| 1 | # Scan demand revival: census proposal |
| 2 | |
| 3 | Status: Paul explicitly approved this scoped inventory update on 2026-10-21, and it has been applied on the review branch. All prior checks and seals remain. Final independent review is still required before merge. |
| 4 | |
| 5 | Branch: `scan-demand-revival`, based on `ce8c425ae5930e1c2807018bde1880b93b0947cd`. The exact-tip CI failure is limited to the two census checks in `internal/provision`; the other package tests passed in CI. |
| 6 | |
| 7 | ## Root-read entries |
| 8 | |
| 9 | All five execute in the console service, under its console identity. The proposal retains the two existing legacy dispositions and gives the three new console functions the same console-only disposition. This is a proposal for review, not an owner ruling. |
| 10 | |
| 11 | - `cmd/console/main.go:serve`: Console service wires the optional callback signer and starts the claim-guarded queue worker. The same three data path literals move; it does not add a privileged reader. Proposed class: `legacy`, task: `accepted-legacy`. Sites: `data-literal@3913,data-literal@5014,data-literal@5251`. Digest: `c0aee9fd233d704a880d6b0171a967cae569ba7dd4281fe96f57d30914318841`. |
| 12 | - `internal/console/apiscan.go:randomWebhookGeneration`: Console grant and rotation call crypto/rand.Read for a callback generation. The Read selector is entropy, not a filesystem path or root decision. Proposed class: `legacy`, task: `accepted-legacy`. Sites: `file:Read@77`. Digest: `930e00b0aec413b5fe0493b4f9c18f0129f1e364477140259cdb9955b80ba900`. |
| 13 | - `internal/console/apiscanstatus.go:Server.handleAPIScanObject`: Authenticated console handler reads URL query parameters key and wait. Query is URL.Query, not database or filesystem I/O. Proposed class: `legacy`, task: `accepted-legacy`. Sites: `file:Query@1119,file:Query@939`. Digest: `1976cc46a661732c3cf2f9352594b348b2c4c612e59bb25c912329338309a67f`. |
| 14 | - `internal/console/scandeliver.go:Server.scanCallbackHost`: Console callback delivery reads registry routes to select an existing ready platform host for the same account and app, excluding canaries and sidecars. It changes no route and invokes no root operation. Proposed class: `legacy`, task: `accepted-legacy`. Sites: `registry:App@427,registry:Canary@534,registry:Host@585,registry:Host@656,registry:Host@683,registry:Platform@519,registry:Status@491,whole:Route@413,whole:Route@469`. Digest: `161d32082b1b7bb3b91d1e036a0fc2708ea02ea2a3c7f4fa7b181735aa683c3a`. |
| 15 | - `internal/console/server.go:NewServer`: Console construction adds queue and notification state. The existing logs/data route literal moves; it is not a filesystem read. Proposed class: `legacy`, task: `accepted-legacy`. Sites: `data-literal@9149`. Digest: `47c78e5384da30570e5db6cdac52ba088f4b33351e26326e08f33d4421762691`. |
| 16 | |
| 17 | ## Source envelopes |
| 18 | |
| 19 | Only these production package envelopes change: |
| 20 | |
| 21 | - `.`: `6d5a6e90f87912ba6f516215f3fc2a04cd84cad86a8db5a47b6700774dcc3c00`. |
| 22 | - `cmd/console`: `f96aab27a8a6c9c21e2884e2ad2bad65e97bf3cd5422cebeeb50cb202ff1eeba`. |
| 23 | - `internal/console`: `3585b6a125fc44020f11411ac43cefe7f714616a17500cb59b2ce4560f0f1907`. |
| 24 | - `internal/hostops`: `3d339a4a91b3fa6c0af58acefa96dc4387fb4f14722e17522c82a118bccd1af3`. |
| 25 | - `internal/objstore`: `1bb476aee8d705d32231af68881c874458ee50b2e0009e30c67260c902208751`. |
| 26 | - `internal/usage`: `91cc5f119bb2e8a67a8ccd8e9c88a1d622b273a49ff85a09dadb6ec8dc82832b`. |
| 27 | |
| 28 | ## Record-write entries |
| 29 | |
| 30 | Route registration and construction keep their existing `key-site` classifications. `UpsertScanDay` writes only the daily counter object under `usage/scan/<account>/<app>/<date>.json`; it never writes an instance or sidecar record. Its proposed class is `nonrecord`, consistent with the strictly checked scan-usage storage classifier. |
| 31 | |
| 32 | - `internal/console/authcli.go:Server.registerCLIRoutes`: `key-site`, sites `lit:instances,lit:sidecars`, digest `f73eb0167bc7a2c8c7f2f9faebe66d55ce1f888dd14f49cfc1f937e74b489181`. |
| 33 | - `internal/console/server.go:NewServer`: `key-site`, sites `lit:instances`, digest `47c78e5384da30570e5db6cdac52ba088f4b33351e26326e08f33d4421762691`. |
| 34 | - `internal/usage/scan.go:UpsertScanDay`: `nonrecord`, sites `sel:Put`, digest `0581382a8128827cd07aeb379fe313b39660e960b5a19db4aaf1866aa9bc84be`. |
| 35 | |
| 36 | ## Applying an approved disposition |
| 37 | |
| 38 | Keep all existing inventory checks and seals. Add a final overlay containing just these five rows and six envelopes, checking the existing seal before loading it. Add the three write entries as a final overlay on `plan14MovesOfflineWriteCensusInventory`. Run the complete provision package and exact-tip CI. Do not label a proposed disposition as an accepted ruling. |
| 39 | |
| 40 | The candidate root overlay adds five frozen fingerprints. Its proposed resulting seal is `a21dba12b0f3cd0811c624ec352d6ff5c46936ef0da1d4ce9d31cdd13cc0f262`; the preceding seal remains `a42b90d7a5c440ae8d94981fa3d80f46891e676ed0783574e193afc3534fef1a`. |
| 41 | |
| 42 | The root package envelope includes the two status lines separately approved by Paul on 2026-10-21. No additional read or write site is introduced by those lines. |
| 43 | |
amadan