carlos / platform Public

census: self-serve moves 1 Task 6b fix round 1 re-pins Reconcile and the three judged host reads

Reconcile's write-census digest and its accepted-legacy row are re-pinned in
place; rootGenerationSource.resolve and generationRequiredInventory are
re-pinned in the write inventory; channelRelease, rootGenerationSource.resolve
and generationRequiredInventory take root-read rows at their classes; the
internal/host and internal/provision envelopes are refreshed; the seal moves.
All PROPOSED-self-serve-moves-1.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

claude 2 days ago f7a29824ceef9893e608a9857d3e326bbbe37b7c parent d9c5d97

3 files changed, +21 −7

internal/provision/plan14_root_reads_test.go +3 −2
internal/provision/self_serve_moves1_census_test.go +10 −1
internal/provision/testdata/plan14-root-reads-self-serve-moves-1.tsv +8 −4

diff --git a/internal/provision/plan14_root_reads_test.go b/internal/provision/plan14_root_reads_test.go

index 3ef06978d..d99d0bc4b 100644

--- a/internal/provision/plan14_root_reads_test.go

+++ b/internal/provision/plan14_root_reads_test.go

@@ -1275,8 +1275,9 @@ func TestPlan14RootReadCensus(t *testing.T) {

// claims-off auto-purge is removed. Task 6b (consumers observe the

// lifetime) re-pins the reconcile pass, the import journal's readers and

// the box's record consumers, and adds journalRecordJudged, which moves

- // it again.

- seal = "a75f40917021bd449efbcc5974370277a39e1c284d234d46f8e9a904c08ccc53"

+ // it again; its fix round 1 re-pins Reconcile (the known-account guard),

+ // which moves it once more.

+ seal = "7f98c73860397592334df34740815c20879af64bb80dbbac4746b5e56004d5b6"

errs := append(compareRootReads(got, inv), checkRootReadLegacy(inv, seal)...)

errs = append(errs, checkRootReadDeclarations(got, inv)...)

if len(errs) > 0 {

diff --git a/internal/provision/self_serve_moves1_census_test.go b/internal/provision/self_serve_moves1_census_test.go

index 75dae9490..07f5b258c 100644

--- a/internal/provision/self_serve_moves1_census_test.go

+++ b/internal/provision/self_serve_moves1_census_test.go

@@ -172,6 +172,11 @@ package provision

// rootRestartRequestSource.target and .creation and

// rootUpdateSource.resolve read through ReadRecordJudged with the

// source's judge. Reads only.

+// - Fix round 1: Reconcile re-pinned (the removal phase's known-account

+// guard; the pass arms its own context); the claims-on host key-sites

+// rootGenerationSource.resolve and generationRequiredInventory read

+// through ReadRecordJudged with the context's judge (nil there). No write

+// site added.

func plan14SelfServeMoves1WriteCensusInventory() []censusEntry {

removed := []struct{ file, unit string }{

{"internal/provision/provision.go", "GetRecordETag"},

@@ -209,6 +214,8 @@ func plan14SelfServeMoves1WriteCensusInventory() []censusEntry {

{"internal/provision/seedreconcile.go", "journalRecord"},

{"internal/provision/seedrollback.go", "cleanUpImport"},

{"internal/provision/seedrollback.go", "journalRecordByKey"},

+ {"internal/host/rootgeneration_requirements.go", "generationRequiredInventory"},

+ {"internal/host/rootgenerations_launch.go", "rootGenerationSource.resolve"},

}

added := []censusEntry{

{"internal/provision/provision.go", "updateRecordSeeding", "record-writer", "key:RecordKey,key:WriteRecord", "0bd38721d7cc97f37dbe8f37803f89d3e6efdaf29f9d6542a1d1b4d8eb370a3e"},

@@ -259,12 +266,14 @@ func plan14SelfServeMoves1WriteCensusInventory() []censusEntry {

{"internal/host/rootupdates.go", "rootUpdateSource.resolve", "key-site", "key:RecordKey", "a9bb5ed9c1b9071b00ff2f3f5bb214cf490cf21504549fea50fda279c708ed44"},

{"internal/host/runs.go", "runsWorker.pickup", "record-writer", "key:SetRecordRun", "462358cebd1c89f2c9fafa4cfdf8a93487ddbb9dfb520c7744938f106f2b2006"},

{"internal/host/seedwiring.go", "seedPlacedHook", "record-writer", "key:SetRecordSeed", "16919dae2f43919610d0e18097cf054a9082897ec239fdbaee444d4f78bd37f0"},

- {"internal/provision/reconcile.go", "Reconcile", "key-site", "key:ParseRecordKey,key:RecordKey,lit:instances", "48d3702ed9280077b5973b997a44109cb54fa1dc2a0b31e731187c9c676daa78"},

+ {"internal/provision/reconcile.go", "Reconcile", "key-site", "key:ParseRecordKey,key:RecordKey,lit:instances", "0549d50e56f63d695afae392062a304fbc671646ce90d2f22b7b6fc74f83d006"},

{"internal/provision/seedreconcile.go", "journalPass", "key-site", "key:RecordKey", "90c1d7db21ce78f4e6dfc871f44afff1da34cba9a01ec35d60dac8d7fd21cb7c"},

{"internal/provision/seedreconcile.go", "journalRecord", "key-site", "key:RecordKey", "6d2be83a87dee789c8fe6dff056ede2d341afd141ae703cda64992740749568a"},

{"internal/provision/seedrollback.go", "cleanUpImport", "record-writer", "key:SetRecordSeed", "19c33612f01046c9de64bfca596cbba862f144365abc428e315acb4e63db8b21"},

{"internal/provision/seedrollback.go", "journalRecordByKey", "key-site", "key:RecordKey", "cb15f26875f21280b080611d5978b3f97e2e802b823a4f2d61f30d047e607e69"},

{"internal/provision/seedrollback.go", "journalRecordJudged", "key-site", "key:ParseRecordKey,key:RecordKey", "920d7af0c8cfb35a8890845793cb9daa44ea3f91d5881051e7f214f9c9d9369a"},

+ {"internal/host/rootgeneration_requirements.go", "generationRequiredInventory", "key-site", "key:RecordKey", "e1d05dbe1b9eb564fd36af7387ada592e25890b53f8de30d82d9250baca85040"},

+ {"internal/host/rootgenerations_launch.go", "rootGenerationSource.resolve", "key-site", "key:RecordKey", "83709d0cb22958a52060bf1b124f859e4b51c070ac0f2af02ca6748820d22037"},

}

entries := plan14ClaimRosterBindingWriteCensusInventory()

for _, r := range removed {

diff --git a/internal/provision/testdata/plan14-root-reads-self-serve-moves-1.tsv b/internal/provision/testdata/plan14-root-reads-self-serve-moves-1.tsv

index 379dc881f..c54f6ace0 100644

--- a/internal/provision/testdata/plan14-root-reads-self-serve-moves-1.tsv

+++ b/internal/provision/testdata/plan14-root-reads-self-serve-moves-1.tsv

@@ -1,5 +1,5 @@

# Census overlay self-serve-moves-1, marked rev3=PROPOSED-self-serve-moves-1 (not an accepted ruling; docs/superpowers/notes/census-proposal-self-serve-moves-1.md). Task 1 adds the lifetime fields to provision.Record (incarnation, incarnation_migrating, move_seq, retired) and internal/provision/lifetime.go (the host incarnation slot, the lifetime verdict, the tombstone body, GetRecordRaw); GetRecordETag now hides a tombstone. Envelope only: no new root read, class or task, and the registry schema (@fields) is unchanged because Record is not a registry struct. internal/provision is re-pinned over the new code. The seal stands.

-@coverage internal/provision 88e46bd0a039351397c27fb4dc6ab31db8ce099b17461dc2e719dd0ff3f406c4

+@coverage internal/provision 98306ea59c79bac957db9add654b2905b567a2c459ff3ca650cbc9af32dbe784

# Task 2 and fix round 1: rev3=PROPOSED-self-serve-moves-1 throughout; all dispositions below await the human census ruling. Console SQL and randomness run as carlos-console under console.service; no root decision is added. Existing legacy rows are re-frozen at this boundary, and the two constructors lose their own read sites to insertAppRow.

# The H3 removal syntax requires the census-ruling- prefix; PROPOSED in those tokens is deliberate and does not claim approval.

@legacy 296610cb0201ccb67b21152a50191b8b819f41e1d39fd43ca8b8d35cd75a2601 internal/console/lifetimes_store.go Store.BeginAllocation legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-1;basis=console.service user carlos-console, J4 root-input: inserts one pending allocation in the console SQLite store, carrying the account, app and app lifetime; no bucket or root action file:Exec@132 7c7cb202595de014e2a549ebb001ae2c0afd800fc7959a6b5e145f5c1bc9c8ef

@@ -74,7 +74,7 @@ internal/console/lifetimes_store.go Store.ConvertRetirementKind legacy accepted-

@legacy 1fd9608bc83e53fa767adb28b116414434d5bd87a480b15181a12d3c763f95ec internal/domains/reconcile.go Reconcile legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-1;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos), from its domains loop: the seeded-instances body (a trashed app's route kept while an import on its host is journaled, deleted only if the row is still the one listed); self-serve moves 1 Task 4 removes the claims-off 1d auto-purge, so a claims-off box destroys no app objects and a host-claim box only requests the claim's purge as before; the registry reads are unchanged registry:Account@5579,registry:Account@5775,registry:App@10116,registry:App@11452,registry:App@13691,registry:App@5380,registry:App@5528,registry:App@7191,registry:App@7248,registry:App@7449,registry:App@7662,registry:App@7900,registry:App@8090,registry:Canary@10060,registry:Canary@12738,registry:Canary@13582,registry:Channel@11507,registry:Channel@12715,registry:Channel@13613,registry:Channel@13700,registry:Channel@14003,registry:Host@10023,registry:Host@10702,registry:Host@13738,registry:Host@13823,registry:Host@13994,registry:Host@5650,registry:Host@5736,registry:Host@7298,registry:Host@7440,registry:Host@7653,registry:Host@7891,registry:Host@8081,registry:Kind@12381,registry:Platform@10044,registry:Platform@13567,whole:Route@10005,whole:Route@10111,whole:Route@10172,whole:Route@10378,whole:Route@10394,whole:Route@10520,whole:Route@10548,whole:Route@10714,whole:Route@10730,whole:Route@10738,whole:Route@11437,whole:Route@11490,whole:Route@11647,whole:Route@11663,whole:Route@12708,whole:Route@12778,whole:Route@12947,whole:Route@12963,whole:Route@12971,whole:Route@13522,whole:Route@13553,whole:Route@13686,whole:Route@13841,whole:Route@13855,whole:Route@13861,whole:Route@14033,whole:Route@14047,whole:Route@14053,whole:Route@14061,whole:Route@14070,whole:Route@5366,whole:Route@5380,whole:Route@5510,whole:Route@5528,whole:Route@5579,whole:Route@5650,whole:Route@5736,whole:Route@5775,whole:Route@7144,whole:Route@7176,whole:Route@7243,whole:Route@7469,whole:Route@7487,whole:Route@7497,whole:Route@7563,whole:Route@7680,whole:Route@7698,whole:Route@7708,whole:Route@7913,whole:Route@7931,whole:Route@7941,whole:Route@8119,whole:Route@8137,whole:Route@8147,whole:Route@8157,whole:Route@8166 9ee4958e2acd7313769f764102349ba0e6435c5dd895e9ac8e6c0f794734a7a4

internal/domains/reconcile.go Reconcile legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-1;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos), from its domains loop: the seeded-instances body (a trashed app's route kept while an import on its host is journaled, deleted only if the row is still the one listed); self-serve moves 1 Task 4 removes the claims-off 1d auto-purge, so a claims-off box destroys no app objects and a host-claim box only requests the claim's purge as before; the registry reads are unchanged registry:Account@5579,registry:Account@5775,registry:App@10116,registry:App@11452,registry:App@13691,registry:App@5380,registry:App@5528,registry:App@7191,registry:App@7248,registry:App@7449,registry:App@7662,registry:App@7900,registry:App@8090,registry:Canary@10060,registry:Canary@12738,registry:Canary@13582,registry:Channel@11507,registry:Channel@12715,registry:Channel@13613,registry:Channel@13700,registry:Channel@14003,registry:Host@10023,registry:Host@10702,registry:Host@13738,registry:Host@13823,registry:Host@13994,registry:Host@5650,registry:Host@5736,registry:Host@7298,registry:Host@7440,registry:Host@7653,registry:Host@7891,registry:Host@8081,registry:Kind@12381,registry:Platform@10044,registry:Platform@13567,whole:Route@10005,whole:Route@10111,whole:Route@10172,whole:Route@10378,whole:Route@10394,whole:Route@10520,whole:Route@10548,whole:Route@10714,whole:Route@10730,whole:Route@10738,whole:Route@11437,whole:Route@11490,whole:Route@11647,whole:Route@11663,whole:Route@12708,whole:Route@12778,whole:Route@12947,whole:Route@12963,whole:Route@12971,whole:Route@13522,whole:Route@13553,whole:Route@13686,whole:Route@13841,whole:Route@13855,whole:Route@13861,whole:Route@14033,whole:Route@14047,whole:Route@14053,whole:Route@14061,whole:Route@14070,whole:Route@5366,whole:Route@5380,whole:Route@5510,whole:Route@5528,whole:Route@5579,whole:Route@5650,whole:Route@5736,whole:Route@5775,whole:Route@7144,whole:Route@7176,whole:Route@7243,whole:Route@7469,whole:Route@7487,whole:Route@7497,whole:Route@7563,whole:Route@7680,whole:Route@7698,whole:Route@7708,whole:Route@7913,whole:Route@7931,whole:Route@7941,whole:Route@8119,whole:Route@8137,whole:Route@8147,whole:Route@8157,whole:Route@8166 9ee4958e2acd7313769f764102349ba0e6435c5dd895e9ac8e6c0f794734a7a4

@coverage internal/domains f0f68ddee74e459f4416359b4b5d8c911d6c0850d70032bd7346c6b82f1a0885

-@coverage internal/host df8acb8644163e065d60791001022292e834e44bb8f1f36dbef151529e7a487a

+@coverage internal/host ed0cc0e694a8ead96c79849846e3530539019738297c94e94beb4154b59bc24d

@coverage internal/release 99ef7ef9b58b82e6fb4b22a6e378a04d8fd9cccafe1f8726710b8181058ec065

# Task 6b (consumers observe the lifetime: the provision reconcile and import journal, the host wiring and readers), rev3=PROPOSED-self-serve-moves-1: every changed unit re-pinned at its class and task with a reviewed basis; legacy units keep accepted-legacy and take a new frozen fingerprint (the seal moves); the four units with no read left re-pinned at their declarations; seedrollback.go journalRecordJudged added as accepted-legacy beside journalRecordByKey. All rows await the human census ruling.

internal/host/agent.go fastConvergeLoop authority B3 rev3=PROPOSED-self-serve-moves-1;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): every pass context carries the box's lifetime judge (provision.WithLifetimes) and the reconcile config is boxProvisionConfig's; read sites unchanged, offsets moved; B3 authority retained whole:Route@8998,whole:Route@9561 39b7265a91b264ed18defad5ac83c7e2ef39f3c66b0ab4cb4eaabde3a890ded1

@@ -110,8 +110,8 @@ internal/host/seedwiring.go wireSeedPlacement legacy accepted-legacy accepted-le

internal/host/steering_loop.go steeredRoutesFromRecords legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-1;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos), its steering loop: lists records through ListAllRecordsStrictJudged with the pass context's judge; read sites unchanged whole:Route@478,whole:Route@491,whole:Route@579 c91bc40c617bb8614399bb83bc77b50ad51f5487c3d58377fb6f1ff4d1487ab1

@legacy 5cf28be5216e162243606ab2b6f3bb1ec097eb291ca24a4b138fd0fc9f971936 internal/host/steering_loop.go steeringLoop legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-1;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): its context and each duty's carry the box's lifetime judge; read sites unchanged, offsets moved whole:Route@1410 1bd8e85cd2a4499f758eb9063bc5b6dfdb8614481739f39a52a80c426940cc30

internal/host/steering_loop.go steeringLoop legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-1;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): its context and each duty's carry the box's lifetime judge; read sites unchanged, offsets moved whole:Route@1410 1bd8e85cd2a4499f758eb9063bc5b6dfdb8614481739f39a52a80c426940cc30

-@legacy 0b4d5a9df2ffc67688a5e6a93bff625fcecb9aabc439089272541dd07f9984d5 internal/provision/reconcile.go Reconcile legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-1;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos), from its reconcile loops: each listed record is observed through the box's lifetime judge (ObserveWith: the record, then its host incarnation slot) before the shape, channel and scope checks, a stale record is left out and an unjudgeable one protected; the removal phase observes a row's own record key when the pass holds none for it under that key, and deletes a held row whose record is gone or stale through DeleteIfHold; a nil judge (claims on) is main's body; registry read sites unchanged, offsets moved registry:Account@20984,registry:Account@22076,registry:Account@35972,registry:Account@36161,registry:Account@36207,registry:Account@36316,registry:Account@36696,registry:Account@37289,registry:Account@37660,registry:Account@37706,registry:App@20957,registry:App@22049,registry:App@35984,registry:App@36181,registry:App@36219,registry:App@36336,registry:App@36708,registry:App@37301,registry:App@37680,registry:App@37718,registry:ClaimOwnership@21571,registry:DBPath@27772,registry:DBPath@27787,registry:DBPath@28033,registry:DBPath@28564,registry:DBPath@28577,registry:Gate@24712,registry:Gate@24852,registry:Gate@25117,registry:Hibernate@23690,registry:Hibernate@24008,registry:Hibernate@24359,registry:Hibernate@24647,registry:HoldOp@38801,registry:HoldOp@38892,registry:HoldOp@39027,registry:HoldOp@39308,registry:Host@14861,registry:Host@35887,registry:Host@35992,registry:Host@36031,registry:Host@36716,registry:Host@36919,registry:Host@37548,registry:Host@37806,registry:Host@37921,registry:Host@38275,registry:Host@38372,registry:Host@38508,registry:Host@38883,registry:Host@39018,registry:Host@39189,registry:Host@39299,registry:Host@39474,registry:Host@39576,registry:Kind@21713,registry:Kind@21976,registry:Kind@27690,registry:Kind@27703,registry:Kind@27813,registry:Kind@27826,registry:Kind@28475,registry:Kind@28486,registry:Kind@34875,registry:Kind@38499,registry:Kind@39009,registry:Kind@39290,registry:Kind@39465,registry:Kind@39567,registry:Pool@34967,registry:Provisioned@20933,registry:Provisioned@22025,registry:Provisioned@34925,registry:Region@34956,registry:Replication@24093,registry:Replication@24220,registry:Seed@26192,registry:SeedSource@25697,registry:Socket@27738,registry:Socket@27753,registry:Socket@28050,registry:Socket@28534,registry:Socket@28547,registry:Unit@27656,registry:Unit@27669,registry:Unit@28501,registry:Unit@28512,whole:ClaimOwnership@21574,whole:ClaimOwnership@21591,whole:Route@14843,whole:Route@14854,whole:Route@14872,whole:Route@15972,whole:Route@16272,whole:Route@16279,whole:Route@16319,whole:Route@16680,whole:Route@16998,whole:Route@17859,whole:Route@18215,whole:Route@18224,whole:Route@18270,whole:Route@20578,whole:Route@21049,whole:Route@21059,whole:Route@21416,whole:Route@21423,whole:Route@21491,whole:Route@21814,whole:Route@22457,whole:Route@23780,whole:Route@27882,whole:Route@29361,whole:Route@29406,whole:Route@29416,whole:Route@30279,whole:Route@31031,whole:Route@34323,whole:Route@34992,whole:Route@39387 48d3702ed9280077b5973b997a44109cb54fa1dc2a0b31e731187c9c676daa78

-internal/provision/reconcile.go Reconcile legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-1;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos), from its reconcile loops: each listed record is observed through the box's lifetime judge (ObserveWith: the record, then its host incarnation slot) before the shape, channel and scope checks, a stale record is left out and an unjudgeable one protected; the removal phase observes a row's own record key when the pass holds none for it under that key, and deletes a held row whose record is gone or stale through DeleteIfHold; a nil judge (claims on) is main's body; registry read sites unchanged, offsets moved registry:Account@20984,registry:Account@22076,registry:Account@35972,registry:Account@36161,registry:Account@36207,registry:Account@36316,registry:Account@36696,registry:Account@37289,registry:Account@37660,registry:Account@37706,registry:App@20957,registry:App@22049,registry:App@35984,registry:App@36181,registry:App@36219,registry:App@36336,registry:App@36708,registry:App@37301,registry:App@37680,registry:App@37718,registry:ClaimOwnership@21571,registry:DBPath@27772,registry:DBPath@27787,registry:DBPath@28033,registry:DBPath@28564,registry:DBPath@28577,registry:Gate@24712,registry:Gate@24852,registry:Gate@25117,registry:Hibernate@23690,registry:Hibernate@24008,registry:Hibernate@24359,registry:Hibernate@24647,registry:HoldOp@38801,registry:HoldOp@38892,registry:HoldOp@39027,registry:HoldOp@39308,registry:Host@14861,registry:Host@35887,registry:Host@35992,registry:Host@36031,registry:Host@36716,registry:Host@36919,registry:Host@37548,registry:Host@37806,registry:Host@37921,registry:Host@38275,registry:Host@38372,registry:Host@38508,registry:Host@38883,registry:Host@39018,registry:Host@39189,registry:Host@39299,registry:Host@39474,registry:Host@39576,registry:Kind@21713,registry:Kind@21976,registry:Kind@27690,registry:Kind@27703,registry:Kind@27813,registry:Kind@27826,registry:Kind@28475,registry:Kind@28486,registry:Kind@34875,registry:Kind@38499,registry:Kind@39009,registry:Kind@39290,registry:Kind@39465,registry:Kind@39567,registry:Pool@34967,registry:Provisioned@20933,registry:Provisioned@22025,registry:Provisioned@34925,registry:Region@34956,registry:Replication@24093,registry:Replication@24220,registry:Seed@26192,registry:SeedSource@25697,registry:Socket@27738,registry:Socket@27753,registry:Socket@28050,registry:Socket@28534,registry:Socket@28547,registry:Unit@27656,registry:Unit@27669,registry:Unit@28501,registry:Unit@28512,whole:ClaimOwnership@21574,whole:ClaimOwnership@21591,whole:Route@14843,whole:Route@14854,whole:Route@14872,whole:Route@15972,whole:Route@16272,whole:Route@16279,whole:Route@16319,whole:Route@16680,whole:Route@16998,whole:Route@17859,whole:Route@18215,whole:Route@18224,whole:Route@18270,whole:Route@20578,whole:Route@21049,whole:Route@21059,whole:Route@21416,whole:Route@21423,whole:Route@21491,whole:Route@21814,whole:Route@22457,whole:Route@23780,whole:Route@27882,whole:Route@29361,whole:Route@29406,whole:Route@29416,whole:Route@30279,whole:Route@31031,whole:Route@34323,whole:Route@34992,whole:Route@39387 48d3702ed9280077b5973b997a44109cb54fa1dc2a0b31e731187c9c676daa78

+@legacy b67404b40b964e1938c788e27a79f68c391907784a8260708bcf4cb9b61be4f1 internal/provision/reconcile.go Reconcile legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-1;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos), from its reconcile loops: each listed record is observed through the box's lifetime judge (ObserveWith: the record, then its host incarnation slot) before the shape, channel and scope checks, a stale record is left out and an unjudgeable one protected; the removal phase observes a row's own record key when the pass holds none for it under that key, and deletes a held row whose record is gone or stale through DeleteIfHold; a nil judge (claims on) is main's body; registry read sites unchanged, offsets moved; fix round 1: the removal phase observes a row's own key only under an account the listing trusts, so a retired or unmaterialised account's row keeps record gone, and the pass arms its own context with the judge registry:Account@21148,registry:Account@22240,registry:Account@36136,registry:Account@36325,registry:Account@36371,registry:Account@36480,registry:Account@36522,registry:Account@37075,registry:Account@37668,registry:Account@38039,registry:Account@38085,registry:App@21121,registry:App@22213,registry:App@36148,registry:App@36345,registry:App@36383,registry:App@36500,registry:App@37087,registry:App@37680,registry:App@38059,registry:App@38097,registry:ClaimOwnership@21735,registry:DBPath@27936,registry:DBPath@27951,registry:DBPath@28197,registry:DBPath@28728,registry:DBPath@28741,registry:Gate@24876,registry:Gate@25016,registry:Gate@25281,registry:Hibernate@23854,registry:Hibernate@24172,registry:Hibernate@24523,registry:Hibernate@24811,registry:HoldOp@39180,registry:HoldOp@39271,registry:HoldOp@39406,registry:HoldOp@39687,registry:Host@15025,registry:Host@36051,registry:Host@36156,registry:Host@36195,registry:Host@37095,registry:Host@37298,registry:Host@37927,registry:Host@38185,registry:Host@38300,registry:Host@38654,registry:Host@38751,registry:Host@38887,registry:Host@39262,registry:Host@39397,registry:Host@39568,registry:Host@39678,registry:Host@39853,registry:Host@39955,registry:Kind@21877,registry:Kind@22140,registry:Kind@27854,registry:Kind@27867,registry:Kind@27977,registry:Kind@27990,registry:Kind@28639,registry:Kind@28650,registry:Kind@35039,registry:Kind@38878,registry:Kind@39388,registry:Kind@39669,registry:Kind@39844,registry:Kind@39946,registry:Pool@35131,registry:Provisioned@21097,registry:Provisioned@22189,registry:Provisioned@35089,registry:Region@35120,registry:Replication@24257,registry:Replication@24384,registry:Seed@26356,registry:SeedSource@25861,registry:Socket@27902,registry:Socket@27917,registry:Socket@28214,registry:Socket@28698,registry:Socket@28711,registry:Unit@27820,registry:Unit@27833,registry:Unit@28665,registry:Unit@28676,whole:ClaimOwnership@21738,whole:ClaimOwnership@21755,whole:Route@15007,whole:Route@15018,whole:Route@15036,whole:Route@16136,whole:Route@16436,whole:Route@16443,whole:Route@16483,whole:Route@16844,whole:Route@17162,whole:Route@18023,whole:Route@18379,whole:Route@18388,whole:Route@18434,whole:Route@20742,whole:Route@21213,whole:Route@21223,whole:Route@21580,whole:Route@21587,whole:Route@21655,whole:Route@21978,whole:Route@22621,whole:Route@23944,whole:Route@28046,whole:Route@29525,whole:Route@29570,whole:Route@29580,whole:Route@30443,whole:Route@31195,whole:Route@34487,whole:Route@35156,whole:Route@39766 0549d50e56f63d695afae392062a304fbc671646ce90d2f22b7b6fc74f83d006

+internal/provision/reconcile.go Reconcile legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-1;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos), from its reconcile loops: each listed record is observed through the box's lifetime judge (ObserveWith: the record, then its host incarnation slot) before the shape, channel and scope checks, a stale record is left out and an unjudgeable one protected; the removal phase observes a row's own record key when the pass holds none for it under that key, and deletes a held row whose record is gone or stale through DeleteIfHold; a nil judge (claims on) is main's body; registry read sites unchanged, offsets moved; fix round 1: the removal phase observes a row's own key only under an account the listing trusts, so a retired or unmaterialised account's row keeps record gone, and the pass arms its own context with the judge registry:Account@21148,registry:Account@22240,registry:Account@36136,registry:Account@36325,registry:Account@36371,registry:Account@36480,registry:Account@36522,registry:Account@37075,registry:Account@37668,registry:Account@38039,registry:Account@38085,registry:App@21121,registry:App@22213,registry:App@36148,registry:App@36345,registry:App@36383,registry:App@36500,registry:App@37087,registry:App@37680,registry:App@38059,registry:App@38097,registry:ClaimOwnership@21735,registry:DBPath@27936,registry:DBPath@27951,registry:DBPath@28197,registry:DBPath@28728,registry:DBPath@28741,registry:Gate@24876,registry:Gate@25016,registry:Gate@25281,registry:Hibernate@23854,registry:Hibernate@24172,registry:Hibernate@24523,registry:Hibernate@24811,registry:HoldOp@39180,registry:HoldOp@39271,registry:HoldOp@39406,registry:HoldOp@39687,registry:Host@15025,registry:Host@36051,registry:Host@36156,registry:Host@36195,registry:Host@37095,registry:Host@37298,registry:Host@37927,registry:Host@38185,registry:Host@38300,registry:Host@38654,registry:Host@38751,registry:Host@38887,registry:Host@39262,registry:Host@39397,registry:Host@39568,registry:Host@39678,registry:Host@39853,registry:Host@39955,registry:Kind@21877,registry:Kind@22140,registry:Kind@27854,registry:Kind@27867,registry:Kind@27977,registry:Kind@27990,registry:Kind@28639,registry:Kind@28650,registry:Kind@35039,registry:Kind@38878,registry:Kind@39388,registry:Kind@39669,registry:Kind@39844,registry:Kind@39946,registry:Pool@35131,registry:Provisioned@21097,registry:Provisioned@22189,registry:Provisioned@35089,registry:Region@35120,registry:Replication@24257,registry:Replication@24384,registry:Seed@26356,registry:SeedSource@25861,registry:Socket@27902,registry:Socket@27917,registry:Socket@28214,registry:Socket@28698,registry:Socket@28711,registry:Unit@27820,registry:Unit@27833,registry:Unit@28665,registry:Unit@28676,whole:ClaimOwnership@21738,whole:ClaimOwnership@21755,whole:Route@15007,whole:Route@15018,whole:Route@15036,whole:Route@16136,whole:Route@16436,whole:Route@16443,whole:Route@16483,whole:Route@16844,whole:Route@17162,whole:Route@18023,whole:Route@18379,whole:Route@18388,whole:Route@18434,whole:Route@20742,whole:Route@21213,whole:Route@21223,whole:Route@21580,whole:Route@21587,whole:Route@21655,whole:Route@21978,whole:Route@22621,whole:Route@23944,whole:Route@28046,whole:Route@29525,whole:Route@29570,whole:Route@29580,whole:Route@30443,whole:Route@31195,whole:Route@34487,whole:Route@35156,whole:Route@39766 0549d50e56f63d695afae392062a304fbc671646ce90d2f22b7b6fc74f83d006

@legacy 19c8800007a0fa83aaea5107fb40f5b9dd351f849a502ee5bd3dc901ba3cdd98 internal/provision/reconcile.go holdExisting legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-1;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos), from the reconcile pass under the host's hold lock: the record re-read is the judge's observation, so a record its slot no longer vouches for asks for no hold; registry read sites unchanged, offsets moved registry:Account@640,registry:Account@795,registry:App@613,registry:App@781,registry:HoldOp@333,registry:HoldOp@371,registry:HoldOp@489,registry:Provisioned@589,registry:Status@2228,registry:Status@472 cb2a45c9081f7f01c43fd335a06da77cc528066c7fbed93eddb922dbb1ec7a9b

internal/provision/reconcile.go holdExisting legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-1;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos), from the reconcile pass under the host's hold lock: the record re-read is the judge's observation, so a record its slot no longer vouches for asks for no hold; registry read sites unchanged, offsets moved registry:Account@640,registry:Account@795,registry:App@613,registry:App@781,registry:HoldOp@333,registry:HoldOp@371,registry:HoldOp@489,registry:Provisioned@589,registry:Status@2228,registry:Status@472 cb2a45c9081f7f01c43fd335a06da77cc528066c7fbed93eddb922dbb1ec7a9b

@legacy 486e6002eaf3bc4548e64ee0b2a8fe4b4598731fca9af21dfdced2e75f8485cb internal/provision/seedreconcile.go journalPass legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-1;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos), from the reconcile pass: hands the box's judge to journalRecord; read sites unchanged, offsets moved registry:Host@1689,registry:Host@1926,registry:Host@2260,registry:Host@2635,registry:Host@3140,registry:Host@3334,registry:Host@3379,registry:Host@3470,registry:Host@3597,registry:Host@3631,registry:Host@3736,registry:Host@3929,registry:Host@533,registry:Host@558,registry:Host@765,registry:RecordKey@2154,registry:RecordKey@2282,registry:SeedID@1697,registry:SeedID@1934,registry:SeedID@2268,registry:SeedID@2643,registry:SeedID@2786,registry:SeedID@3148,registry:SeedID@3387,registry:SeedID@3605,registry:SeedID@3937,registry:SeedID@773,registry:State@1707,registry:State@2363,registry:State@2653,whole:ImportJournal@1778,whole:ImportJournal@2476,whole:ImportJournal@2831,whole:ImportJournal@2990,whole:ImportJournal@514 90c1d7db21ce78f4e6dfc871f44afff1da34cba9a01ec35d60dac8d7fd21cb7c

@@ -124,3 +124,7 @@ internal/provision/seedrollback.go cleanUpImport legacy accepted-legacy accepted

internal/provision/seedrollback.go journalRecordByKey legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-1;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos), from the reconcile pass: a nil judge reads the key exactly as main; a judge hands the read to journalRecordJudged; read sites unchanged, offsets moved registry:Host@415,registry:RecordKey@225,registry:RecordKey@464,registry:RecordKey@534,whole:ImportJournal@185 cb15f26875f21280b080611d5978b3f97e2e802b823a4f2d61f30d047e607e69

@legacy c044327c58ad5f084e05fd84254848c3fae2f641d0b8e464505dde28a0e36829 internal/provision/seedrollback.go journalRecordJudged legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-1;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos), from the reconcile pass: the journal row's own Host and RecordKey (as journalRecordByKey reads them) name the record observed under the box's judge; stale or absent is gone, corrupt or unjudgeable an error; no new root decision registry:Host@409,registry:Host@491,registry:RecordKey@176,registry:RecordKey@243,registry:RecordKey@381,registry:RecordKey@478 920d7af0c8cfb35a8890845793cb9daa44ea3f91d5881051e7f214f9c9d9369a

internal/provision/seedrollback.go journalRecordJudged legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-1;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos), from the reconcile pass: the journal row's own Host and RecordKey (as journalRecordByKey reads them) name the record observed under the box's judge; stale or absent is gone, corrupt or unjudgeable an error; no new root decision registry:Host@409,registry:Host@491,registry:RecordKey@176,registry:RecordKey@243,registry:RecordKey@381,registry:RecordKey@478 920d7af0c8cfb35a8890845793cb9daa44ea3f91d5881051e7f214f9c9d9369a

+# Task 6b fix round 1, rev3=PROPOSED-self-serve-moves-1: reconcile.go Reconcile re-pinned in place (the removal phase's known-account guard and its own WithLifetimes); three claims-on host record reads become judged readers with the context's judge (nil there: unchanged) and are re-pinned at their classes; envelopes refreshed in place; the seal moves.

+internal/host/relocatepass.go channelRelease hint E1 rev3=PROPOSED-self-serve-moves-1;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos), its relocation pass (claims on): the holder's record is read through judgedRecord with the context's judge, nil on a claims-on box, so the read is GetRecord as before; read sites unchanged; the preceding hint E1 classification retained file:Read@191 802486e10dad06c5bb1df7168362d1aa5d2790c29c8822802663320f387e83e9

+internal/host/rootgenerations_launch.go rootGenerationSource.resolve authority E2 rev3=PROPOSED-self-serve-moves-1;basis=root adopt/update/control uid 0 under release and host exclusion (claims on): the canonical record is read through ReadRecordJudged with the context's judge, nil there, so the read is GetRecordETag as before; read sites unchanged; the preceding E2 classification retained file:Open@2530 83709d0cb22958a52060bf1b124f859e4b51c070ac0f2af02ca6748820d22037

+internal/host/rootgeneration_requirements.go generationRequiredInventory authority E2 rev3=PROPOSED-self-serve-moves-1;basis=root adopt/update/control uid 0 (claims on): the canonical record is read through ReadRecordJudged with the context's judge, nil there, so the read is GetRecordETag as before; no root read in the unit; E2 retained e1d05dbe1b9eb564fd36af7387ada592e25890b53f8de30d82d9250baca85040