Scan demand revival: census proposal

Status: Paul explicitly approved this scoped inventory update on 2026-10-21, and it has been applied on the review branch. All prior checks and seals remain. Final independent review is still required before merge.

Branch: scan-demand-revival, based on ce8c425ae5930e1c2807018bde1880b93b0947cd. The exact-tip CI failure is limited to the two census checks in internal/provision; the other package tests passed in CI.

Root-read entries

All five execute in the console service, under its console identity. The proposal retains the two existing legacy dispositions and gives the three new console functions the same console-only disposition. This is a proposal for review, not an owner ruling.

• cmd/console/main.go:serve: Console service wires the optional callback signer and starts the claim-guarded queue worker. The same three data path literals move; it does not add a privileged reader. Proposed class: legacy, task: accepted-legacy. Sites: data-literal@3913,data-literal@5014,data-literal@5251. Digest: c0aee9fd233d704a880d6b0171a967cae569ba7dd4281fe96f57d30914318841.
• internal/console/apiscan.go:randomWebhookGeneration: Console grant and rotation call crypto/rand.Read for a callback generation. The Read selector is entropy, not a filesystem path or root decision. Proposed class: legacy, task: accepted-legacy. Sites: file:Read@77. Digest: 930e00b0aec413b5fe0493b4f9c18f0129f1e364477140259cdb9955b80ba900.
• internal/console/apiscanstatus.go:Server.handleAPIScanObject: Authenticated console handler reads URL query parameters key and wait. Query is URL.Query, not database or filesystem I/O. Proposed class: legacy, task: accepted-legacy. Sites: file:Query@1119,file:Query@939. Digest: 1976cc46a661732c3cf2f9352594b348b2c4c612e59bb25c912329338309a67f.
• internal/console/scandeliver.go:Server.scanCallbackHost: Console callback delivery reads registry routes to select an existing ready platform host for the same account and app, excluding canaries and sidecars. It changes no route and invokes no root operation. Proposed class: legacy, task: accepted-legacy. Sites: registry:App@427,registry:Canary@534,registry:Host@585,registry:Host@656,registry:Host@683,registry:Platform@519,registry:Status@491,whole:Route@413,whole:Route@469. Digest: 161d32082b1b7bb3b91d1e036a0fc2708ea02ea2a3c7f4fa7b181735aa683c3a.
• internal/console/server.go:NewServer: Console construction adds queue and notification state. The existing logs/data route literal moves; it is not a filesystem read. Proposed class: legacy, task: accepted-legacy. Sites: data-literal@9149. Digest: 47c78e5384da30570e5db6cdac52ba088f4b33351e26326e08f33d4421762691.

Source envelopes

Only these production package envelopes change:

• .: 6d5a6e90f87912ba6f516215f3fc2a04cd84cad86a8db5a47b6700774dcc3c00.
• cmd/console: f96aab27a8a6c9c21e2884e2ad2bad65e97bf3cd5422cebeeb50cb202ff1eeba.
• internal/console: 3585b6a125fc44020f11411ac43cefe7f714616a17500cb59b2ce4560f0f1907.
• internal/hostops: 3d339a4a91b3fa6c0af58acefa96dc4387fb4f14722e17522c82a118bccd1af3.
• internal/objstore: 1bb476aee8d705d32231af68881c874458ee50b2e0009e30c67260c902208751.
• internal/usage: 91cc5f119bb2e8a67a8ccd8e9c88a1d622b273a49ff85a09dadb6ec8dc82832b.

Record-write entries

Route registration and construction keep their existing key-site classifications. UpsertScanDay writes only the daily counter object under usage/scan/<account>/<app>/<date>.json; it never writes an instance or sidecar record. Its proposed class is nonrecord, consistent with the strictly checked scan-usage storage classifier.

• internal/console/authcli.go:Server.registerCLIRoutes: key-site, sites lit:instances,lit:sidecars, digest f73eb0167bc7a2c8c7f2f9faebe66d55ce1f888dd14f49cfc1f937e74b489181.
• internal/console/server.go:NewServer: key-site, sites lit:instances, digest 47c78e5384da30570e5db6cdac52ba088f4b33351e26326e08f33d4421762691.
• internal/usage/scan.go:UpsertScanDay: nonrecord, sites sel:Put, digest 0581382a8128827cd07aeb379fe313b39660e960b5a19db4aaf1866aa9bc84be.

Applying an approved disposition

Keep all existing inventory checks and seals. Add a final overlay containing just these five rows and six envelopes, checking the existing seal before loading it. Add the three write entries as a final overlay on plan14MovesOfflineWriteCensusInventory. Run the complete provision package and exact-tip CI. Do not label a proposed disposition as an accepted ruling.

The candidate root overlay adds five frozen fingerprints. Its proposed resulting seal is a21dba12b0f3cd0811c624ec352d6ff5c46936ef0da1d4ce9d31cdd13cc0f262; the preceding seal remains a42b90d7a5c440ae8d94981fa3d80f46891e676ed0783574e193afc3534fef1a.

The root package envelope includes the two status lines separately approved by Paul on 2026-10-21. No additional read or write site is introduced by those lines.