507895a1b961903947249df4b49adf14b05a8fc5480d6bfbcad5738c
-@legacy b11acd284e3e378504ad7f2d9e318a1e51f7b04acc5aa533357e5e3d0a638e1b internal/console/apiinstancemove_offline.go Server.offlineClaimEvidence legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=root-input (J4, as main's moves units); the console (cmd/console serve under console.service, user carlos-console): the census-ruling-moves-offline body unchanged, its inputs passed as account, app, host and record (offlineRecordChecks) rather than the door; reads the host claim, the record's acquisition, a domains claim and the app's admission only to refuse a start; a failed read refuses with a 502; deny-only file:Read@427 25b39bcacda912c8e03ea7e08e96cf54ffedbc36bbcc44e046dbced9cec33200
-internal/console/apiinstancemove_offline.go Server.offlineClaimEvidence legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=root-input (J4, as main's moves units); the console (cmd/console serve under console.service, user carlos-console): the census-ruling-moves-offline body unchanged, its inputs passed as account, app, host and record (offlineRecordChecks) rather than the door; reads the host claim, the record's acquisition, a domains claim and the app's admission only to refuse a start; a failed read refuses with a 502; deny-only file:Read@427 25b39bcacda912c8e03ea7e08e96cf54ffedbc36bbcc44e046dbced9cec33200
-@legacy 3e683da1dbcecefbcde3ade6601940eacbe80c746b9f290311133b3e1bad2c79 internal/console/apiinstancemove_offline.go Server.participantIdentityFor legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: reads the signed host roster (hostactors.Directory.Read, control/host-actors.json in the deployment bucket, verified under the release key) so a self-serve participant's identity record is checked against it; absent is no entries, any other failure refuses; no file read, no root action file:Read@478 5c91228191471a4415aa57a541861dbd20b6b2324f1d05f2610e98deba4c8e30
-internal/console/apiinstancemove_offline.go Server.participantIdentityFor legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: reads the signed host roster (hostactors.Directory.Read, control/host-actors.json in the deployment bucket, verified under the release key) so a self-serve participant's identity record is checked against it; absent is no entries, any other failure refuses; no file read, no root action file:Read@478 5c91228191471a4415aa57a541861dbd20b6b2324f1d05f2610e98deba4c8e30
+@legacy 15cf880752e5a25ee07684b1b1676c1efa09d265217eca7ee0c8f6eb6b0dc7af internal/console/apiinstancemove_offline.go Server.offlineClaimEvidence legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=root-input (J4, as main's moves units); the console (cmd/console serve under console.service, user carlos-console): the census-ruling-moves-offline body unchanged, its inputs passed as account, app, host and record (offlineRecordChecks) rather than the door; reads the host claim, the record's acquisition, a domains claim and the app's admission only to refuse a start; a failed read refuses with a 502; deny-only; self-serve moves 2 Task 7 fix round 1: its unreadable refusals are built transient (a typed field the job waits on), the answer, status and sentence unchanged file:Read@444 c12ce72c5e136b1752eb1543dae65715dc7994b8150856893dd51e59bce6bd3a
+internal/console/apiinstancemove_offline.go Server.offlineClaimEvidence legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=root-input (J4, as main's moves units); the console (cmd/console serve under console.service, user carlos-console): the census-ruling-moves-offline body unchanged, its inputs passed as account, app, host and record (offlineRecordChecks) rather than the door; reads the host claim, the record's acquisition, a domains claim and the app's admission only to refuse a start; a failed read refuses with a 502; deny-only; self-serve moves 2 Task 7 fix round 1: its unreadable refusals are built transient (a typed field the job waits on), the answer, status and sentence unchanged file:Read@444 c12ce72c5e136b1752eb1543dae65715dc7994b8150856893dd51e59bce6bd3a
+@legacy 0ea0b86b0720591d8892f4f8fec79bb508a0c67617d4d72f1da4f4d3afef3702 internal/console/apiinstancemove_offline.go Server.participantIdentityFor legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: reads the signed host roster (hostactors.Directory.Read, control/host-actors.json in the deployment bucket, verified under the release key) so a self-serve participant's identity record is checked against it; absent is no entries, any other failure refuses; no file read, no root action; self-serve moves 2 Task 7 fix round 1: its unreadable refusals are built transient (a typed field the job waits on), the answer, status and sentence unchanged file:Read@478 a0aed552b0b30662fe79a6e613e4c26e228469a83f9f88dbaaef6a922b566f46
+internal/console/apiinstancemove_offline.go Server.participantIdentityFor legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: reads the signed host roster (hostactors.Directory.Read, control/host-actors.json in the deployment bucket, verified under the release key) so a self-serve participant's identity record is checked against it; absent is no entries, any other failure refuses; no file read, no root action; self-serve moves 2 Task 7 fix round 1: its unreadable refusals are built transient (a typed field the job waits on), the answer, status and sentence unchanged file:Read@478 a0aed552b0b30662fe79a6e613e4c26e228469a83f9f88dbaaef6a922b566f46
@legacy 87ac0e5d6b48d2440bcc8a1ff4137b7609a927b0f3f522037acaa559d0117996 internal/console/selfserve_door.go Server.selfServeEstimate legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: the estimate of a self-serve move not yet requested: reads the request's URL query (region), the console SQLite rows and the prepare's bucket evidence, writes nothing; no file read, no root action; fix round 1: the record checks before the journal read (selfServeOpenRow) file:Query@354 12c7adb0d9d0682fd3ae9ec9f80884cf53899891aa4cd38ce5a0a71eff62c8b4
internal/console/selfserve_door.go Server.selfServeEstimate legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: the estimate of a self-serve move not yet requested: reads the request's URL query (region), the console SQLite rows and the prepare's bucket evidence, writes nothing; no file read, no root action; fix round 1: the record checks before the journal read (selfServeOpenRow) file:Query@354 12c7adb0d9d0682fd3ae9ec9f80884cf53899891aa4cd38ce5a0a71eff62c8b4
@legacy 00fcfd1a948069335f118cf07dd757b90d2020fad8caef0719eb75e8d3cc261c internal/console/selfserve_door.go selfServeBusy legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: the prepare's record checks; its one site is rec.ActiveRun.Open(), a method of the record already read; no file read, no root action; fix round 1: the open row is checked after it, from the journal file:Open@144 b9949bc89e1ed588d04dbd042d2a3b8a530546b85e05bf6f7fd3daf4d97a47b1
@@ -169,7 +169,7 @@ internal/console/selfserve_estimate.go type estimateTerms legacy accepted-legacy
internal/console/selfserve_estimate.go var estimateDefaults legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: the estimate's default terms, a literal whose Open field is the open phase's term; no file read, no root action file:Open@247,file:Open@49 e7c598c8e4a4fa1e4df207e463c6fd722f89d0955f896baa439ce328db821849
# Task 5 fix round 1, rev3=PROPOSED-self-serve-moves-2: selfServeBusy and Server.selfServeEstimate are re-pinned in place in their Task 5 rows (the record checks come before the journal read); no root read is added. The internal/console envelope is re-pinned in place. The seal moves.
# Task 5 fix round 2, rev3=PROPOSED-self-serve-moves-2: reserveBoxes accepts an operator operation's own reservation whatever its keys; it reads no file, so no root read row changes and the seal stands. The internal/console envelope is re-pinned in place.
-# Task 7 (the job from requested to ready and its reconciliation), rev3=PROPOSED-self-serve-moves-2: no root read, class or task is added. Nine accepted-legacy units are added: the request nonce's crypto/rand read (newRequestNonce), the fact set's data-path literal (targetDataPaths), the phase deadlines (selfServePhaseDeadline, whose matched Open is the estimate's open term) and six console SQLite units of the journal (AbortSelfServe, AdvanceSelfServeToStep, ConsumeSelfServeMaintenance, ExpireSelfServeRequest, VoidExpiredSelfServeRequest and issueSelfServeRequest). AdvanceSelfServe and IssueSelfServeRequest stay declared with no direct read (their statements moved unchanged into AdvanceSelfServeToStep and issueSelfServeRequest), so their rows are removed under a proposed H3 disposition. The internal/console envelope is re-pinned in place. The job's record reads go through observeRecord and fenceRecord, judged; its record writes are SetRecordMoveAt (the write census).
+# Task 7 (the job from requested to ready and its reconciliation), rev3=PROPOSED-self-serve-moves-2: no root read, class or task is added. Nine accepted-legacy units are added: the request nonce's crypto/rand read (newRequestNonce), the fact set's data-path literal (targetDataPaths), the phase deadlines (selfServePhaseDeadline, whose matched Open is the estimate's open term) and six console SQLite units of the journal (AbortSelfServe, AdvanceSelfServeToStep, ConsumeSelfServeMaintenance, ExpireSelfServeRequest, VoidExpiredSelfServeRequest and issueSelfServeRequest). AdvanceSelfServe and IssueSelfServeRequest stay declared with no direct read (their statements moved into AdvanceSelfServeToStep and issueSelfServeRequest; both changed: the advance also stamps staging_started_at and next_maintenance_at, and the issue gains a variant that sets the round's step deadline), so their rows are removed under a proposed H3 disposition. The internal/console envelope is re-pinned in place. The job's record reads go through observeRecord and fenceRecord, judged; its record writes are SetRecordMoveAt (the write census).
@legacy ef59e56ac62104a8e88ee2f25c3507da162d60bcea0517512afa8a0cb30a0711 internal/console/selfserve_apply.go newRequestNonce legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: reads crypto/rand for one self-serve request's random nonce, the receipt the job's record write carries; randomness grants no root authority file:Read@71 bfb07e7090b5d440e80a75ce46953b498406bde7d3c193a1292c9cd0dd8af2b0
internal/console/selfserve_apply.go newRequestNonce legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: reads crypto/rand for one self-serve request's random nonce, the receipt the job's record write carries; randomness grants no root authority file:Read@71 bfb07e7090b5d440e80a75ce46953b498406bde7d3c193a1292c9cd0dd8af2b0
@legacy faff40689f2db1c15244128406ef4d56ca66901a66d297e1b374509fd3c72688 internal/console/selfserve_checks.go targetDataPaths legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: names the instance's data paths under the data directory a target box's ready report uses (/data when the report names none), the fact set the job requires; reads no file and grants nothing data-literal@84 f5e99416bb54a684961d961f97bd0409ea1dbe7550c1c619073c939b7b933e33
@@ -188,5 +188,6 @@ internal/console/selfserve_store.go Store.ExpireSelfServeRequest legacy accepted
internal/console/selfserve_store.go Store.VoidExpiredSelfServeRequest legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: voids one expired, unconfirmed, unconsumed self-serve request and records the abort it obliges (abort_requested_at and its reason only when no abort was requested) in one UPDATE; no bucket or root action file:Exec@232 ababbf3459fb6fc8621a03bd1900735c638daa95ebf02d4aa2f55aefb8bf211a
@legacy 12c3b724737ce23f27d1c7854ce33964e06d94cfdd45dcd949d2e99b80a12fc8 internal/console/selfserve_store.go Store.issueSelfServeRequest legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: IssueSelfServeRequest's UPDATE (and its variant that sets the round's step deadline in the same statement), predicated on the phase, no outcome and no unconsumed request; no bucket or root action file:Exec@1273 6cf2541380116c6da8cb9f8a310f0067a5cc4721a5e8148e04349c8462b1905e
internal/console/selfserve_store.go Store.issueSelfServeRequest legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: IssueSelfServeRequest's UPDATE (and its variant that sets the round's step deadline in the same statement), predicated on the phase, no outcome and no unconsumed request; no bucket or root action file:Exec@1273 6cf2541380116c6da8cb9f8a310f0067a5cc4721a5e8148e04349c8462b1905e
-@removed internal/console/selfserve_store.go Store.AdvanceSelfServe H3 census-ruling-PROPOSED-self-serve-moves-2;rev3=PROPOSED-self-serve-moves-2;basis=remains declared but has no direct read; its statement moved unchanged to AdvanceSelfServeToStep, classified below, which AdvanceSelfServe calls with the phase's first substep; proposed removal only
-@removed internal/console/selfserve_store.go Store.IssueSelfServeRequest H3 census-ruling-PROPOSED-self-serve-moves-2;rev3=PROPOSED-self-serve-moves-2;basis=remains declared but has no direct read; its statement moved unchanged to issueSelfServeRequest, classified below, which IssueSelfServeRequest and IssueSelfServeRequestWithDeadline call; proposed removal only
+@removed internal/console/selfserve_store.go Store.AdvanceSelfServe H3 census-ruling-PROPOSED-self-serve-moves-2;rev3=PROPOSED-self-serve-moves-2;basis=remains declared but has no direct read; its statement moved to AdvanceSelfServeToStep, classified below, which AdvanceSelfServe calls with the phase's first substep, and which also stamps staging_started_at entering staging and next_maintenance_at entering ready in the same statement (a changed behaviour of AdvanceSelfServe); proposed removal only
+@removed internal/console/selfserve_store.go Store.IssueSelfServeRequest H3 census-ruling-PROPOSED-self-serve-moves-2;rev3=PROPOSED-self-serve-moves-2;basis=remains declared but has no direct read; its statement moved to issueSelfServeRequest, classified below, which IssueSelfServeRequest calls (its UPDATE as before) and IssueSelfServeRequestWithDeadline calls with the round's step deadline set in the same statement; proposed removal only
+# Task 7 fix round 1, rev3=PROPOSED-self-serve-moves-2: offlineClaimEvidence and participantIdentityFor are re-pinned in place (their unreadable refusals are built transient, a typed field of offlineRefusal; the doors' answers are unchanged), read sites unchanged, offsets moved; the internal/console envelope is re-pinned in place. The two Task 7 removals' bases now say how the moved statements changed.