| 1 | package provision |
| 2 | |
| 3 | // plan14ClaimEmptyCohortFix1WriteCensusInventory is the record-write |
| 4 | // inventory for claim-empty-cohort-done's fix round 1, PROPOSED (the ruling |
| 5 | // is owed; docs/superpowers/notes/census-proposal-claim-step8-readiness.md, |
| 6 | // "Fix round 1"). |
| 7 | // |
| 8 | // - Backfill.Done, re-reviewed: it lists the records again (through |
| 9 | // doneRecords: hostops.Apps and hostops.Records, reads only) immediately |
| 10 | // before its one Put and once more after the readback. The Put, its key |
| 11 | // (the backfill manifest) and its If-Match on the collecting etag are |
| 12 | // unchanged, and it writes no record. Still nonrecord. |
| 13 | func plan14ClaimEmptyCohortFix1WriteCensusInventory() []censusEntry { |
| 14 | entries := plan14ClaimStep8ReadinessWriteCensusInventory() |
| 15 | kept := make([]censusEntry, 0, len(entries)+1) |
| 16 | for _, e := range entries { |
| 17 | if e.File == "internal/hostops/backfill_publish.go" && e.Unit == "Backfill.Done" { |
| 18 | continue |
| 19 | } |
| 20 | kept = append(kept, e) |
| 21 | } |
| 22 | return append(kept, |
| 23 | censusEntry{"internal/hostops/backfill_publish.go", "Backfill.Done", "nonrecord", "sel:Put", "c8b9e7f6ab7245c3d26fe472bf12ed11da40acb4113aec9567b99280b5a1a219"}, |
| 24 | ) |
| 25 | } |
| 26 | |
| 27 | // plan14ClaimMergeMovesOfflineWriteCensusInventory was this branch's write |
| 28 | // census with moves-offline's overlay (merged to main as 7af8815) applied on |
| 29 | // top. Since claim-merge-main-3 the chain starts from main's tip |
| 30 | // (movesOfflinePrecopyWriteCensusInventory, which carries moves-offline, |
| 31 | // scan-demand-revival, plans-caps and moves-offline-precopy), so this is a |
| 32 | // pass-through: re-applying the older moves-offline overlay here would undo |
| 33 | // precopy's re-freeze of offlineTakeSeal. |
| 34 | func plan14ClaimMergeMovesOfflineWriteCensusInventory() []censusEntry { |
| 35 | return plan14ClaimEmptyCohortFix1WriteCensusInventory() |
| 36 | } |
| 37 | |
| 38 | // plan14ClaimRosterBindingWriteCensusInventory is the record-write inventory |
| 39 | // for the roster binding build (design-roster-revision-holds.md rev 3 and |
| 40 | // section 7, tasks 1 to 7), PROPOSED (the ruling is owed; |
| 41 | // docs/superpowers/notes/census-proposal-claim-step8-readiness.md, "Roster |
| 42 | // binding"), on top of the merged inventory above. Six key-site units are |
| 43 | // re-reviewed: each compares or produces an installation stamp, which is now |
| 44 | // the box binding (hostactors.BoxBinding) in place of the roster write |
| 45 | // counter. Their kinds are unchanged, none writes an instance or sidecar |
| 46 | // record, and each keeps its class. |
| 47 | // |
| 48 | // - installRecoveryRemote: the rebind request's successor carries the |
| 49 | // actor's binding. The request still names the record key and ETag it |
| 50 | // read; root writes nothing to the record. |
| 51 | // - servingParkStateDirectory: the actor must carry a binding, and the |
| 52 | // inventory's stamp must equal it. |
| 53 | // - executionAuthority: the authority carries the fresh actor's binding. |
| 54 | // - commitRootInventoryPending: the inventory's stamp must equal the fresh |
| 55 | // InventoryActor's binding, and a target stamp, when sent, the |
| 56 | // inventory's (fix round 1, finding 2). |
| 57 | // - recoverRootInventory: a pending intent stamped under another binding |
| 58 | // than the startup binding is settled through the guard's |
| 59 | // SettleObsoleteRootInventory (host-local guard state: the intent |
| 60 | // cleared, the record quarantined and marked settled), never replayed |
| 61 | // (fix round 1, finding 1). It reads the inventory version only, and |
| 62 | // decides obsolescence on the inventory's validated stamp alone |
| 63 | // (finding 2). A superseded-claim abandonment ends in the same settled |
| 64 | // state, with the same reconciliation (fix round 2). |
| 65 | // - rebindRecoveryInventory: the successor and the predecessor inventory |
| 66 | // must both carry the fresh actor's binding. |
| 67 | // |
| 68 | // Not listed, and not a record write in this census's sense: B3's |
| 69 | // hostguard Guard.SettleObsoleteColdHandover. It rewrites the guard's own |
| 70 | // host-local record (recordDir.write: the <host>.json fence and stamp state |
| 71 | // under root's guard directory) and, through its record callback, the cold |
| 72 | // handover journal (writeColdJournal, under root's retire directory). Neither |
| 73 | // is an instance or sidecar record in the deployment store, and the unit |
| 74 | // names no Put-family method, record-key constructor or record literal, so |
| 75 | // the scanner does not see it, exactly as it does not see its siblings that |
| 76 | // make the same guard write (BeginColdHandover, CompleteColdHandover, |
| 77 | // AbandonColdHandover). hostguard's writeRecord is listed only because its |
| 78 | // name ends in writerecord. The Plan 14 overlay pins the new unit. |
| 79 | func plan14ClaimRosterBindingWriteCensusInventory() []censusEntry { |
| 80 | replacements := []censusEntry{ |
| 81 | {"internal/host/claimrecovery_remote.go", "claimCrossBoxHandover.installRecoveryRemote", "key-site", "key:RecordKey", "999a89cc8558d09465cbabb455f19a2974cef0ab92935536dcbe68c09db86b8f"}, |
| 82 | {"internal/host/claimservingparksource_linux.go", "servingParkStateDirectory", "key-site", "lit:instances", "3596d8a75440c454d0acfa8033a8bf67cbae0625911925a0bb45140975d55baa"}, |
| 83 | {"internal/host/rootexecution_authority.go", "ClaimRootHTTP.executionAuthority", "key-site", "key:RecordKey,lit:instances", "00818a660276f82be32f4753aae26edc547ef55654c51c6dec81fdd2e9404cdd"}, |
| 84 | {"internal/host/rootinventory.go", "ClaimRootHTTP.commitRootInventoryPending", "key-site", "key:RecordKey", "bb679c624346c0392db6f7dcddbf75aa1d96baf93e614cc509217d2c2a69d24a"}, |
| 85 | {"internal/host/rootinventory.go", "ClaimRootHTTP.recoverRootInventory", "key-site", "key:RecordKey", "877fbabf76173278757f8696582c56e361934986052fa02fce12cec20ce364d1"}, |
| 86 | {"internal/host/rootrecovery_rebind.go", "ClaimRootHTTP.rebindRecoveryInventory", "key-site", "key:RecordKey", "0e9f3ee60e6077c46c5a951be7abe6878ec79f76a71f78872ac9e54d519a66f4"}, |
| 87 | } |
| 88 | entries := plan14ClaimMergeMovesOfflineWriteCensusInventory() |
| 89 | for _, replacement := range replacements { |
| 90 | found := false |
| 91 | for i, entry := range entries { |
| 92 | if entry.File == replacement.File && entry.Unit == replacement.Unit { |
| 93 | if entry.Class != replacement.Class || entry.Kinds != replacement.Kinds { |
| 94 | panic("roster binding re-pin changes the class or kinds of " + entry.File + ":" + entry.Unit) |
| 95 | } |
| 96 | entries[i], found = replacement, true |
| 97 | break |
| 98 | } |
| 99 | } |
| 100 | if !found { |
| 101 | panic("roster binding re-pin of an unlisted unit " + replacement.File + ":" + replacement.Unit) |
| 102 | } |
| 103 | } |
| 104 | return entries |
| 105 | } |
| 106 | |
amadan