carlos / platform Public

provision: census for the final review's fix round (console half, and the host implementer's re-pins)

Root reads: issueSelfServeRequest, migrateSelfServe and selfServeRequest
re-pinned in place (F9, F10); ConfirmSelfServeRequestLanded frozen with
ConfirmSelfServeRequest's statement, ConfirmSelfServeRequest's row removed
under a proposed H3 disposition; the internal/console, internal/moves,
internal/alerting and internal/host envelopes re-pinned; the seal moves to
1b87d203. Record writes: selfServeRun, reserveBoxes, offlineOpenRecord,
handleAPIInstanceOfflineReturn and the host's writeReturnReport re-pinned.
The console's return index deleter (deleteReturnIndexEntry, F6) is a new
writer outside the census's Put family, recorded PROPOSED in the inventory
comment and the census note.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude 1 day ago fcef25ae55b42802e6a11e52f35fcf2cf0c93ab9 parent f7d3fe3

4 files changed, +57 −17

docs/superpowers/notes/census-proposal-self-serve-moves-2.md +2 −0
internal/provision/plan14_root_reads_test.go +8 −2
internal/provision/self_serve_moves2_census_test.go +33 −5
internal/provision/testdata/plan14-root-reads-self-serve-moves-2.tsv +14 −10

diff --git a/docs/superpowers/notes/census-proposal-self-serve-moves-2.md b/docs/superpowers/notes/census-proposal-self-serve-moves-2.md

index 1cc630ad2..85df8a005 100644

--- a/docs/superpowers/notes/census-proposal-self-serve-moves-2.md

+++ b/docs/superpowers/notes/census-proposal-self-serve-moves-2.md

@@ -49,3 +49,5 @@ Task 9 fix round 2 adds no root read, class or task and no record write. `Server

Task 10b (the fourteen named end-to-end witnesses) adds no root read, class or task, no record write and no writer, and changes no production unit. It adds two test seams. `console.TestHooks.LifetimesOn` (`internal/console/testhooks.go`) reads the cutover marker through `readCutoverMarker`, the watcher's own reader, and activates the gate past the settle, so a witness can call the member's request door (which admits only with lifetimes on). Only `internal/e2e/selfserve` calls it, under the e2e build tag. `host.BoxHandle.OptDir` (`internal/host/e2e_bridge.go`) answers the test box's opt directory, a field. The witnesses themselves write only from test code: the cutover marker, a foreign open record, a damaged sealed archive in the loopback data bucket, active.json entries and records of other hosts. In the root-read overlay the `internal/console` and `internal/host` envelopes are re-pinned in place, and the seal stands. The writers list above is unchanged.

Task 10b fix round 1 changes how the end-to-end bridge arms a box's instance id. Each box now arms it as `armMovesPass` arms the agent's: a per-process cache of the metadata answer, shaped like `cachedInstanceID`, read once at arm and then lazily through `throttledInstanceID`. `E2E.status` publishes the cached id in the status block, as the agent's status tick does. In the root-read overlay `E2E.status` is re-pinned in place (tests only, no new read site) and the internal/host envelope is re-pinned in place. The seal moves to `9193bc80…`. The record-write inventory and the writers list are unchanged.

+The final review's fix round (console half) adds no root read, class or task and no record write, and adds one bucket writer. In the root-read overlay `Store.issueSelfServeRequest` (it also stores a queue request's staging coordinates, F10), `Store.migrateSelfServe` (three additive columns, `announce_seq`, `request_stage_bucket` and `request_stage_region`, F9 and F10) and `Store.selfServeRequest` (the coordinates read back) are re-pinned in place with their bases extended. `ConfirmSelfServeRequest`'s statement moved to `ConfirmSelfServeRequestLanded`, which also records the landed record_seq as owed its serial bump (F9), frozen accepted-legacy; `ConfirmSelfServeRequest` stays declared with no direct read, so its row is removed under a proposed H3 disposition. The internal/console, internal/moves and internal/alerting (`alerting.Armed`, F13) envelopes are re-pinned, and the internal/host envelope for the host implementer's commits (036528e6..e43e415e: F5 host half, F7, F17's clock comment). The seal moves to `1b87d203…`. In the record-write inventory five units are re-pinned in place with their writes unchanged: `Server.selfServeRun` (the owed announcement), `Server.reserveBoxes` (two lost races with no holder observed answer unreadable, F14), `Server.offlineOpenRecord` (a guard immediately before its create-only Put, the job's lease-bound context, F11), `Server.handleAPIInstanceOfflineReturn` (the request carries `target_box_id`, F6) and the host's `movesWorker.writeReturnReport` (an unreadable request is the scan's error, F5). The new writer, PROPOSED: `Server.deleteReturnIndexEntry` in `offlinereturn.go` deletes a return index entry (`control/offline-moves/@returns/<region>/<host>/<forward id>.json`) with `DeleteIfMatch` on the ETag it read, called when a return is staged or started (`offlineReturnIndexDone`) and by the pass's sweep of entries whose request is past its deadline (`selfServeReturnSweep`, once per tick under the lease, at most 32 entries). It never touches a record. The record-write census scans the Put family only (`censusMethods`), so the deleter has no inventory row; it is recorded here and in the inventory's comment. The writers list is otherwise unchanged.

diff --git a/internal/provision/plan14_root_reads_test.go b/internal/provision/plan14_root_reads_test.go

index 4a6ac607e..f0a70fa83 100644

--- a/internal/provision/plan14_root_reads_test.go

+++ b/internal/provision/plan14_root_reads_test.go

@@ -1363,8 +1363,14 @@ func TestPlan14RootReadCensus(t *testing.T) {

// part left out) and moveTimings (the floor bound) in place, which

// moves it once more. Task 10b's fix round 1 re-pins E2E.status in

// place (the bridge publishes each box's cached instance id as the

- // agent's status tick does), which moves it again.

- seal = "9193bc80e8f38382d2505c182dae0e5e8b2f367d0a16cf9d9faeac875a1e0843"

+ // agent's status tick does), which moves it again. The final review's

+ // console fix round re-pins issueSelfServeRequest, migrateSelfServe and

+ // selfServeRequest in place (the queue's staging coordinates and the

+ // owed announcement, F9 and F10), freezes ConfirmSelfServeRequestLanded

+ // (ConfirmSelfServeRequest's statement, which also records the landed

+ // sequence; ConfirmSelfServeRequest's row under a proposed H3

+ // disposition), which moves it once more.

+ seal = "1b87d203a51b2f58017d43ee3d83baddf4014aaf04f43558816b4afb468d1afd"

errs := append(compareRootReads(got, inv), checkRootReadLegacy(inv, seal)...)

errs = append(errs, checkRootReadDeclarations(got, inv)...)

if len(errs) > 0 {

diff --git a/internal/provision/self_serve_moves2_census_test.go b/internal/provision/self_serve_moves2_census_test.go

index 834606bc8..50e9e3537 100644

--- a/internal/provision/self_serve_moves2_census_test.go

+++ b/internal/provision/self_serve_moves2_census_test.go

@@ -171,6 +171,34 @@ package provision

// console SQLite only. The one new bucket access is a read: the advance

// into landed reads the move's reports (readOfflineEvidence, already a

// key-site) for the seal's sizes.

+//

+// The final review's fix round: no record write is added or made raw; five

+// units are re-pinned in place and one bucket writer is added outside the

+// census's Put family.

+// - selfserve_apply.go:Server.selfServeRun stays a record-writer

+// (key:SetRecordMoveAt) and is re-pinned: its confirmation records the

+// landed record_seq as owed its serial bump (F9); the bound write is

+// unchanged.

+// - offlinereserve.go:Server.reserveBoxes is re-pinned: two lost races

+// with no holder observed answer unreadable (F14); its Put is

+// unchanged.

+// - apiinstancemove_offline.go:Server.offlineOpenRecord is re-pinned: a

+// guard runs immediately before its create-only Put, and the job passes

+// the lease-bound context (F11); the Put is unchanged.

+// - offlinereturn.go:Server.handleAPIInstanceOfflineReturn is re-pinned:

+// the request it writes carries target_box_id, the target the door

+// selects (F6); its key and create-only Put are unchanged.

+// - movesoffline_return.go:movesWorker.writeReturnReport is re-pinned for

+// the host implementer (F5 host half): a request it cannot read is the

+// scan's error; its Put is unchanged.

+// - offlinereturn.go:Server.deleteReturnIndexEntry is a new bucket writer,

+// PROPOSED: the console deletes the return index entry

+// (control/offline-moves/@returns/<region>/<host>/<forward id>.json),

+// DeleteIfMatch on the ETag it read, when a return is staged or started

+// (offlineReturnIndexDone) and from the pass's sweep of entries past

+// their request's deadline (selfServeReturnSweep). Never a record. The

+// census scans the Put family only (censusMethods), so it has no row

+// here; it is listed in the census note.

func plan14SelfServeMoves2WriteCensusInventory() []censusEntry {

removed := []struct{ file, unit string }{

{"internal/console/apiinstancemove.go", "Server.handleAPIInstanceMoveRequest"},

@@ -196,7 +224,7 @@ func plan14SelfServeMoves2WriteCensusInventory() []censusEntry {

{"internal/console/apiinstancemove_offline.go", "Server.offlineApplyBound", "record-writer", "key:SetRecordMoveAt", "039573bfd1f3ec621474e9c761f55ce301227d812f4dd6a7d206dad0c18b9980"},

// Re-pinned by Task 5 fix round 2: an operator operation's own

// reservation is accepted whatever its keys; the one Put is unchanged.

- {"internal/console/offlinereserve.go", "Server.reserveBoxes", "nonrecord", "sel:Put", "6dabc4ca621053e3e973a40c646e65ed48cc90f654e65981d963c57f8655b8e8"},

+ {"internal/console/offlinereserve.go", "Server.reserveBoxes", "nonrecord", "sel:Put", "a4306de9d14c0f7d63dd060b4123cbc48cd987e4cef0e2a7658cc4e87549e82d"},

{"internal/console/offlinereserve.go", "Server.releaseBoxes", "nonrecord", "sel:Put", "0d7cad2d3a92890c10d7a538784713124d3659d89c872e75fbc107bf96794751"},

{"internal/console/selfserve_lease.go", "leaseToken.put", "nonrecord", "sel:Put", "e574640142eb930463ce8c4a91cd599857870311303072902ca8d98901d64fac"},

{"internal/console/server.go", "NewServer", "key-site", "lit:instances", "4a3aea119aaef70a5eb1a0e0a01c47ea8f91b1f3b121bb209624d1752e0086e3"},

@@ -214,15 +242,15 @@ func plan14SelfServeMoves2WriteCensusInventory() []censusEntry {

{"internal/host/e2e_bridge.go", "sealWorld.arm", "testsupport", "sel:Put", "501199f1f33a0539bb0e97782f87f7e8fd8b2fe345530881670e6cfb0423709f"},

{"internal/host/e2e_bridge.go", "const sealPrefix", "reference", "lit:instances", "c78134a7cd1306c1655db52559840e9e94956991b4a83d27521801fa85ad566c"},

// Task 7: the job's one record write, every transition through it.

- {"internal/console/selfserve_apply.go", "Server.selfServeRun", "record-writer", "key:SetRecordMoveAt", "748c29c143e8bba836a9ba5fcf11db3170b12e54450ae6931449900f663dc2bb"},

+ {"internal/console/selfserve_apply.go", "Server.selfServeRun", "record-writer", "key:SetRecordMoveAt", "26998a3066d61bead04f7a3c195d690c006ca35e995baadfa7f025cf37f94201"},

// Task 8: the open record, the operator return's request and

// report, their readers, and the return door's route.

- {"internal/console/apiinstancemove_offline.go", "Server.offlineOpenRecord", "foreign-recordkey", "key:OpenRecordKey,sel:Put", "8a192083d237fbf7489ac900f03da62c854dfc521ccaa31d5cc8fc7d73b2d5d7"},

+ {"internal/console/apiinstancemove_offline.go", "Server.offlineOpenRecord", "foreign-recordkey", "key:OpenRecordKey,sel:Put", "a81e93f3b42072a6a2c13cd3fcf31cdda42952cd619cdd89bac628e7c821ab90"},

{"internal/console/apiinstancemove_offline.go", "Server.readOfflineEvidence", "key-site", "key:OpenRecordKey", "09b3dd97c2e4fb9828d04e09a451a4380b1a9dc321640f6d57f18a217547af12"},

- {"internal/console/offlinereturn.go", "Server.handleAPIInstanceOfflineReturn", "nonrecord", "sel:Put", "351bf250002266f6ef071f7ea254253218305ee8ae4fd8b5dc8cc0e92dc6bf48"},

+ {"internal/console/offlinereturn.go", "Server.handleAPIInstanceOfflineReturn", "nonrecord", "sel:Put", "371ac237cfeaa2df7daa9c9c5d12ed3be3a5c81092d627f66998073824811446"},

{"internal/console/offlinereturn.go", "Server.offlineReturnIndex", "nonrecord", "sel:Put", "38f5e6d1f0781f11491d7b116a43dd8fb42d5fb3e60c66419513ec1cfb646792"},

{"internal/console/offlinereturn.go", "Server.readOpenRecord", "key-site", "key:OpenRecordKey", "809cf07d965d8bd136a1d463e5df3c435c086598359432630fa9d5fea6cd8950"},

- {"internal/host/movesoffline_return.go", "movesWorker.writeReturnReport", "nonrecord", "sel:Put", "2a22da03ff31ee930897e9953707778e28ed241d2a259aecd5fd8a352b608a86"},

+ {"internal/host/movesoffline_return.go", "movesWorker.writeReturnReport", "nonrecord", "sel:Put", "c69060efd9642f9841b67bbb5ca7ebd63cf8dbe7fa104bdeed906b1f00377701"},

{"internal/host/movesoffline_return.go", "movesWorker.readOpen", "key-site", "key:OpenRecordKey", "712d3bd4ab0850b208e9feb61c9c76ccd8eba9878711982f640b0d78910cdb47"},

{"internal/console/authcli.go", "Server.registerCLIRoutes", "key-site", "lit:instances,lit:sidecars", "0af692569c69daef180738395057594bd8413fdf6d9e1c4cc91f0a924ab3ef7b"},

}

diff --git a/internal/provision/testdata/plan14-root-reads-self-serve-moves-2.tsv b/internal/provision/testdata/plan14-root-reads-self-serve-moves-2.tsv

index 7245b27dc..5b690949e 100644

--- a/internal/provision/testdata/plan14-root-reads-self-serve-moves-2.tsv

+++ b/internal/provision/testdata/plan14-root-reads-self-serve-moves-2.tsv

@@ -23,8 +23,8 @@ internal/console/templates/settings.html external legacy accepted-legacy accepte

internal/provision/offline_move.go offlineBegin legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=root-input (J4, as OfflineStart); the console (cmd/console serve under console.service, user carlos-console): self-serve moves 1 Task 7's body (OfflineStart's, the state a parameter; a direct start advances move_seq and stamps move.seq, refusing ErrLifetimeExhausted at MaxInt64 before any write), and it now also creates the self-serve move in offline-queued for OfflineQueue (queued_at, staged_at and precheck_at at the caller's stamp, move.seq set to the record's move_seq, no advance) and records return_of; a stage and a queue hold nothing; its one site is still rec.ActiveRun.Open(), a method on the record's run state (RunState.Open), not a file read; self-serve moves 2 Task 2 file:Open@208 0a9b432ddf2f39a977c0651e377258b35c1d05635e9979583eeac6253d6c0ec8

@coverage internal/provision d018e5699137db933be2142f7526d0d1d10b08170525886bd9c424cde5578b55

# Task 3 (per-box reservations with a legacy projection and a sentinel, the fenced reclaim and the operator doors' bound admission), rev3=PROPOSED-self-serve-moves-2: no root read, class or task is added and no accepted-legacy unit is re-pinned, so the seal does not move. The new units (moves.ParseOfflineActive, moves.OfflineActiveBody, the console's offlinereserve.go, the doors' offlineApplyBound and offlineAdvanceBound) read no file: their reads are the bucket's control/offline-moves/active.json and the instance record through the judged readers and fenceRecord. Envelopes re-pinned in place (Task 2's rows replaced): internal/console (offlinereserve.go, the start and stage doors, the Server's two evidence fields) and internal/moves (the reservation table in offline.go).

-@coverage internal/console 820f672daed2bccfed1209ef3dc612c64aeefecc9011622cec7ef0613ab51e69

-@coverage internal/moves 6a61fc2680d29b8998a383c7c65756f78a06ac312279148bdde752546686cd8d

+@coverage internal/console 7a8316dd7a5333ff7b7c10a23b077de58baf4e308a768fdfe1e6e72869ad00b6

+@coverage internal/moves bcac95270e69cdea56c9af080d134cc13586be1a0b7d079928372aded9df17ac

# Task 4 (the journal, the events table, the console lease and the pass skeleton), rev3=PROPOSED-self-serve-moves-2: no root read, class or task is added. The console SQLite journal (selfserve_store.go) adds twenty-two units, each frozen accepted-legacy with a reviewed basis (console SQL as carlos-console, no bucket or root action), and the lease's console name adds one crypto/rand read (Server.selfServeConsoleID); serve (in place: the paging arm takes the store, the pass is started), NewServer (the row evidence and the recovery-mode scan) and Store.migrate (migrateSelfServe) are re-pinned. The seal moves. The lease and the pass read control/offline-moves/console.json and active.json from the bucket, not a file. Envelopes re-pinned in place: cmd/console, internal/console and internal/provision (WithWriteGuard in WriteRecord).

@legacy a8dd51a494ab3cd2ad371ded2850b6d78492569729527ea82cd8dd0f2b418a78 internal/console/selfserve_lease.go Server.selfServeConsoleID legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: reads crypto/rand once per process for the random console name the self-serve moves lease carries; randomness grants no root authority file:Read@110 3303b18ec5c77ccaf662064801f94276bfe947c31378cc1ecb8c4fe509d5d4d1

internal/console/selfserve_lease.go Server.selfServeConsoleID legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: reads crypto/rand once per process for the random console name the self-serve moves lease carries; randomness grants no root authority file:Read@110 3303b18ec5c77ccaf662064801f94276bfe947c31378cc1ecb8c4fe509d5d4d1

@@ -36,7 +36,6 @@ internal/console/selfserve_store.go Store.AbandonSelfServeRequest legacy accepte

internal/console/selfserve_store.go Store.AdmitSelfServeMove legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: inserts one self-serve move row and its first phase event in one SQLite transaction, or reads the instance's open row back; no bucket or root action; self-serve moves 2 Task 5: the row also stores the estimate (estimate_seconds, estimate_terms) the request door computed file:Exec@808,file:QueryRow@1580 121e398e82839b2894fd7a3db441b554269196c57af943b0502ce8552c07671d

@legacy c2e1ad98b9e02efa012eee032c98c16b38efbc62b4ba9ff1b52bfb0822762cd2 internal/console/selfserve_store.go Store.AdvanceSelfServe legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: advances one self-serve row's phase, predicated on the phase, the abort flag and an optional confirmed nonce it consumes, with the phase event in one SQLite transaction; no bucket or root action file:Exec@230 79b0ec7f50cf599f0661de8fbb273db6e20faf7adb95d9f6dd8e459c5a1de41e

@legacy bb4226610c6d82f9c7ca9a79e6e4132ad0150bfa1841fa8db3364c4793c97fbb internal/console/selfserve_store.go Store.ConfirmSelfServeRequest legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: marks a self-serve request confirmed, predicated on its nonce and unconsumed, unvoided, unconfirmed flags; no bucket or root action file:Exec@221 811edad437cdf69f10bd91c33daa7330bfdf92934ef10c9b7e61ba01b62e4f94

-internal/console/selfserve_store.go Store.ConfirmSelfServeRequest legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: marks a self-serve request confirmed, predicated on its nonce and unconsumed, unvoided, unconfirmed flags; no bucket or root action file:Exec@221 811edad437cdf69f10bd91c33daa7330bfdf92934ef10c9b7e61ba01b62e4f94

@legacy a68001a82e950a2786b2cf460cbdc621b440084eb0936ef9b77c6bd4afd0600c internal/console/selfserve_store.go Store.ConsumeSelfServeRequest legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: consumes a confirmed self-serve request with the next substep and deadline, predicated on its nonce; no bucket or root action; self-serve moves 2 Task 9: the UPDATE runs in one transaction with the decision's events (ssWithAlso), only when it wins file:Exec@199 8374e93bd9afe919729de068de0a45135e0f111bfeedaa1c555109903b4a8d11

internal/console/selfserve_store.go Store.ConsumeSelfServeRequest legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: consumes a confirmed self-serve request with the next substep and deadline, predicated on its nonce; no bucket or root action; self-serve moves 2 Task 9: the UPDATE runs in one transaction with the decision's events (ssWithAlso), only when it wins file:Exec@199 8374e93bd9afe919729de068de0a45135e0f111bfeedaa1c555109903b4a8d11

@legacy 2af004d044f348306bcea936da03941d474ba305eb23a04687947890ad7e8d15 internal/console/selfserve_store.go Store.FinishSelfServeMove legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: records a self-serve row's outcome, consumes its confirmed request and inserts the terminal event in one SQLite transaction, only while the row has no outcome; no bucket or root action; self-serve moves 2 Task 8: the statement also sets phase done and clears open_record_pending, and refuses a row whose request is unconfirmed file:Exec@290,file:QueryRow@922 b8171ea50d77204a37e862edb065384ed466b9ed1191a3b17bf1b536d84ce550

@@ -59,12 +58,12 @@ internal/console/selfserve_store.go Store.SetSelfServeExpiry legacy accepted-leg

internal/console/selfserve_store.go Store.UnemittedSelfServeEvents legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: lists undelivered self-serve events from the console SQLite store; no bucket or root action file:Query@94 be88efeaf911708fdc26a7ab288ff49ac04768ce0a657f1107ceb4eb4fd65d2a

@legacy 319506acaa32df215a15bbdbac67c2da01be9ec85c9e06124052397c4665397e internal/console/selfserve_store.go Store.VoidSelfServeRequest legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: voids an unconfirmed, unconsumed self-serve request, predicated on its nonce; no bucket or root action file:Exec@74 a34f7e295861352741da1c27a13ab5185b4e900eedf597b05c391306d0603c57

internal/console/selfserve_store.go Store.VoidSelfServeRequest legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: voids an unconfirmed, unconsumed self-serve request, predicated on its nonce; no bucket or root action file:Exec@74 a34f7e295861352741da1c27a13ab5185b4e900eedf597b05c391306d0603c57

-@legacy 751b7c962a859b4e6e90a8abed8e0166b5e1dfc5f7f20542b73a56595bd7067e internal/console/selfserve_store.go Store.migrateSelfServe legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: creates the self-serve journal tables (self_serve_moves with its open-row unique index, self_serve_events, self_serve_timings) and move_timings at unarmed store boot, idempotently; no bucket or root action; self-serve moves 2 Task 9: adds self_serve_events.attempts idempotently (ALTER TABLE, a duplicate column tolerated) file:Exec@4602,file:Exec@4800 99afc5640823670ed81c1f33d6f1630e5c92028bf2bea2aa55d679aa6f60f652

-internal/console/selfserve_store.go Store.migrateSelfServe legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: creates the self-serve journal tables (self_serve_moves with its open-row unique index, self_serve_events, self_serve_timings) and move_timings at unarmed store boot, idempotently; no bucket or root action; self-serve moves 2 Task 9: adds self_serve_events.attempts idempotently (ALTER TABLE, a duplicate column tolerated) file:Exec@4602,file:Exec@4800 99afc5640823670ed81c1f33d6f1630e5c92028bf2bea2aa55d679aa6f60f652

+@legacy 1b644881c98b510cd64ed02bfc7fef0eea38ee5717f2751f955ef399711f9f86 internal/console/selfserve_store.go Store.migrateSelfServe legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: creates the self-serve journal tables (self_serve_moves with its open-row unique index, self_serve_events, self_serve_timings) and move_timings at unarmed store boot, idempotently; no bucket or root action; self-serve moves 2 Task 9: adds self_serve_events.attempts idempotently (ALTER TABLE, a duplicate column tolerated) (final review F9 and F10: three additive ALTER TABLE ADD COLUMN statements, announce_seq, request_stage_bucket and request_stage_region, idempotent on a duplicate column) file:Exec@4602,file:Exec@4841,file:Exec@5114,file:Exec@5438 b68e7f2c99721f1ff5c5cfe195488d9b5c983936c04c954ab3f738642afb6428

+internal/console/selfserve_store.go Store.migrateSelfServe legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: creates the self-serve journal tables (self_serve_moves with its open-row unique index, self_serve_events, self_serve_timings) and move_timings at unarmed store boot, idempotently; no bucket or root action; self-serve moves 2 Task 9: adds self_serve_events.attempts idempotently (ALTER TABLE, a duplicate column tolerated) (final review F9 and F10: three additive ALTER TABLE ADD COLUMN statements, announce_seq, request_stage_bucket and request_stage_region, idempotent on a duplicate column) file:Exec@4602,file:Exec@4841,file:Exec@5114,file:Exec@5438 b68e7f2c99721f1ff5c5cfe195488d9b5c983936c04c954ab3f738642afb6428

@legacy 8df4dff0cd99a5606cdc1197e88f0039ded580fa3043b7705de91ccf362bf435 internal/console/selfserve_store.go Store.selfServeMoves legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: lists self-serve move rows under a fixed predicate from the console SQLite store; no bucket or root action file:Query@99 3780495187ef409c945d603d2aabe9aeecd02044ba034ee9e349d2f38b551466

internal/console/selfserve_store.go Store.selfServeMoves legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: lists self-serve move rows under a fixed predicate from the console SQLite store; no bucket or root action file:Query@99 3780495187ef409c945d603d2aabe9aeecd02044ba034ee9e349d2f38b551466

-@legacy 7696cdcbbb86d8e2adb5e1e896d4def7c4ffe6d62aeea4839f426e74c6f718f6 internal/console/selfserve_store.go Store.selfServeRequest legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: reads one self-serve row's request columns with cut_requested_at; no bucket or root action file:QueryRow@270 491bb9fe1c4b487f130d3a07c2a840995e408e86d6f8afaa561be57c61442dbb

-internal/console/selfserve_store.go Store.selfServeRequest legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: reads one self-serve row's request columns with cut_requested_at; no bucket or root action file:QueryRow@270 491bb9fe1c4b487f130d3a07c2a840995e408e86d6f8afaa561be57c61442dbb

+@legacy 163cc0e40c8b51eeed49947541224384c8d66205174d6ce63be11633fab03f31 internal/console/selfserve_store.go Store.selfServeRequest legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: reads one self-serve row's request columns with cut_requested_at; no bucket or root action (final review F10: also the queue's staging coordinates) file:QueryRow@270 f73ae00a9bbb071e32f99cd9dc01522bbc4c56d777224bd37c18751756e11838

+internal/console/selfserve_store.go Store.selfServeRequest legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: reads one self-serve row's request columns with cut_requested_at; no bucket or root action (final review F10: also the queue's staging coordinates) file:QueryRow@270 f73ae00a9bbb071e32f99cd9dc01522bbc4c56d777224bd37c18751756e11838

@legacy 0d9f415961b7e7fd3645705ab6a10d8153ac6e49153e839ef6da687b5177e929 internal/console/selfserve_store.go Store.setSelfServe legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: updates fixed columns of one self-serve row (the estimate, health, gates, warning, notified seq, abort facts, effects, release, open record); no bucket or root action file:Exec@141 8db17fe770db1c0f0f44dd8623a38156518ebbba8ceead4cb7c649e0fc2a4c83

internal/console/selfserve_store.go Store.setSelfServe legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: updates fixed columns of one self-serve row (the estimate, health, gates, warning, notified seq, abort facts, effects, release, open record); no bucket or root action file:Exec@141 8db17fe770db1c0f0f44dd8623a38156518ebbba8ceead4cb7c649e0fc2a4c83

@legacy d98c167a2f01901679bd70c307f6f447f83283cc339592a6a68bc615a49dd26a internal/console/selfserve_store.go auditActivityTx legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: resolves an account sqid and inserts one audit row inside the caller's SQLite transaction (a self-serve event's delivery); no bucket or root action file:Exec@285,file:QueryRow@112 8027f01859caad9c9f8a732ce6978b267cbe5f5a1e1e8fecbf24d4240f021710

@@ -123,7 +122,7 @@ internal/host/movespass.go armOffline legacy accepted-legacy accepted-legacy;rev

internal/host/probes.go stagePathActive legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=root-input (J4, as configPathActive): systemctl is-active carlos-stage.path for the precheck's and the ready report's stage-path fact; self-serve moves 2 Task 6 file:Command@42 f7cbe0e2ba971d201f8fc7111eb4cebac9c9bae14cc826366c06b9e8bd3eecb8

@legacy 6febdffd5ed3a46ca7c8296e2bf12d8249561e26ab6479eb672f40a96b13f0f4 internal/status/snapshot.go CollectBox legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=root-route; self-serve moves 2 Task 6: carries Probes.BoxID, Lanes and Hosts into the private BoxMetrics only (never the public feed); read sites unchanged, offsets moved registry:Alias@4465,registry:CertExpiresAt@3160,registry:CertExpiresAt@3396,registry:CertExpiresAt@4580,registry:DBPath@2495,registry:DBPath@2553,registry:DNSCheckedAt@3365,registry:DNSCheckedAt@4549,registry:DNSStatus@3139,registry:DNSStatus@3334,registry:DNSStatus@4519,registry:Hibernate@3853,registry:Host@2295,registry:Host@2437,registry:Host@2666,registry:Host@3280,registry:Host@3315,registry:Host@4500,registry:Kind@2473,registry:Kind@3807,registry:Platform@2152,registry:ServingVersion@2324,registry:ServingVersion@2447,registry:Socket@3988,registry:Version@2186,registry:Version@2305,whole:Route@1581,whole:RouteAlias@4362 e874e3166d22d437b4d4daf2b1dc8b2d56bc853076cc132b9b2c1d30f9a2b1be

internal/status/snapshot.go CollectBox legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=root-route; self-serve moves 2 Task 6: carries Probes.BoxID, Lanes and Hosts into the private BoxMetrics only (never the public feed); read sites unchanged, offsets moved registry:Alias@4465,registry:CertExpiresAt@3160,registry:CertExpiresAt@3396,registry:CertExpiresAt@4580,registry:DBPath@2495,registry:DBPath@2553,registry:DNSCheckedAt@3365,registry:DNSCheckedAt@4549,registry:DNSStatus@3139,registry:DNSStatus@3334,registry:DNSStatus@4519,registry:Hibernate@3853,registry:Host@2295,registry:Host@2437,registry:Host@2666,registry:Host@3280,registry:Host@3315,registry:Host@4500,registry:Kind@2473,registry:Kind@3807,registry:Platform@2152,registry:ServingVersion@2324,registry:ServingVersion@2447,registry:Socket@3988,registry:Version@2186,registry:Version@2305,whole:Route@1581,whole:RouteAlias@4362 e874e3166d22d437b4d4daf2b1dc8b2d56bc853076cc132b9b2c1d30f9a2b1be

-@coverage internal/host 2594da7b6ef031ae2e1bddafaeacb08f9d110003eedf4f57c9f375b14436c4ef

+@coverage internal/host 9deb3a7abf24f654c3aa660c41ad60ad0eea23cf002e11663e7d7b33f59277bb

@coverage internal/lease 7e2a4a3652f964aaf1ee32356d2538a292c66ee0aaf9e622cf087b644aeaaa61

@coverage internal/status 6bf65bf3b04fdc150e2ec35d2d0d67046cf37b7c60a9dcde1c2204b75bcf8d2b

# Task 6 fix round 1 (the import cycle internal/park's tests saw), rev3=PROPOSED-self-serve-moves-2: PlacementMatches moves into internal/regionname (park.PlacementMatches delegates to it, unchanged in behaviour) so internal/moves no longer imports internal/park; no root read is added or moved. Envelopes: internal/moves in place, internal/park and internal/regionname added.

@@ -185,8 +184,8 @@ internal/console/selfserve_store.go Store.ConsumeSelfServeMaintenance legacy acc

internal/console/selfserve_store.go Store.ExpireSelfServeRequest legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: decides one self-serve request's expiry, predicated on its nonce, the deadline and the cut state the worker read, unconsumed and unexpired; no bucket or root action file:Exec@126 49d1e55948e9b1e8060997cd2bf530cce028d0c3da96e10cdcc1e68048786498

@legacy 21c5d6b0011930d8cd779e2e2af3090a140f1df6529fdaa41cd7b8b9f1ef7680 internal/console/selfserve_store.go Store.VoidExpiredSelfServeRequest legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: voids one expired, unconfirmed, unconsumed self-serve request and records the abort it obliges (abort_requested_at and its reason only when no abort was requested) in one UPDATE; no bucket or root action file:Exec@232 ababbf3459fb6fc8621a03bd1900735c638daa95ebf02d4aa2f55aefb8bf211a

internal/console/selfserve_store.go Store.VoidExpiredSelfServeRequest legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: voids one expired, unconfirmed, unconsumed self-serve request and records the abort it obliges (abort_requested_at and its reason only when no abort was requested) in one UPDATE; no bucket or root action file:Exec@232 ababbf3459fb6fc8621a03bd1900735c638daa95ebf02d4aa2f55aefb8bf211a

-@legacy 12c3b724737ce23f27d1c7854ce33964e06d94cfdd45dcd949d2e99b80a12fc8 internal/console/selfserve_store.go Store.issueSelfServeRequest legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: IssueSelfServeRequest's UPDATE (and its variant that sets the round's step deadline in the same statement), predicated on the phase, no outcome and no unconsumed request; no bucket or root action file:Exec@1273 6cf2541380116c6da8cb9f8a310f0067a5cc4721a5e8148e04349c8462b1905e

-internal/console/selfserve_store.go Store.issueSelfServeRequest legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: IssueSelfServeRequest's UPDATE (and its variant that sets the round's step deadline in the same statement), predicated on the phase, no outcome and no unconsumed request; no bucket or root action file:Exec@1273 6cf2541380116c6da8cb9f8a310f0067a5cc4721a5e8148e04349c8462b1905e

+@legacy faaf12082c722ff45799fb9cc6b3c4a8daabe43883f210c701bae99ac5bc4185 internal/console/selfserve_store.go Store.issueSelfServeRequest legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: IssueSelfServeRequest's UPDATE (and its variant that sets the round's step deadline in the same statement), predicated on the phase, no outcome and no unconsumed request; no bucket or root action (final review F10: it also stores the queue's staging coordinates, request_stage_bucket and request_stage_region, in the same statement) file:Exec@1305 c14592b8774fc53693f9d84f8fbb932982320ec91a28220b39661c271825d331

+internal/console/selfserve_store.go Store.issueSelfServeRequest legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: IssueSelfServeRequest's UPDATE (and its variant that sets the round's step deadline in the same statement), predicated on the phase, no outcome and no unconsumed request; no bucket or root action (final review F10: it also stores the queue's staging coordinates, request_stage_bucket and request_stage_region, in the same statement) file:Exec@1305 c14592b8774fc53693f9d84f8fbb932982320ec91a28220b39661c271825d331

@removed internal/console/selfserve_store.go Store.AdvanceSelfServe H3 census-ruling-PROPOSED-self-serve-moves-2;rev3=PROPOSED-self-serve-moves-2;basis=remains declared but has no direct read; its statement moved to AdvanceSelfServeToStep, classified below, which AdvanceSelfServe calls with the phase's first substep, and which also stamps staging_started_at entering staging and next_maintenance_at entering ready in the same statement (a changed behaviour of AdvanceSelfServe); proposed removal only

@removed internal/console/selfserve_store.go Store.IssueSelfServeRequest H3 census-ruling-PROPOSED-self-serve-moves-2;rev3=PROPOSED-self-serve-moves-2;basis=remains declared but has no direct read; its statement moved to issueSelfServeRequest, classified below, which IssueSelfServeRequest calls (its UPDATE as before) and IssueSelfServeRequestWithDeadline calls with the round's step deadline set in the same statement; proposed removal only

# Task 7 fix round 1, rev3=PROPOSED-self-serve-moves-2: offlineClaimEvidence and participantIdentityFor are re-pinned in place (their unreadable refusals are built transient, a typed field of offlineRefusal; the doors' answers are unchanged), read sites unchanged, offsets moved; the internal/console envelope is re-pinned in place. The two Task 7 removals' bases now say how the moved statements changed.

@@ -235,3 +234,8 @@ internal/console/selfserve_estimate.go Store.moveTimings legacy accepted-legacy

# Task 9 fix round 2, rev3=PROPOSED-self-serve-moves-2: Server.estimateRules (a rated row inside its fixed part, or within a tick of it, carries no rate and is left out) and Store.moveTimings (the floor bound) are re-pinned in place; the internal/console envelope is re-pinned in place.

# Task 10b (the end-to-end witnesses), rev3=PROPOSED-self-serve-moves-2: no root read, class or task is added and no unit changes. Two test seams are added: console.TestHooks.LifetimesOn (internal/console/testhooks.go: it reads the cutover marker through readCutoverMarker, the watcher's own reader, and activates the gate; called only by internal/e2e/selfserve under the e2e build tag) and host.BoxHandle.OptDir (internal/host/e2e_bridge.go: the test box's opt directory, a field). The internal/console and internal/host envelopes are re-pinned in place; the seal stands.

# Task 10b fix round 1, rev3=PROPOSED-self-serve-moves-2: the end-to-end bridge arms each box's instance id as armMovesPass arms the agent's (a per-process cache of the metadata answer, cachedInstanceID's shape, read at arm and lazily through throttledInstanceID) and E2E.status publishes it in the status block as the agent's status tick does, so E2E.status is re-pinned in place (tests only, no new read site); the internal/host envelope is re-pinned in place; the seal moves.

+# Final review fix round (console), rev3=PROPOSED-self-serve-moves-2: no root read, class or task is added. Store.issueSelfServeRequest (the queue's staging coordinates, F10), Store.migrateSelfServe (three additive columns, F9 and F10) and Store.selfServeRequest (the coordinates read back, F10) are re-pinned in place, sites unchanged in kind, offsets moved. ConfirmSelfServeRequest's statement moves to ConfirmSelfServeRequestLanded (it also records announce_seq, F9), frozen accepted-legacy below; ConfirmSelfServeRequest stays declared with no direct read, its row removed under a proposed H3 disposition. The internal/console, internal/moves and internal/alerting (alerting.Armed, F13) envelopes are re-pinned, and the internal/host envelope for the host implementer's F5, F7 and F17 commits (036528e6..e43e415e). The seal moves.

+@legacy b4f1c3fb74e2c6b71833ae3a447fcd9b143432e38cef65c077d6f9f505e3db37 internal/console/selfserve_store.go Store.ConfirmSelfServeRequestLanded legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: ConfirmSelfServeRequest's UPDATE, which also records the landed record_seq as owed its serial bump (announce_seq = MAX(announce_seq, ?), final review F9), predicated on its nonce and unconsumed, unvoided, unconfirmed flags; no bucket or root action file:Exec@326 e7523e0d723468ac13dbbf021dcd54cc58fa10c57e2908d3c4979ba8a95216b4

+internal/console/selfserve_store.go Store.ConfirmSelfServeRequestLanded legacy accepted-legacy accepted-legacy;rev3=PROPOSED-self-serve-moves-2;basis=console.service user carlos-console, J4 root-input: ConfirmSelfServeRequest's UPDATE, which also records the landed record_seq as owed its serial bump (announce_seq = MAX(announce_seq, ?), final review F9), predicated on its nonce and unconsumed, unvoided, unconfirmed flags; no bucket or root action file:Exec@326 e7523e0d723468ac13dbbf021dcd54cc58fa10c57e2908d3c4979ba8a95216b4

+@removed internal/console/selfserve_store.go Store.ConfirmSelfServeRequest H3 census-ruling-PROPOSED-self-serve-moves-2;rev3=PROPOSED-self-serve-moves-2;basis=remains declared but has no direct read; its statement moved to ConfirmSelfServeRequestLanded, classified above, which ConfirmSelfServeRequest calls with no landed sequence (its UPDATE as before) and the job calls with the landed record_seq; proposed removal only

+@coverage internal/alerting d70d1997f5fb0d2e8b948c56b4e9e65159ea7e9488a95cc737715ebe2bedd675