| 1 | package provision |
| 2 | |
| 3 | // Plan 9 B8 record-write census. |
| 4 | // |
| 5 | // Every production top-level declaration in the repository that |
| 6 | // - selects, defines, or merely names Put, PutFrom, PutIfAbsent or |
| 7 | // CopyVersion (calls, method values and expressions, interface and struct |
| 8 | // members, string names; plus the derived PutObjectFrom, PutReplace, |
| 9 | // PutIfAbsentVersioned[At] and CopyVersioned[At]), or |
| 10 | // - touches a record-key constructor (RecordKey, SidecarRecordKey, |
| 11 | // RecordsPrefix, SidecarsPrefix, SidecarManifestKey, ParseRecordKey, |
| 12 | // ParseSidecarKey, WriteRecord, putSequencedRecord and the typed |
| 13 | // CreateRecord/UpdateRecord/SetRecord*/CreateSidecarRecord API), or |
| 14 | // - holds a record path literal ("instances", "sidecars", "instances/", |
| 15 | // "sidecars/", "instances.json", "sidecars.json"), |
| 16 | // |
| 17 | // must appear in plan9B8CensusInventory with the reviewed class, the exact |
| 18 | // set of site kinds, and the sha256 of its source. A new, changed, removed or |
| 19 | // unlisted unit fails the test. The test never rewrites the inventory: |
| 20 | // Review the changed writer and its callers before updating the explicit |
| 21 | // inventory below; never bless a changed digest just to make this test pass. |
| 22 | // |
| 23 | // Matching is by name, not by type. A same-named method on any receiver, a |
| 24 | // local alias, a method value or a function field all count; that is the |
| 25 | // point. It cannot see a key assembled from fragments none of which is a |
| 26 | // listed identifier or literal; the digest pins every unit it can see. |
| 27 | |
| 28 | import ( |
| 29 | "crypto/sha256" |
| 30 | "encoding/hex" |
| 31 | "fmt" |
| 32 | "go/ast" |
| 33 | "go/parser" |
| 34 | "go/token" |
| 35 | "io/fs" |
| 36 | "os" |
| 37 | "path/filepath" |
| 38 | "sort" |
| 39 | "strings" |
| 40 | "testing" |
| 41 | ) |
| 42 | |
| 43 | type censusEntry struct{ File, Unit, Class, Kinds, Digest string } |
| 44 | |
| 45 | var censusMethods = map[string]bool{ |
| 46 | "Put": true, "PutFrom": true, "PutIfAbsent": true, "CopyVersion": true, |
| 47 | "PutObjectFrom": true, "PutReplace": true, |
| 48 | "PutIfAbsentVersioned": true, "PutIfAbsentVersionedAt": true, |
| 49 | "CopyVersioned": true, "CopyVersionedAt": true, |
| 50 | } |
| 51 | |
| 52 | // Lower-cased identifier suffixes / exact names that mark a record-key or |
| 53 | // typed-record-writer touchpoint. Keep these names aligned with the APIs above. |
| 54 | var ( |
| 55 | censusKeySuffixes = []string{"recordkey", "recordsprefix", "sidecarsprefix", "sidecarkey", "sidecarmanifestkey", "writerecord", "sequencedrecord"} |
| 56 | censusKeyExact = map[string]bool{"createrecord": true, "updaterecord": true, "setrecordregion": true, "setrecordmove": true, "setrecordrun": true, "setrecordseed": true, "createsidecarrecord": true, "claimrawupdaterecord": true} |
| 57 | censusLitWords = []string{"instances", "sidecars"} |
| 58 | ) |
| 59 | |
| 60 | var censusClasses = map[string]bool{ |
| 61 | "record-primitive": true, "record-writer": true, "record-writer-raw": true, |
| 62 | "record-transport": true, "versioned-transport": true, "foreign-recordkey": true, |
| 63 | "nonrecord": true, "key-site": true, "reference": true, "testsupport": true, |
| 64 | } |
| 65 | |
| 66 | func censusKeyIdent(name string) bool { |
| 67 | low := strings.ToLower(name) |
| 68 | if censusKeyExact[low] { |
| 69 | return true |
| 70 | } |
| 71 | for _, s := range censusKeySuffixes { |
| 72 | if strings.HasSuffix(low, s) { |
| 73 | return true |
| 74 | } |
| 75 | } |
| 76 | return false |
| 77 | } |
| 78 | |
| 79 | func censusRecvName(e ast.Expr) string { |
| 80 | for { |
| 81 | switch x := e.(type) { |
| 82 | case *ast.StarExpr: |
| 83 | e = x.X |
| 84 | case *ast.ParenExpr: |
| 85 | e = x.X |
| 86 | case *ast.IndexExpr: |
| 87 | e = x.X |
| 88 | case *ast.IndexListExpr: |
| 89 | e = x.X |
| 90 | case *ast.Ident: |
| 91 | return x.Name |
| 92 | default: |
| 93 | return "?" |
| 94 | } |
| 95 | } |
| 96 | } |
| 97 | |
| 98 | func censusSpecName(s ast.Spec) string { |
| 99 | switch s := s.(type) { |
| 100 | case *ast.ValueSpec: |
| 101 | return s.Names[0].Name |
| 102 | case *ast.TypeSpec: |
| 103 | return s.Name.Name |
| 104 | } |
| 105 | return "?" |
| 106 | } |
| 107 | |
| 108 | // censusParse returns one entry (Class empty) per top-level unit of src that |
| 109 | // has at least one site kind. path is the slash-separated repo-relative name. |
| 110 | func censusParse(path string, src []byte) ([]censusEntry, error) { |
| 111 | fset := token.NewFileSet() |
| 112 | f, err := parser.ParseFile(fset, path, src, 0) |
| 113 | if err != nil { |
| 114 | return nil, err |
| 115 | } |
| 116 | var out []censusEntry |
| 117 | seen := map[string]int{} |
| 118 | grouped := map[string]int{} |
| 119 | for _, decl := range f.Decls { |
| 120 | var name string |
| 121 | switch d := decl.(type) { |
| 122 | case *ast.FuncDecl: |
| 123 | name = d.Name.Name |
| 124 | if d.Recv != nil && len(d.Recv.List) == 1 { |
| 125 | name = censusRecvName(d.Recv.List[0].Type) + "." + name |
| 126 | } |
| 127 | case *ast.GenDecl: |
| 128 | if d.Tok == token.IMPORT { |
| 129 | continue |
| 130 | } |
| 131 | if d.Lparen.IsValid() { |
| 132 | grouped[d.Tok.String()]++ |
| 133 | name = fmt.Sprintf("%s#%d", d.Tok, grouped[d.Tok.String()]) |
| 134 | } else { |
| 135 | name = d.Tok.String() + " " + censusSpecName(d.Specs[0]) |
| 136 | } |
| 137 | default: |
| 138 | continue |
| 139 | } |
| 140 | seen[name]++ |
| 141 | if seen[name] > 1 { |
| 142 | name = fmt.Sprintf("%s#%d", name, seen[name]) |
| 143 | } |
| 144 | kinds := map[string]bool{} |
| 145 | done := map[*ast.Ident]bool{} |
| 146 | name2 := func(n string, method string) { |
| 147 | if censusMethods[n] { |
| 148 | kinds[method+":"+n] = true |
| 149 | } |
| 150 | if censusKeyIdent(n) { |
| 151 | kinds["key:"+n] = true |
| 152 | } |
| 153 | } |
| 154 | ast.Inspect(decl, func(n ast.Node) bool { |
| 155 | switch n := n.(type) { |
| 156 | case *ast.FuncDecl: |
| 157 | name2(n.Name.Name, "def") |
| 158 | done[n.Name] = true |
| 159 | case *ast.SelectorExpr: |
| 160 | name2(n.Sel.Name, "sel") |
| 161 | done[n.Sel] = true |
| 162 | case *ast.Ident: |
| 163 | if !done[n] { |
| 164 | name2(n.Name, "id") |
| 165 | } |
| 166 | case *ast.BasicLit: |
| 167 | if n.Kind == token.STRING && len(n.Value) >= 2 { |
| 168 | inner := n.Value[1 : len(n.Value)-1] |
| 169 | if censusMethods[inner] { |
| 170 | kinds["str:"+inner] = true |
| 171 | } |
| 172 | for _, w := range censusLitWords { |
| 173 | if inner == w || strings.Contains(inner, w+"/") || strings.Contains(inner, w+".json") { |
| 174 | kinds["lit:"+w] = true |
| 175 | } |
| 176 | } |
| 177 | } |
| 178 | } |
| 179 | return true |
| 180 | }) |
| 181 | if len(kinds) == 0 { |
| 182 | continue |
| 183 | } |
| 184 | ks := make([]string, 0, len(kinds)) |
| 185 | for k := range kinds { |
| 186 | ks = append(ks, k) |
| 187 | } |
| 188 | sort.Strings(ks) |
| 189 | sum := sha256.Sum256(src[fset.Position(decl.Pos()).Offset:fset.Position(decl.End()).Offset]) |
| 190 | out = append(out, censusEntry{File: path, Unit: name, Kinds: strings.Join(ks, ","), Digest: hex.EncodeToString(sum[:])}) |
| 191 | } |
| 192 | return out, nil |
| 193 | } |
| 194 | |
| 195 | func censusRoot(t *testing.T) string { |
| 196 | t.Helper() |
| 197 | dir, err := os.Getwd() |
| 198 | if err != nil { |
| 199 | t.Fatal(err) |
| 200 | } |
| 201 | for { |
| 202 | if _, err := os.Stat(filepath.Join(dir, "go.mod")); err == nil { |
| 203 | return dir |
| 204 | } |
| 205 | up := filepath.Dir(dir) |
| 206 | if up == dir { |
| 207 | t.Fatal("census: no go.mod above the working directory") |
| 208 | } |
| 209 | dir = up |
| 210 | } |
| 211 | } |
| 212 | |
| 213 | // censusProduction parses every non-test .go file under root (testdata, |
| 214 | // vendor, dot- and underscore-directories excluded), build tags ignored. |
| 215 | func censusProduction(root string) (map[string]censusEntry, error) { |
| 216 | got := map[string]censusEntry{} |
| 217 | err := filepath.WalkDir(root, func(p string, d fs.DirEntry, err error) error { |
| 218 | if err != nil { |
| 219 | return err |
| 220 | } |
| 221 | if d.IsDir() { |
| 222 | n := d.Name() |
| 223 | if p != root && (n == "testdata" || n == "vendor" || strings.HasPrefix(n, ".") || strings.HasPrefix(n, "_")) { |
| 224 | return filepath.SkipDir |
| 225 | } |
| 226 | return nil |
| 227 | } |
| 228 | if !strings.HasSuffix(p, ".go") || strings.HasSuffix(p, "_test.go") { |
| 229 | return nil |
| 230 | } |
| 231 | src, err := os.ReadFile(p) |
| 232 | if err != nil { |
| 233 | return err |
| 234 | } |
| 235 | rel, err := filepath.Rel(root, p) |
| 236 | if err != nil { |
| 237 | return err |
| 238 | } |
| 239 | units, err := censusParse(filepath.ToSlash(rel), src) |
| 240 | if err != nil { |
| 241 | return err |
| 242 | } |
| 243 | for _, u := range units { |
| 244 | got[u.File+":"+u.Unit] = u |
| 245 | } |
| 246 | return nil |
| 247 | }) |
| 248 | return got, err |
| 249 | } |
| 250 | |
| 251 | // censusDiff compares the reviewed inventory with what the source shows. |
| 252 | func censusDiff(inv []censusEntry, got map[string]censusEntry) []string { |
| 253 | var problems []string |
| 254 | listed := map[string]censusEntry{} |
| 255 | for _, e := range inv { |
| 256 | id := e.File + ":" + e.Unit |
| 257 | if _, dup := listed[id]; dup { |
| 258 | problems = append(problems, "duplicate inventory entry "+id) |
| 259 | } |
| 260 | listed[id] = e |
| 261 | } |
| 262 | for id, g := range got { |
| 263 | e, ok := listed[id] |
| 264 | switch { |
| 265 | case !ok: |
| 266 | problems = append(problems, fmt.Sprintf("unlisted site %s [%s]: review it, classify it, and update its explicit inventory entry", id, g.Kinds)) |
| 267 | case e.Kinds != g.Kinds: |
| 268 | problems = append(problems, fmt.Sprintf("changed site %s: kinds were [%s], now [%s]", id, e.Kinds, g.Kinds)) |
| 269 | case e.Digest != g.Digest: |
| 270 | problems = append(problems, fmt.Sprintf("changed site %s: source differs from the reviewed digest", id)) |
| 271 | } |
| 272 | } |
| 273 | for id := range listed { |
| 274 | if _, ok := got[id]; !ok { |
| 275 | problems = append(problems, "stale inventory entry "+id+": no such unit with a write site any more") |
| 276 | } |
| 277 | } |
| 278 | sort.Strings(problems) |
| 279 | return problems |
| 280 | } |
| 281 | |
| 282 | func censusKindNames(kinds, prefix string) []string { |
| 283 | var out []string |
| 284 | for _, k := range strings.Split(kinds, ",") { |
| 285 | if rest, ok := strings.CutPrefix(k, prefix); ok { |
| 286 | out = append(out, rest) |
| 287 | } |
| 288 | } |
| 289 | return out |
| 290 | } |
| 291 | |
| 292 | // censusPolicy holds the classification invariants the inventory must satisfy. |
| 293 | func censusPolicy(inv []censusEntry) []string { |
| 294 | var problems []string |
| 295 | primitive := 0 |
| 296 | for _, e := range inv { |
| 297 | id := e.File + ":" + e.Unit |
| 298 | if !censusClasses[e.Class] { |
| 299 | problems = append(problems, fmt.Sprintf("%s: unknown class %q", id, e.Class)) |
| 300 | continue |
| 301 | } |
| 302 | var viaPrimitive, directPut, ctor bool |
| 303 | for _, k := range censusKindNames(e.Kinds, "key:") { |
| 304 | if k == "WriteRecord" || k == "putSequencedRecord" { |
| 305 | viaPrimitive = true |
| 306 | } |
| 307 | if k != "SidecarManifestKey" { |
| 308 | ctor = true |
| 309 | } // App manifests are not host records. |
| 310 | } |
| 311 | if len(censusKindNames(e.Kinds, "lit:")) != 0 { |
| 312 | ctor = true |
| 313 | } |
| 314 | for _, k := range censusKindNames(e.Kinds, "sel:") { |
| 315 | if censusMethods[k] { |
| 316 | directPut = true |
| 317 | } |
| 318 | } |
| 319 | switch e.Class { |
| 320 | case "record-primitive": |
| 321 | primitive++ |
| 322 | if id != "internal/provision/record_sequence.go:WriteRecord" { |
| 323 | problems = append(problems, id+": only provision.WriteRecord may be the record-key Put primitive") |
| 324 | } |
| 325 | case "record-writer-raw": |
| 326 | problems = append(problems, id+": writes record keys without WriteRecord") |
| 327 | case "record-writer": |
| 328 | typed := viaPrimitive |
| 329 | for _, k := range censusKindNames(e.Kinds, "key:") { |
| 330 | if censusKeyExact[strings.ToLower(k)] { |
| 331 | typed = true |
| 332 | } |
| 333 | } |
| 334 | if !typed { |
| 335 | problems = append(problems, id+": record-writer must reach the store through WriteRecord or the typed provision API") |
| 336 | } |
| 337 | } |
| 338 | if e.Class == "nonrecord" { |
| 339 | for _, k := range strings.Split(e.Kinds, ",") { |
| 340 | low := strings.ToLower(strings.TrimPrefix(k, "key:")) |
| 341 | touches := strings.HasPrefix(k, "lit:") || censusKeyExact[low] |
| 342 | for _, suf := range []string{"recordkey", "recordsprefix", "sidecarsprefix", "sidecarkey", "writerecord", "sequencedrecord"} { |
| 343 | touches = touches || strings.HasPrefix(k, "key:") && strings.HasSuffix(low, suf) |
| 344 | } |
| 345 | if touches && (strings.HasPrefix(k, "lit:") || strings.HasPrefix(k, "key:")) { |
| 346 | problems = append(problems, fmt.Sprintf("%s: class nonrecord but it mentions %s; classify it as what it is", id, k)) |
| 347 | } |
| 348 | } |
| 349 | } |
| 350 | if ctor && directPut && !viaPrimitive && e.Class != "record-writer-raw" && e.Class != "foreign-recordkey" { |
| 351 | problems = append(problems, id+": builds a record key and Puts directly; it must be record-writer-raw (fails) or foreign-recordkey with a reason") |
| 352 | } |
| 353 | } |
| 354 | if primitive != 1 { |
| 355 | problems = append(problems, fmt.Sprintf("want exactly one record-primitive, have %d", primitive)) |
| 356 | } |
| 357 | return problems |
| 358 | } |
| 359 | |
| 360 | func TestPlan9B8RecordWriteCensus(t *testing.T) { |
| 361 | root := censusRoot(t) |
| 362 | got, err := censusProduction(root) |
| 363 | if err != nil { |
| 364 | t.Fatal(err) |
| 365 | } |
| 366 | if len(got) < 100 { |
| 367 | t.Fatalf("census found only %d units under %s; the walk is broken", len(got), root) |
| 368 | } |
| 369 | inventory := edgeRequestRecordsWriteCensusInventory() |
| 370 | problems := append(censusDiff(inventory, got), censusPolicy(inventory)...) |
| 371 | if len(problems) > 0 { |
| 372 | t.Fatalf("record-write census rejected %d site(s); update the explicit inventory only after reviewing the source:\n %s", len(problems), strings.Join(problems, "\n ")) |
| 373 | } |
| 374 | } |
| 375 | |
| 376 | // The census must reject each way a new record write could be introduced. |
| 377 | func TestPlan9B8CensusRejectsNewSites(t *testing.T) { |
| 378 | const base = `package x |
| 379 | |
| 380 | import "context" |
| 381 | |
| 382 | func Reviewed(ctx context.Context, s Store, k string) error { |
| 383 | _, err := s.Put(ctx, k, nil, "") |
| 384 | return err |
| 385 | } |
| 386 | ` |
| 387 | observe := func(t *testing.T, src string) map[string]censusEntry { |
| 388 | t.Helper() |
| 389 | units, err := censusParse("x.go", []byte(src)) |
| 390 | if err != nil { |
| 391 | t.Fatal(err) |
| 392 | } |
| 393 | m := map[string]censusEntry{} |
| 394 | for _, u := range units { |
| 395 | m[u.File+":"+u.Unit] = u |
| 396 | } |
| 397 | return m |
| 398 | } |
| 399 | var inv []censusEntry |
| 400 | for _, u := range observe(t, base) { |
| 401 | u.Class = "nonrecord" |
| 402 | inv = append(inv, u) |
| 403 | } |
| 404 | if len(inv) != 1 { |
| 405 | t.Fatalf("baseline inventory: %+v", inv) |
| 406 | } |
| 407 | if p := censusDiff(inv, observe(t, base)); len(p) != 0 { |
| 408 | t.Fatalf("unchanged source must pass, got %v", p) |
| 409 | } |
| 410 | cases := []struct{ name, src, want string }{ |
| 411 | {"raw Put alias", base + "\nfunc Alias(s Store) { put := s.Put; _ = put }\n", "unlisted site x.go:Alias [sel:Put]"}, |
| 412 | {"raw PutIfAbsent alias", base + "\nfunc AliasAbsent(s Store) { f := s.PutIfAbsent; _ = f }\n", "unlisted site x.go:AliasAbsent [sel:PutIfAbsent]"}, |
| 413 | {"CopyVersion alias", base + "\nfunc AliasCopy(v Versioned) { f := v.CopyVersion; _ = f }\n", "unlisted site x.go:AliasCopy [sel:CopyVersion]"}, |
| 414 | {"PutFrom alias", base + "\nfunc AliasFrom(s Store) { f := s.PutFrom; _ = f }\n", "unlisted site x.go:AliasFrom [sel:PutFrom]"}, |
| 415 | {"method value returned", base + "\nfunc MethodValue(s Store) func(context.Context, string, []byte, string) (string, error) { return s.Put }\n", "unlisted site x.go:MethodValue [sel:Put]"}, |
| 416 | {"method expression", base + "\nvar expr = Store.Put\n", "unlisted site x.go:var expr [sel:Put]"}, |
| 417 | {"interface member", base + "\ntype Writer interface{ Put(string) }\n", "unlisted site x.go:type Writer [id:Put]"}, |
| 418 | {"function field", base + "\nvar hook = struct{ Put func() }{}\n", "unlisted site x.go:var hook [id:Put]"}, |
| 419 | {"sidecar key", base + "\nfunc Side(a, b, c string) string { return provision.SidecarRecordKey(a, b, c) }\n", "unlisted site x.go:Side [key:SidecarRecordKey]"}, |
| 420 | {"instance key", base + "\nfunc Inst(a, b, c string) string { return provision.RecordKey(a, b, c) }\n", "unlisted site x.go:Inst [key:RecordKey]"}, |
| 421 | {"records prefix", base + "\nfunc Pref(a, b string) string { return provision.RecordsPrefix(a, b) }\n", "unlisted site x.go:Pref [key:RecordsPrefix]"}, |
| 422 | {"box callsite", base + "\nfunc Box(ctx context.Context, s Store, k string, b []byte) { provision.WriteRecord(ctx, s, k, nil, b, \"\") }\n", "unlisted site x.go:Box [key:WriteRecord]"}, |
| 423 | {"typed writer callsite", base + "\nfunc Typed(ctx context.Context, s Store) { provision.SetRecordMove(ctx, s, \"a\", \"b\", \"c\", nil) }\n", "unlisted site x.go:Typed [key:SetRecordMove]"}, |
| 424 | {"record path literal", base + "\nfunc Lit(h string) string { return \"apps/a/b/instances/\" + h + \".json\" }\n", "unlisted site x.go:Lit [lit:instances]"}, |
| 425 | {"sidecar path literal", base + "\nconst sidecarDir = \"sidecars\"\n", "unlisted site x.go:const sidecarDir [lit:sidecars]"}, |
| 426 | {"reflective name", base + "\nfunc Reflect(v any) { _ = reflect.ValueOf(v).MethodByName(\"Put\") }\n", "unlisted site x.go:Reflect [str:Put]"}, |
| 427 | {"reviewed unit gains a second write", strings.Replace(base, "return err", "f := s.PutIfAbsent\n\t_ = f\n\treturn err", 1), "changed site x.go:Reviewed: kinds were [sel:Put], now [sel:Put,sel:PutIfAbsent]"}, |
| 428 | {"reviewed unit body edited", strings.Replace(base, `nil, "")`, `nil, "*")`, 1), "changed site x.go:Reviewed: source differs from the reviewed digest"}, |
| 429 | {"reviewed unit gains a record key", strings.Replace(base, "return err", "_ = provision.RecordKey(\"a\", \"b\", \"c\")\n\treturn err", 1), "changed site x.go:Reviewed: kinds were [sel:Put], now [key:RecordKey,sel:Put]"}, |
| 430 | {"reviewed unit removed", "package x\n", "stale inventory entry x.go:Reviewed"}, |
| 431 | } |
| 432 | for _, c := range cases { |
| 433 | t.Run(c.name, func(t *testing.T) { |
| 434 | problems := censusDiff(inv, observe(t, c.src)) |
| 435 | for _, p := range problems { |
| 436 | if strings.Contains(p, c.want) { |
| 437 | return |
| 438 | } |
| 439 | } |
| 440 | t.Fatalf("want a problem containing %q, got %v", c.want, problems) |
| 441 | }) |
| 442 | } |
| 443 | t.Run("record key plus direct Put is policy-rejected", func(t *testing.T) { |
| 444 | bad := []censusEntry{{File: "x.go", Unit: "Direct", Class: "nonrecord", Kinds: "key:RecordKey,sel:Put"}} |
| 445 | if p := censusPolicy(bad); len(p) == 0 || !strings.Contains(strings.Join(p, "\n"), "builds a record key and Puts directly") { |
| 446 | t.Fatalf("policy accepted a direct record Put: %v", p) |
| 447 | } |
| 448 | }) |
| 449 | for _, kinds := range []string{"lit:instances,sel:Put", "lit:sidecars,sel:PutObjectFrom", "key:RecordsPrefix,sel:PutIfAbsentVersionedAt", "key:SidecarRecordKey,sel:CopyVersioned"} { |
| 450 | t.Run("transport cannot originate "+kinds, func(t *testing.T) { |
| 451 | bad := []censusEntry{{File: "x.go", Unit: "Transport", Class: "record-transport", Kinds: kinds}} |
| 452 | if problems := censusPolicy(bad); len(problems) == 0 || !strings.Contains(strings.Join(problems, "\n"), "builds a record key and Puts directly") { |
| 453 | t.Fatalf("transport bypass accepted: %v", problems) |
| 454 | } |
| 455 | }) |
| 456 | } |
| 457 | t.Run("a second record-primitive is rejected", func(t *testing.T) { |
| 458 | bad := []censusEntry{ |
| 459 | {File: "internal/provision/record_sequence.go", Unit: "WriteRecord", Class: "record-primitive", Kinds: "key:WriteRecord,sel:Put"}, |
| 460 | {File: "x.go", Unit: "Other", Class: "record-primitive", Kinds: "sel:Put"}, |
| 461 | } |
| 462 | if p := censusPolicy(bad); len(p) == 0 { |
| 463 | t.Fatal("policy accepted a second record-key Put primitive") |
| 464 | } |
| 465 | }) |
| 466 | t.Run("raw record writer is rejected", func(t *testing.T) { |
| 467 | bad := []censusEntry{{File: "x.go", Unit: "Raw", Class: "record-writer-raw", Kinds: "key:RecordKey,sel:Put"}} |
| 468 | if p := censusPolicy(bad); len(p) == 0 { |
| 469 | t.Fatal("policy accepted a raw record writer") |
| 470 | } |
| 471 | }) |
| 472 | } |
| 473 | |
| 474 | // BEGIN REVIEWED INVENTORY |
| 475 | var plan9B8CensusInventory = []censusEntry{ |
| 476 | // Seed serving paths: three local/data keys and one files-object transport. |
| 477 | {"internal/host/claimfilesseed_select.go", "checkFilesSeedLayout", "key-site", "lit:instances", "cb0de1645ceeb6726ca342bec8487a807b0da6f200a277c41be87e3bc62de4cd"}, |
| 478 | {"internal/host/claimfilesseed_select.go", "filesSeedChain", "key-site", "lit:instances", "be995b5de271102602ff47d5c532ed226502dd364264fa688673ee7e7ad16493"}, |
| 479 | {"internal/host/claimfilesseed_stage.go", "filesSeedCheckingStore.Put", "nonrecord", "def:Put,sel:Put", "1b9671f8b7b441b98087fe762ad54013ead435faa8eb62a930cc0ff207e897b0"}, |
| 480 | {"internal/host/claimservingmaintenance_linux.go", "claimServingRoom", "key-site", "lit:instances", "ce0cb25c53adfd3dba7344a98049f44fc3f0b3e633b22ad37299dea81503e403"}, |
| 481 | // rev3=PROPOSED-seed: local instances mount/state references; no deployment record writer. Root authority remains in the seed overlay. |
| 482 | {"internal/host/claimservingpark_linux.go", "servingParkFS.parent", "key-site", "lit:instances", "1d241a7d446bbbade6e460efd911863f8a5246b8ac1d47b2548034e3feb2f216"}, |
| 483 | {"internal/host/claimservinghandover_reboot_linux.go", "ClaimRootHTTP.verifyServingHandoverDirectory", "key-site", "lit:instances", "03e6aa32c980b6fc3512c88bbf5e93f18e84606c36357810bede2b7d3df25b12"}, |
| 484 | {"internal/host/claimservingparksource_linux.go", "servingParkStateDirectory", "key-site", "lit:instances", "ec4a121330c5c8f27343f21af0bbe458cced885d4754e96c0d87b12d9b4a8f35"}, |
| 485 | {"internal/host/rootgeneration_inventory.go", "generationReconciler.reconcile", "key-site", "key:RecordKey", "35fba4c4b286b530288f83d150f93a49980cb5a587bdea1b69c4f71a90442fbf"}, |
| 486 | {"internal/host/rootgenerations_launch.go", "rootGenerationSource.resolve", "key-site", "key:RecordKey", "1d66e9ffa6aca3ea4a2d370c04f782b01c8a15d9ae6ca93a9356632d2b032977"}, |
| 487 | {"internal/host/rootinventory.go", "ClaimRootHTTP.recoverRootInventory", "key-site", "key:RecordKey", "10d09b5ab6d07d316437233c9a65bf0bcdfe1083db4d0769fa8303b255dfd0ac"}, |
| 488 | {"internal/host/proofnamed.go", "proofBindingSource.record", "key-site", "key:RecordKey", "10a99ff4b355907831a904010b7019d480ce93f2f595e99e076d3c702d10ca2b"}, |
| 489 | {"internal/host/rootrecovery_rebind.go", "type recoveryRebindRequest", "key-site", "key:RecordKey", "b5db3e4dcd4807edea1d053eb1787fbf222be97d3f892e2ab66771457a51dc3d"}, |
| 490 | {"internal/host/rootrecovery_rebind.go", "ClaimRootHTTP.rebindRecoveryInventory", "key-site", "key:RecordKey", "a782cf4233eeeb7063e39a1c699530a88c96755e8105f508b3e745cfd3508c9a"}, |
| 491 | {"internal/host/claimrecovery_remote.go", "claimCrossBoxHandover.installRecoveryRemote", "key-site", "key:RecordKey", "d60c3ab46f7b909fa22c648e883e402345d2652a3c54640c3981b13c5c36e168"}, |
| 492 | {"internal/host/rootinventory.go", "ClaimRootHTTP.commitRootInventoryPending", "key-site", "key:RecordKey", "3e3d34311cb6685989689ea445aaa969d270e595d90b97b78dab68f21c1aff1e"}, |
| 493 | {"internal/host/movesheldrelease_root.go", "movesHeldReleaseRoot.authority", "key-site", "key:RecordKey", "cd50ea0c21a17a1acccfe5735e0ab4147341747ec1a080c6113affc1df940901"}, |
| 494 | {"internal/host/rootrecord_claim.go", "rootClaimRecord", "key-site", "key:RecordKey,key:SidecarRecordKey", "e7f73adcaa45e4dfefc5743f43e9ab83567ac95a74ae0557e789478a58e64da4"}, |
| 495 | {"internal/hostbox/inventory_expected.go", "StopInventoryDB.WriteExpected", "key-site", "key:RecordKey", "8c2824998dcb510ed54c08a74846352c7918fe1ba2d7ffb3dd05596ca81b329b"}, |
| 496 | {"internal/hostbox/inventory_expected.go", "type InventoryExpectation", "key-site", "key:RecordKey", "c9d359aac6c5e352f31acfbd66548e09be10a5e621b5bf15da61b4ad3fd9feff"}, |
| 497 | {"internal/hostbox/inventory_registration.go", "ReconcileAdapter.CaptureInventory", "key-site", "key:RecordKey", "75b520c9ebd7816e4e0ce9fa0d767c35282f745055ff923cef54f35be109cac5"}, |
| 498 | // Files seed v4 rejects RecordKey; these remain key sites for older journal versions. |
| 499 | {"internal/hostbox/journalservice.go", "journalPrepare", "key-site", "key:RecordKey", "c8d747d257f0ad48a7bfc645de0a9c50a05fec4c333a75df2a1360d9de9fb9f1"}, |
| 500 | {"internal/hostbox/journalservice.go", "journalRequestHash", "key-site", "key:RecordKey", "b6248a416cb57046d014a95b22f3798f156e0cde5aba189f5f82c36d4c7a5e78"}, |
| 501 | {"internal/hostbox/journalservice.go", "type JournalRequest", "key-site", "key:RecordKey", "be65901745c9d840a1f6cbb7c82f2443482f85b652b7b1635f38fc0524aec38c"}, |
| 502 | {"internal/hostbox/journalservice.go", "validateJournalRequest", "key-site", "key:RecordKey", "2d05c14a0afd5bbe4b5dd9e03e7eb885329caec62fb360e02256183d2894d351"}, |
| 503 | // Fix3 extends PID-zero binding states; RecordKey remains an identity read, with no record write. |
| 504 | {"internal/host/proofbinding.go", "proofBindingSource.binding", "key-site", "key:RecordKey", "8824e9a950f7d92ddbef2315938ec7702ec93814be24f067c6b8df1009ff4835"}, |
| 505 | {"internal/host/proofbinding.go", "type proofBinding", "key-site", "key:RecordKey", "418f61bc5a4192d99821b315baeb1a5b4619593303f8a02e9b13ef824003a613"}, |
| 506 | {"internal/host/rootroute.go", "proofBindingSource.claimIdentity", "key-site", "key:RecordKey", "ad6e0fc3f2cd360473a5d0a2267d2dc7944b45d80947613f791db8d573f8fee6"}, |
| 507 | {"internal/provision/rootrecord.go", "IndexRecords", "key-site", "key:ParseRecordKey,lit:instances", "2e45f3c659a61943727ac1413d431c8320dbc1d4e89cb4f43df60c819764abf9"}, |
| 508 | // Read-only discovery of signed loss records; no record write or lifecycle authority. |
| 509 | {"internal/console/claim_loss_pages.go", "Server.pageClaimLossRecord", "key-site", "key:LossRecordKey", "d21e2450f540edf6645c457eb08c72f470969f5ea4fcbc597157bb7dbeb27287"}, |
| 510 | {"internal/hostbox/parkleases.go", "ReplicaParkLeaseSet", "key-site", "lit:instances", "0ca8d9b743402fda9d15cc215464423b35e21c1c2b47f91294d76188b7d43fb6"}, |
| 511 | {"internal/host/claimretirementcensus.go", "ClaimRetirementCensus", "key-site", "lit:instances", "abc0bd8c5f5d328abfac8821f42f8f23954723ed6506747f33b0197824e2611f"}, |
| 512 | {"internal/host/claimproduction.go", "productionClaimRegional.View", "key-site", "lit:instances", "533203b2aa729801438da4f3a85799a58ea0e67d20eb5625f0de32ea623f1607"}, |
| 513 | {"internal/hostops/move_loss_admission.go", "moveLossOwner.ValidateLossRecovery", "key-site", "key:RecordKey", "1ad4af4595c764fc5051e50c2b187472cb20ce73c3b3e8245b8527228f326f5f"}, |
| 514 | {"internal/host/claimretirementcensus.go", "claimArchivedLocations", "key-site", "lit:instances", "9ba8ea4ecb5ad63621c1322467b9a80f8f5703896ba1fc3f7cb1addd56418950"}, |
| 515 | {"internal/host/claimretirementcensus.go", "claimLegacyIncarnation", "key-site", "lit:instances", "31a14ea105c67e00a24f06b9500a221ee5bfc47402b9c33cecfde807e51db530"}, |
| 516 | {"internal/hostops/move_fence_release.go", "MoveRecoveryGrant.releaseFencedTarget", "record-writer", "key:WriteRecord,key:writeRecord", "d2288f641c97eadf304e967042c96076a37d9d11443706f813a896e32826816b"}, |
| 517 | {"internal/hostops/move_fence_release.go", "MoveRecoveryGrant.StampLostMoveTargetParked", "record-writer", "key:WriteRecord", "911ab90f0786d646b494a62c2d061852c35273dc538408636ebf2ec613fa2198"}, |
| 518 | {"internal/hostops/move_recovery_grant.go", "MoveRecoveryGrant.Convert", "record-writer", "key:WriteRecord", "eaf286018241c8d1f02ee37f5e2cac1b97eec657335519febf529ab902c0b511"}, |
| 519 | // The recovery pass's move log writer: one create-only entry of a move's |
| 520 | // log under its report prefix, for a host whose claim still names the |
| 521 | // app; never a record (Plan 6 Task 3 fix round 3, ruling 1). |
| 522 | {"internal/hostops/move_log_writer.go", "MoveLogWriter.WriteMoveLog", "nonrecord", "sel:Put", "2241e022d7c13c03ad3011ef8175ec5308b9fdfbcd3452589269ee47003a4e7f"}, |
| 523 | {"internal/hostops/move_recovery_grant.go", "MoveRecoveryGrant.Record", "record-writer", "key:WriteRecord", "5f7e2b19846e5994e54e92592ec2b713c18d8b7c43353ad2f3a0b7c864ab3b38"}, |
| 524 | // Plan 10: reviewed typed console move and loss writers. |
| 525 | {"internal/hostops/console_move_grant.go", "ControlWriter.ConsoleMove", "record-writer", "key:WriteRecord", "21e7a6ddc4dbe5b3bf06e65b39a228e2eb588af1edc43beb09d91dd72570dd44"}, |
| 526 | {"internal/hostops/console_move_grant.go", "ControlWriter.consoleMoveClaim", "key-site", "key:RecordKey", "4b1a147d0222690151ae160aad5c983e58cca4a1beebe44bebeda16d35450c53"}, |
| 527 | {"internal/hostops/console_move_grant.go", "ObserveConsoleMove", "key-site", "key:RecordKey", "296077e790e210e9f15eabdfb30f4ba09acc46825aee27824ca333bd470664a4"}, |
| 528 | {"internal/hostops/move_loss_grant.go", "ControlWriter.DeclareMoveLoss", "key-site", "key:LossRecordKey", "b78321f1182124da71b5f03c978293f4fbff5361869565e13621b2b0e5e93579"}, |
| 529 | {"internal/hostops/move_loss_grant.go", "ControlWriter.moveLossClaim", "key-site", "key:RecordKey", "d97870cace01fbbe59514b170de41352afa255272c1834625711e955527d647a"}, |
| 530 | {"internal/hostops/move_loss_grant.go", "claimSimulation.Put", "nonrecord", "def:Put", "08f341b2c797aa30cda0e4e56249f2479f1ad032ee086442ba543f84e601c118"}, |
| 531 | {"internal/hostops/move_loss_grant.go", "lossScopedStore.Put", "record-transport", "def:Put,key:IsRecordKey,key:LossRecordKey,key:putSequencedRecord,sel:Put", "f6f912bbc4c6c67317cfbb012ea4e87ed2fbbdababa91fb640c89c433738d3d5"}, |
| 532 | {"internal/hostops/move_loss_grant.go", "readOnlyStore.Put", "nonrecord", "def:Put", "e5f2d05226614d6a23afe06dea4fda7d45958aeac6ee5f42474872b2cbbc8b8e"}, |
| 533 | {"internal/hostops/move_loss_owner.go", "claimLossIntent", "key-site", "key:RecordKey", "c3eeb176db52e6642bd026bbf97b2b5f6520d08e7fccbdc8c8a9106851725802"}, |
| 534 | {"internal/hostops/move_loss_owner.go", "decodeMoveLossIntent", "key-site", "key:RecordKey", "e868448e696de4614a362f27301e6fa25506394fd7582d3076d126a5f72e93db"}, |
| 535 | {"internal/hostops/move_loss_owner.go", "lossIntentOf", "key-site", "key:LossRecordKey", "bd0d6d6d2c53ed4daddae47791f4de5fda5935bd59be0a04e41ad22a0b3a2954"}, |
| 536 | {"internal/hostops/move_loss_owner.go", "moveLossOwner.FinishLoss", "record-writer", "key:RecordKey,key:WriteRecord", "fb936dc901ec18ac2aeb1cd638eed0600df0b5dfe3bf2caf6efa6b4f000af1d2"}, |
| 537 | {"internal/hostops/move_loss_owner.go", "moveLossOwner.PrepareLoss", "record-writer", "key:RecordKey,key:WriteRecord", "bf616b8ef1e26e3799d67872a380e1818b9d1bba168b3ee951ba1c1ad0c27a9b"}, |
| 538 | {"internal/hostops/move_loss_owner.go", "moveLossOwner.ValidateDeclareLost", "key-site", "key:LossRecordKey,key:RecordKey", "c4375ea8e4311dcd6ec38be7bc1edbb04aaa2648d7d37fd177a326a8486362a8"}, |
| 539 | {"internal/hostops/move_loss_owner.go", "readSuperseded", "key-site", "key:LossRecordKey", "c6e947a3d2eb726bbc7688fd5ea1320efd4092475c45b7e6a0af3f0cb956b2c4"}, |
| 540 | {"internal/hostops/move_loss_owner.go", "sameMoveTarget", "key-site", "key:RecordKey", "ede06bcfca80df25af7c438629863e711f95eeb17c7c47f6f9d73459ce7ae8eb"}, |
| 541 | {"internal/hostops/move_loss_owner.go", "type moveLossIntent", "key-site", "key:RecordKey", "ff9200092a5e3b55e6b422501f121c51613b8922c201ec29a6012b7bcb0e01ff"}, |
| 542 | // Hibernate generation markers use a different bucket and key grammar from deployment records. |
| 543 | {"internal/host/claimproduction_marker.go", "productionClaimMarkers.PutMarker", "foreign-recordkey", "lit:instances", "69301cdddce2bc61a24f0dd8297534814521adc1ddc76a7d3054ed007444a0f5"}, |
| 544 | {"accounts.go", "putOverwrite", "nonrecord", "sel:Put", "a85f380434a2d297f14c8068083f41ca7f9c9b735efd7d3abf8d91520fe6453c"}, |
| 545 | {"accounts_record_sequence.go", "putMigrationObject", "record-writer", "key:IsRecordKey,key:WriteRecord,sel:Put", "94de2240deb822b8b59e22f70733df64d42f2859150ff302d8c66f110d09cf34"}, |
| 546 | {"accounts_record_sequence.go", "validateMigrationRecords", "key-site", "key:IsRecordKey", "5e2c29c12d21f5a2223ab844c4177557dfa2ca2c7696c5293879c32a25e4854b"}, |
| 547 | {"apimode.go", "apiSession.instanceSetChannel", "key-site", "lit:instances", "e94374a40fc4bce37470ea5cdbdf17b0ceaa2d3b09cf8e755a5ca2fc42e98418"}, |
| 548 | {"apimode.go", "apiSession.instanceSetUpstreams", "key-site", "lit:instances", "a4a3949526c5f722de61f11d000e230da4bad7e330d85df9ddb19abd6b234266"}, |
| 549 | {"apimode.go", "apiSession.instanceSetEnvironment", "key-site", "lit:instances", "aae153781a31a5fa3c80120242b3ab0c11c4ecf32f849e73f8befa34282f0044"}, |
| 550 | {"apimode.go", "apiSession.instanceSetSteering", "key-site", "lit:instances", "86180e9be148c0a27aee61748fd55b029c8d9feaf7aa0d6a131462b06188a6ab"}, |
| 551 | {"apimode.go", "apiSession.instanceSetGate", "key-site", "lit:instances", "d2105918b5b1db014678fa6127a8cb0d84c2a473a247efd94a1a48b8928d484e"}, |
| 552 | {"apimode.go", "apiSession.instanceDelete", "key-site", "lit:instances", "fcb30a3d930a508bd061ff7ed3f615371271891e5c75b0e9d5c00bd723369888"}, |
| 553 | {"apimode.go", "apiSession.instanceGet", "key-site", "lit:instances", "9ee7812feb391a0c839ae7448534bd7f2e2a3a29e3fff1dbe7faa110024bc9a6"}, |
| 554 | {"apimode.go", "apiSession.sidecarGet", "key-site", "lit:sidecars", "1a35497dbb705df114430141c124296fb6be30690c07eeedb50ee3cc2b33de93"}, |
| 555 | {"apimode.go", "apiSession.sidecarDelete", "key-site", "lit:sidecars", "f23690fec191a001df364d3f39d06d3c287ce95f8a2b1b4ea94306d3536fbb3c"}, |
| 556 | {"apimode.go", "apiSession.sidecarWake", "key-site", "lit:sidecars", "9d1239f5d3c2977de9f406ede15ca97756ff2929268857047a58c28d344d9868"}, |
| 557 | // Re-reviewed at the merge of carlos-run into seeded-instances (2026-10-13): main's body with the `import` verb case beside `create`; it writes no record. |
| 558 | {"cli.go", "runInstances", "key-site", "lit:instances", "342c14b2ecd4100405e59eb5a13d7be893d625b70eaff4ca0e0074ae31908210"}, |
| 559 | {"instances_cli.go", "apiSession.instanceRetry", "key-site", "lit:instances", "68e68933d4817ed2191cefa45bb63e70b2d71bdf7acec76aeb79ce8f07245b6e"}, |
| 560 | // Settings plan 5: builds the console API path .../instances/<host>/updates for `carlos instances set` and `update`; the CLI writes through the console door, never a record. |
| 561 | {"instances_updates.go", "updatesPath", "key-site", "lit:instances", "9c6f5c6025c023127d490e91bf52d6c536fd8c05efb89b213d9a183690d87880"}, |
| 562 | // Names instance record paths in refusals; writes local registry rows, not provision objects. |
| 563 | {"cli.go", "runRoute", "key-site", "lit:instances", "36862b228fb5144bb9a282274f957c5479ed23dd6965673e88c09cc9e97fc66a"}, |
| 564 | {"cli.go", "runRouteHibernate", "key-site", "key:SidecarManifestKey", "c151cae2cbc57943e9a5d0a5dac611823d769a6b651d5dbc2fe86182f6e098b1"}, |
| 565 | {"cli.go", "RunStatus", "key-site", "lit:instances", "3b9936cf0f29f57f06c378a334e3118096679dfdadab7aad45b1f6c7b5841562"}, |
| 566 | {"domains_cli.go", "runDomainsList", "key-site", "lit:instances", "f7aefeff56b0be7b50ee82bd250ada08ae9a095b7a62f577ead70846e00b61ad"}, |
| 567 | // Maps a data-bucket replica key to its park location instances/<host>[/<incarnation>]; a pure string function. |
| 568 | {"internal/host/movesevidence.go", "movesInstancesLocation", "key-site", "lit:instances", "4f79083f445c5892fb4933a696bc322eb081d0dd0c0b53c2134e8544c5a9df3e"}, |
| 569 | // Reads the record through MovesRecordReader (GetRecord); RecordKey only checks the claim holder's key, and the literals only compare data-bucket locations. No write. |
| 570 | {"internal/host/movesevidence.go", "movesRetirementEvidence.retired", "key-site", "key:RecordKey,lit:instances", "944be37e61727fdc6ed76f0394a8ae3100ff5b15a92b8619ac9e7a8cd91362df"}, |
| 571 | // The moves park view's record read (Plan 5 Task 9a): reads through MovesRecordReader (GetRecord); RecordKey only checks the claim holder's key. No write. |
| 572 | {"internal/host/movessources.go", "holderRecord", "key-site", "key:RecordKey", "84e840552703cd9863c9b27786baa864109e94d15b9e6f3e035c0da18622eb2e"}, |
| 573 | // The park view's read-only store over one manifest version (Plan 5 Task 9a, M10): Put refuses and writes nothing. |
| 574 | {"internal/host/movessources.go", "versionStore.Put", "nonrecord", "def:Put", "a540f7fd383ea728f93a9eacb0d03ec1b8dcefcf20ade117831d0dd28faad2da"}, |
| 575 | // movesfiles.go (moves Task 6, C8): the prepared manifest build's create-only |
| 576 | // store over the box's versioned data bucket; files manifests and their |
| 577 | // objects, never a record. |
| 578 | {"internal/host/movesfiles.go", "createOnlyStore.Put", "nonrecord", "def:Put,sel:PutIfAbsent", "84d637bc7993e3de5dc0b7615db9420820dbdeaf231f93e0f20a43f0749d905e"}, |
| 579 | // Task 6 fix round 1: the exact-version read-back of a prepared manifest |
| 580 | // (read only), the establishment's selection-fenced data bucket store, and |
| 581 | // the install's authority-checking versioned store; files manifests and |
| 582 | // their objects, never a record. |
| 583 | {"internal/host/movesfiles.go", "exactBytesStore.Put", "nonrecord", "def:Put", "7f875cc9a0678d9b0357bfe1246dc998e4e4b3da0043eea47bc71bc0b096557d"}, |
| 584 | {"internal/host/movesfiles.go", "selectionStore.Put", "nonrecord", "def:Put,sel:Put", "c246cff188a95056a0e01a85d4af5af01b254f2ada772513a89a9af318a24674"}, |
| 585 | {"internal/host/movesinstall.go", "installAuthorityStore.CopyVersion", "nonrecord", "def:CopyVersion,sel:CopyVersion", "f1934a22f1eebd997bc6389554545096acfad55b4b793fda47f0fc650d8cb6a6"}, |
| 586 | {"internal/host/movesinstall.go", "installAuthorityStore.PutIfAbsent", "nonrecord", "def:PutIfAbsent,sel:PutIfAbsent", "dc3db56e278cead930bfd2002caef7141be0b38d77fcae3ef766170ecd0cac04"}, |
| 587 | // Copies config acknowledgements to moves/<account>/<app>/<host>/<op>/config-ack-source.json. |
| 588 | {"internal/host/movesfinal.go", "sourceFinal.configAck", "nonrecord", "sel:Put", "cca53109e6945a73b7f04705d8965b3b0997f2b7d2a82fa6d86cffa4b4174e93"}, |
| 589 | // Stamps source_parked_at through SetRecordMove, updateRecord and WriteRecord. |
| 590 | {"internal/host/movesfinal.go", "sourceFinal.stampParked", "record-writer", "key:SetRecordMove", "5eeb2386021980ea668123d3acb2d2ccefce9a8561e32be8937504b115dd5ffb"}, |
| 591 | // Applies install transitions only through SetRecordMove and its sequenced writer. |
| 592 | {"internal/host/movesinstall.go", "installRun.transition", "record-writer", "key:SetRecordMove", "1c6d390393de6065acc6d11409a493ac2fc49299b1f18f08c329a8af68f88c20"}, |
| 593 | // The refusal callback marks the return stuck through SetRecordMove; other callbacks only read or mutate memory. |
| 594 | {"internal/host/movesinstall.go", "recoveryInstallSource", "record-writer", "key:SetRecordMove", "1d97e2177b7a4f3da6cb7db57cacf70d0394824bac32d7d037e7db3fd29b286f"}, |
| 595 | // Copies the sealed lane's build-state.json (moves.BuildStateSuffix) to |
| 596 | // <holder location>/build-state.json in this box's own data bucket, or deletes a leftover there; no record key. |
| 597 | {"internal/host/movesinstall.go", "installRun.placeBuildState", "nonrecord", "sel:CopyVersion", "e50eb9a2fa51ac01e7665aa53ab7527ebabc1e1231907be1e22f84eaaae13b72"}, |
| 598 | // Puts only release.BuildStateKey(prefix), <lease prefix>/build-state.json in the |
| 599 | // hibernate or claim data bucket, CAS on the etag it read; no record key. |
| 600 | {"internal/host/buildstate.go", "buildStates.write", "nonrecord", "sel:Put", "9d1fb38d5a3e0b324f8085d8b40249a204259243f3ab36bbd694bb552ffaec6f"}, |
| 601 | // Lists RecordsPrefix and reads each record with provision.GetRecord for retention; writes nothing. |
| 602 | {"internal/host/retention.go", "appRecords", "key-site", "key:RecordsPrefix", "b5410327666747c08e7ffda28b4462cd54290c0327e78333fb45f590d7a2f34a"}, |
| 603 | // Commits the landing through SetRecordMove (MoveCommit), its refusal the rollback mark. |
| 604 | {"internal/host/moveslandcommit.go", "landingRun.probed", "record-writer", "key:SetRecordMove", "d914debf1ba5d011767fc06cb430c09e39a469dfb182f5996fa3bda806499952"}, |
| 605 | // Stamps opened_at through SetRecordMove (MoveOpened) inside the hold lock, after the proved release. |
| 606 | {"internal/host/moveslandcommit.go", "landingRun.open", "record-writer", "key:SetRecordMove", "febac996d3bb9caf4021cbc4bcffe1c900bddba4287ff95f083bd5e0751e9bc2"}, |
| 607 | // Closes a committed move through SetRecordMove (MoveClose, LastMove done) once nothing is owed under the op, then releases the claim (ReleaseMove via releaseAfterClose): record first, ruling M4. A claim already released by this move gets only the record's close. |
| 608 | {"internal/host/movesparks.go", "movesWorker.closeMove", "record-writer", "key:SetRecordMove", "380a2a0f8cc450573256f359a77da5e451ad506fef84aaeceb9696e3d2904211"}, |
| 609 | // Closes the rollback record through SetRecordMove once nothing is owed under the op, then releases the claim (record first, ruling M4); local journal parking uses separate storage. Plan 6 Task 5: after the close it pages rolled_back once (pageRolledBack, through the box's page outbox; fix round 2), which writes no record. |
| 610 | {"internal/host/movesrecover.go", "recoverRun.finalize", "record-writer", "key:SetRecordMove", "f2bab5b8b4deb1e1698370f1d7ecd52c226978579e3682746759cab9698f39c0"}, |
| 611 | // Advances the source recovery phase through SetRecordMove and its sequenced writer. |
| 612 | {"internal/host/movesrecover.go", "recoverRun.phase", "record-writer", "key:SetRecordMove", "be641eaba77b940ce471696720b637b9dfb9454de0893aca1fcc40750135719d"}, |
| 613 | // Records probe inputs through SetRecordMove; phase and stuck helpers use the same writer. Moves Task 4: it also reads the claim's loss of the target (recoveryDeclared) to ask a declared return's coverage; no new write. |
| 614 | {"internal/host/movesrecover.go", "recoverRun.probing", "record-writer", "key:SetRecordMove", "6d5d83343b5091faed0da4e3c1026965b2f9c2c593e2633185b766532189bfcc"}, |
| 615 | // Moves Task 4: derives the declaration's loss record key to compare with the record's Rollback.LossRef; it reads the claim only and writes nothing. |
| 616 | {"internal/host/movesloss.go", "claimLossRefs", "key-site", "key:LossRecordKey", "288effcd9c701a2ee15619b0c40a2f474ca00cbd95d32fdef0f922e08285080a"}, |
| 617 | // Moves Task 4: derives the pending declaration's loss record key to compare with the record's Rollback.LossRef before vouching for its frozen sources; it writes nothing. |
| 618 | {"internal/host/movesloss.go", "movesRecoveryOwners.pendingLoss", "key-site", "key:LossRecordKey", "fc0855fc74578814a25c3dd10e1efbba202885a6bd1215c923c98d53638d5262"}, |
| 619 | // Marks recovery stuck through SetRecordMove; event and serial writes are not record objects. |
| 620 | {"internal/host/movesrecover.go", "recoverRun.stuck", "record-writer", "key:SetRecordMove", "d634bbd18794aedf081c51f6e3c16b62a9b6b82b21b24f636b949c840c8e5776"}, |
| 621 | // Records revert inputs through SetRecordMove; stuck uses the reviewed record helper and journals are local. Plan 6 fix round 2: its journal write is a Commit through moves.UpdateJournal, and its two step removals are Unmarks. |
| 622 | // Re-reviewed for home part 2, Task 4 (ruling owed): after the probe answers it reads the host claim again for its probed CAS; its record writes are unchanged. |
| 623 | {"internal/host/movesrevert.go", "revertRun.probing", "record-writer", "key:SetRecordMove", "9a4e1f09ea6af0ab98f0253765d544a4419b4daa98066753fa8b2bf1e5aa618a"}, |
| 624 | // Applies revert record mutations only through SetRecordMove and its sequenced writer. |
| 625 | {"internal/host/movesrevert.go", "revertRun.record", "record-writer", "key:SetRecordMove", "f42100f118eb62ceece23b49423bda2ef357f1aa065760b288bf20340e36a920"}, |
| 626 | // Starts rollback through SetRecordMove; the companion claim update targets the separate claim namespace. |
| 627 | {"internal/host/movesrollback.go", "movesWorker.rollBackLanding", "record-writer", "key:SetRecordMove", "c834e9bb708ef05fbdb80d1677bc409ae02aaa8cae93fa5767fde71f446a571e"}, |
| 628 | // Writes only moves/<host>/<rollback>/move.json in the guarded staging bucket. |
| 629 | {"internal/host/movesrollback.go", "rollbackRun.laneMoveJSON", "nonrecord", "sel:PutIfAbsentVersioned", "5fd541f4a1daf2600ff266583fc9627cc0cab35e276f1d9c8f097f128c2c4e53"}, |
| 630 | // Advances the target rollback phase through SetRecordMove and its sequenced writer. |
| 631 | {"internal/host/movesrollback.go", "rollbackRun.phase", "record-writer", "key:SetRecordMove", "72369c7aafffb3df49f9b6e0f493e21967dd7262e32ddcb6eaff0dc9ff255d33"}, |
| 632 | // Marks the return stuck through SetRecordMove; event and serial writes are not record objects. Plan 5 Task 9a: the release's archive refusal stops here too; only the log line changed (the target's half, not the return), the write is the same MoveMarkStuck. |
| 633 | {"internal/host/movesrollback.go", "rollbackRun.stuck", "record-writer", "key:SetRecordMove", "bfbf69effb1a7d77db96cc0bf404e57eb6ee06c3a298bc31a8990f9fb051f43f"}, |
| 634 | // Validates the pointer-digest marker key and Put/Delete method names without writing. |
| 635 | {"internal/hostops/mutation_classifier.go", "classifyPointerDigestMarker", "reference", "str:Put", "08111b5db5d98e788d1eef5861ad9c861cf926c5e1d5d54717fd650d2dcf9fa8"}, |
| 636 | // Validates the promotion-record key (releases/<acct>/<app>/promoted/<version>, a release object, not a |
| 637 | // provisioning record) and Put/Delete method names without writing. |
| 638 | {"internal/hostops/mutation_classifier.go", "classifyPromotionRecord", "reference", "key:PromotionRecordKey,str:Put", "211775ccd2f2924f1ca7bb4f0c5cd1711d096c2065f111362130847d8e6daa0a"}, |
| 639 | // Renders systemd paths under /data/instances and /run/carlos/instances; performs no store write. |
| 640 | {"internal/instancectl/gen.go", "GenDropIn", "key-site", "lit:instances", "f25956c74df80e9a89026ae5a6cf59b1d78ec227ee6cd6ece53bc79d14cc8746"}, |
| 641 | // Lists reserved local layout basenames, including instances; contains no writer. |
| 642 | {"internal/layout/extras.go", "var platformNames", "key-site", "lit:instances", "0e98837e22835749384ee57a1c1e3ccd687f5099057af7cb1ad56ffc415512c4"}, |
| 643 | // Writes only releases/<account>/pointer-digests after validating the account. |
| 644 | {"internal/release/digestmarker.go", "WriteDigestMarker", "nonrecord", "sel:Put", "d723be84d7a5204237b1b8eed94285c51462d1743fe485aa88fb4d77dd9a4661"}, |
| 645 | // Re-signs only the validated channel pointer; the digest-marker helper only reads. |
| 646 | {"internal/release/resign.go", "Signer.claimRawResign", "nonrecord", "sel:Put", "30b9a49890bde1ef0f26886c3dd3eb385de4502bc191e1e9a96cd1b75d4cc8e5"}, |
| 647 | // Dispatches CLI verb names including instances and sidecars; record writes remain in reviewed handlers. |
| 648 | // Re-reviewed at the merges of main into carlos-run (2026-10-13; again at 21d91fd6 for main's placement-shim call, #272): main's body with the one `run` verb case and its usage line; no record write. |
| 649 | {"main.go", "main", "key-site", "lit:instances,lit:sidecars", "2293301d562503e602b1734c8d036f4405d0dc2874eaab815fff9830387a842e"}, |
| 650 | // Plan 6 Task 1a: `carlos move` builds the console's move door path |
| 651 | // (/api/cli/apps/.../instances/<host>/move); it writes no record. |
| 652 | {"move.go", "moveMain", "key-site", "lit:instances", "3720fd1090c2f0d81d76157eacbd1a1e338a3bae6508167590339d2f60f2399e"}, |
| 653 | {"schedule.go", "renderScheduleList", "key-site", "lit:instances", "af6d666083fbbc753eecc98809d3d307344cc15110362a7e93afab573749ea6e"}, |
| 654 | {"internal/activator/layout.go", "LayoutInputs.sockets", "key-site", "lit:instances", "1d11ac5ac5be6a42e676e064771141fe8f4367c78cbb7e5c5cca072f40c27c42"}, |
| 655 | {"internal/activator/paths.go", "ExecBackend.pathsFor", "key-site", "lit:instances", "cbc01865e27934cb38baab9329a0867b899149531b4706a533a6956afc7c71b3"}, |
| 656 | // Re-digested for fix-empty-app-key (census-ruling-fix-empty-app-key, platform-1e 2026-10-16): DayKey now returns an error for an empty or invalid account, app, box or date, and UpsertDay returns it before any Get or Put. Same single Put of the app-day file; no record key. |
| 657 | {"internal/analytics/day.go", "UpsertDay", "nonrecord", "sel:Put", "ab892656cdbce1c80f0c33441341cf9c94dd22f06716ffffbd6c025100adb1b8"}, |
| 658 | {"internal/appconfig/configack.go", "WriteConfigAck", "nonrecord", "sel:Put", "211c8417bdbd6c6721fc503db085e9df073adeba623d9daa1e226554760ef5d1"}, |
| 659 | {"internal/appconfig/generation.go", "claimRawTouchGeneration", "nonrecord", "sel:Put", "313a5de17aee1b9ed6a344f6b785637c6978b60552a2243ef208c28eb8401a02"}, |
| 660 | {"internal/appconfig/store.go", "applyAt", "nonrecord", "sel:Put", "d234e359f44951240e6c052d87a17587845fb263ef9499dae39dae6c5c763e47"}, |
| 661 | {"internal/appconfig/store.go", "claimRawSetExecDeliveryAt", "nonrecord", "sel:Put", "ebbb8b98849e9fab8c4a15b132cd8f6fb26dff074c2cdb51247fe1e4b1c53a16"}, |
| 662 | {"internal/appconfig/swap.go", "claimRawSetSwapPolicy", "nonrecord", "sel:Put", "155218a21858f639993dc402d157358fc26cbd4abff2605be1b930aec92738d4"}, |
| 663 | {"internal/appconfig/syncexec.go", "reapNestedConfigEnv", "key-site", "lit:instances", "559691b5a516fa240e3a9d2490669ea52281fb085e728d2938970ae439c7ded4"}, |
| 664 | {"internal/awsinv/ec2.go", "ec2Resources", "key-site", "lit:instances", "3fc9a7d769c2e8bf51b7e1809488b7813a5a4b8adffd86a61081649638c14c54"}, |
| 665 | {"internal/boxid/record.go", "Publish", "nonrecord", "sel:Put", "c60d1cf14e758de490c0824b635eb5d6ac54e24b5dd05c99a576a8a03d46ead7"}, |
| 666 | {"internal/boxvolumes/volumes.go", "Write", "nonrecord", "sel:Put", "70ec487d1180d4abe18031d07f49ea98ff7d7fb222403c1ed9304c00429e7825"}, |
| 667 | {"internal/console/account.go", "WriteAccountManifest", "nonrecord", "sel:Put", "f6f1ec0f2aa488ab51850ccf47753e37736d65b94708a1cf25ee0af1152ce251"}, |
| 668 | {"internal/console/apidbclaim.go", "Server.dbClaim", "key-site", "key:RecordKey", "ba56b1742d07a47e9ccb17ff1f7a4def9722c2ef0ed51eecf6fd8550d292fa31"}, |
| 669 | // Re-reviewed for region HA 2a Task 11 fix round 1: one header line before the attach core's refusal is written (setNoCapacityRetryAfter: Retry-After 60 on the no-room 503 only). The instances key site and every write are unchanged. |
| 670 | {"internal/console/apidomains.go", "Server.handleAPIDomainAttach", "key-site", "lit:instances", "df556c7622bbc7e0fa1d01b7c0246b58f53131fbc09b26f8a166b1b7ab594f42"}, |
| 671 | {"internal/console/apidoorkeys.go", "Server.publishDoorKeysLocked", "foreign-recordkey", "key:RecordKey,sel:Put", "0fc498cd4af50570a0b7ed3ff71994213cab40040f6701a303bdf85d94f958da"}, |
| 672 | {"internal/console/apiinstancemove.go", "Server.moveTransitionSaying", "record-writer", "key:SetRecordMove", "d1f7162eecdc234607c708a83e9633cdf77cc6931bac6754fb51042dd8409377"}, |
| 673 | // Re-reviewed at the merge of carlos-run into seeded-instances (2026-10-13): main's door with the seed rule (refuseSeedMove) after its gate and before the transition; the transition is unchanged and refuses the same seed again under its CAS. |
| 674 | // Re-reviewed for home part 2, Task 5 (ruling owed): a home target is refused on the plain path (MV-N510) and for a home-named box (MV-N511) before any write, and admitted under host claims through startClaimModeMove; its record writes are unchanged. |
| 675 | // Re-reviewed for region HA 2a Task 12 (H27): two refusals before any write, both only refusing with region HA on (roomIn before the placement checks; moveRoomCheck's through selectMoveBoxes, answered by writeClaimResponseError). The record writes (SetRecordMove, instances) are unchanged. |
| 676 | {"internal/console/apiinstancemove.go", "Server.handleAPIInstanceMoveRequest", "record-writer", "key:SetRecordMove,lit:instances", "2c79a176f32ff82a269f77f47e07c1fe0a347a8bda0454179e79bda01fc7ab51"}, |
| 677 | {"internal/console/apiinstancemove.go", "Server.registerMovesPhase1Routes", "key-site", "lit:instances", "5af589d288ba22856f631481c40cc001aac342ea74cee6ee0464ec77d0320bbc"}, |
| 678 | {"internal/console/apiinstances.go", "Server.instanceManifest", "key-site", "lit:instances", "e6160ffe84abda9163527ccb33e2ffff2109b35908adb2f3a754534325658fdf"}, |
| 679 | {"internal/console/apiinstances.go", "Server.handleAPIInstanceList", "key-site", "lit:instances", "558d0b3e7b0f06faa8e5067ff6f8c131eb899f13d08b71218dfb2454c3e319e1"}, |
| 680 | // Region HA stage B: the edges read moved whole into internal/edgesfile (EvidenceComplete); the record is still created through CreateRecord. |
| 681 | // Re-reviewed 2026-10-12 (merge of main's home-region work): main's body (claimPlacementRegion) with stage B's one-line EvidenceComplete call; no new write. |
| 682 | // Re-reviewed at the merge of carlos-run into seeded-instances (2026-10-13): main's door with the two seed hand-offs: once every ordinary check has passed, a create that names `from` or `import` leaves for createFrom or createImport, which write their own record (beginFrom, beginImport, below) and refuse a claim console first (seedRegionReady); the ordinary create asks bindEnvironmentCreate before its write. The door's own CreateRecord and its claim create are as main wrote them. |
| 683 | // Re-reviewed for region HA 2a Task 11 (H27): the door asks the region HA chooser (app-derived region, roomIn) and chooses before the environment binding (chooseCreateFirst); the claim create closure is lifted into buildClaim unchanged. No write site is added or changed: CreateRecord and the claim create are as before. |
| 684 | {"internal/console/apiinstances.go", "Server.handleAPIInstanceCreate", "record-writer", "key:CreateRecord", "55b802e0cdbae1a970cc8c8a8d1f79b137f82b60cd2ce76af8a2f408f10380d5"}, |
| 685 | // Re-reviewed at the merge of carlos-run into seeded-instances (2026-10-13): main's door under the environment-binding lock (lockEnvironmentUpdate); the UpdateRecord call is unchanged, and UpdateRecord refuses any change to the record's seed. |
| 686 | {"internal/console/apiinstances.go", "Server.handleAPIInstanceUpdate", "record-writer", "key:UpdateRecord", "43a8bead675a4aa33777c6c68431882d55d79a9c1d27e1a54c8f103dda087de0"}, |
| 687 | {"internal/console/apiscan.go", "Server.writeScanRecord", "nonrecord", "sel:Put", "c3c092f4b7be9bf6bf09d0fe1e2c9fe52892ee97e57f6c7ab964b85fe36fb5c6"}, |
| 688 | {"internal/console/apisidecars.go", "Server.handleAPISidecarList", "key-site", "lit:sidecars", "6a5e461256c985ea4924bf7ba7c0793ae601a59efe8ef570913138ef8b47441a"}, |
| 689 | {"internal/console/apisidecars.go", "Server.handleAPISidecarCreate", "record-writer", "key:CreateSidecarRecord", "f3b049692e3289d9bb3c77e9e6a55dbdfac78bd9ff90af893b6cc753e76a0164"}, |
| 690 | {"internal/console/apistatusinstances.go", "Server.handleAPIStatusInstances", "key-site", "lit:instances", "2b4b9a2bea5f2fc5727869a5dcb8ae96c020e72571621f19898b195ca3b61aaa"}, |
| 691 | {"internal/console/apisystemupdate.go", "Server.mirrorSystemArtifact", "nonrecord", "sel:Put", "76a8dcb558e3723ad5774788da37c22234c229dc3257ded5a6c7b04746c69c2f"}, |
| 692 | // Settings plan 5 Task 5: the shared core behind the JSON doors (instanceGate, svcrole.Set{}, readJSON) and the instance page's forms (session, CSRF, app membership, write budget). The doors' two UpdateRecord writes moved here from handleAPIUpdatesPut and handleAPIUpdatesInstall. applyUpdates refuses a named-unit or non-instance record (shapeRefusal), validates, gates enabling on the fleet (enableRefusal), and writes only through provision.UpdateRecord under the record's etag (a lost race is a 409). |
| 693 | {"internal/console/updatescore.go", "Server.applyUpdates", "record-writer", "key:UpdateRecord", "b7454466c41fc5f0d44b70bbad938b486996b82e86158f258534d477065a5e88"}, |
| 694 | // Update now: shapeRefusal, a pin refusal, then one UpdateRecord of install_request under the record's etag, retried on a lost race. The fast-track owner check is the callers' (the API door's role read; the page gate's 404 and requireFreshAuth). |
| 695 | {"internal/console/updatescore.go", "Server.requestInstall", "record-writer", "key:UpdateRecord", "9650ffe19839f152a0fc73e04405564e691131d6ee4fc5d691e536554077705a"}, |
| 696 | // Settings plan 5 Task 5: the page forms' gate (session, CSRF, app membership, the record's 404, the fast-track owner's 404, the write budget). It reads the record and builds the instance page path; it writes nothing. |
| 697 | {"internal/console/browserupdates.go", "Server.updatesFormGate", "key-site", "lit:instances", "f2dc5d4d9d0347999d9098c775f6a492b7d949237cd876701223031703321a09"}, |
| 698 | {"internal/console/appsettings.go", "Server.handleAppGate", "record-writer", "key:UpdateRecord", "011431f5459529c0abf354edc2cb772cb6a7f2816d3bb50d91598d7d241838ce"}, |
| 699 | // Registers instance and sidecar HTTP paths; record handlers use the reviewed provision writers. |
| 700 | // Re-reviewed at the merge of main into carlos-run (2026-10-13): main's routes (the retry door among them) with the five run doors registered beside them; record writes stay in the reviewed handlers. |
| 701 | // Re-reviewed at the merge of carlos-run into seeded-instances (2026-10-13): main's routes and the run doors with the four import doors, the seeds-floor door and the legacy-routes door registered beside them; record writes stay in the reviewed handlers. |
| 702 | // Re-reviewed for region HA 2a (Task 10 and the final review's P3): the box and group role doors, registered only with host claims and CARLOS_REGION_HA both on. Neither names instances or sidecars; the key sites and record handlers are unchanged. |
| 703 | {"internal/console/authcli.go", "Server.registerCLIRoutes", "key-site", "lit:instances,lit:sidecars", "d212ac148a9f61066fde0429eaa25f4a5490115dbe48be84346f3640e80ed07c"}, |
| 704 | {"internal/console/browserrestart.go", "Server.handleBrowserRestart", "key-site", "lit:instances", "955d71813504f2cfec1e1f64817d5aa5a921aa38e1044c0e903d2cfbe4d073f4"}, |
| 705 | // Builds the instance page path and picks the confirmation line (a declined box's own line); the only write is the reviewed retry door (requestHostRetry), no record write here. |
| 706 | {"internal/console/browserretry.go", "Server.handleInstanceRetry", "key-site", "lit:instances", "4d85d392f3660373f3c282c6391f58d8e25b6df738257ccc067b816e24dfe7ff"}, |
| 707 | {"internal/console/channelmove.go", "Server.handleAPIInstanceChannel", "record-writer", "key:UpdateRecord", "91a2b3157bde9af832e8d95b17d0c384910229982945818f8b52f62dafddb342"}, |
| 708 | {"internal/console/channelmove.go", "Server.executePendingRouteChannel", "record-writer", "key:UpdateRecord", "b3b9a12213261a70b680ad5290957ebe7434eff633a73c2d80c75cc24d026d9a"}, |
| 709 | {"internal/console/claim_alias.go", "claimAliasStore.Put", "nonrecord", "def:Put,sel:Put", "a21b7cce328ebad9955211657ca8353adc7c2495b065fe09909b93c85ea7defb"}, |
| 710 | {"internal/console/claim_alias.go", "Server.claimAliasUnbacked", "key-site", "key:RecordKey", "7edc8330b15b5dc89ca17a7b043dea53dbe2d3de9a59892b5e16aa3afe6f18e8"}, |
| 711 | {"internal/console/claim_mail_admitter.go", "refusingStore.Put", "record-transport", "def:Put", "a66beae02acd7f15582f7b28157a36974e63877a75912591f0ea264e09a97d87"}, |
| 712 | {"internal/console/claim_relay.go", "Server.relayPublishGated", "nonrecord", "sel:Put", "2bec06d053666dadfdda44870ffe5c03336d354f78ed0e51a23c1c812c76b1ab"}, |
| 713 | {"internal/console/claim_retire.go", "Server.retireClaimHostRecord", "key-site", "key:claimRetireRecordKey", "820a42bcd354941e5b00520c6c5a806fa7d6d48779f779afa262a5dd30c04986"}, |
| 714 | {"internal/console/claim_retire_helpers.go", "claimRetireRecordKey", "key-site", "key:RecordKey,key:SidecarRecordKey,key:claimRetireRecordKey", "4a84350fc30ad6866855f785e40bea690655daf6399acad853c4e61871ee82a5"}, |
| 715 | {"internal/console/claim_store_effects.go", "claimEffectStore.Put", "record-transport", "def:Put,sel:Put", "679406564fa1f9816a4fe2fe9bd454ed6fdde1e16a3e7c5060c22fdb933e7b9e"}, |
| 716 | {"internal/console/domainattach.go", "Server.attachDomainAs", "record-writer", "key:CreateRecord", "c99691f92daab087137bb607a89f3dc7ef4202e83431e61ebee56553756f7f4f"}, |
| 717 | {"internal/console/domaincatchall.go", "Server.catchallListItems", "key-site", "lit:instances", "365ead1d588dfbe9397a86510c386940545bf853f77294601575f1f39c48e989"}, |
| 718 | {"internal/console/economicspass.go", "Server.upsertBill", "nonrecord", "sel:Put", "2af1ed6992d6856f5273d5ce6305fa4b9d434f94b25c9843c5cd45a6c69362b1"}, |
| 719 | {"internal/console/economicspass.go", "Server.putScenario", "nonrecord", "sel:Put", "80557ccbb43b60fe9e8a54a4aaf3be1e7982a92a9ba2d6e33be43ddf51329ab5"}, |
| 720 | {"internal/console/economicspass.go", "Server.putActiveScenario", "nonrecord", "sel:Put", "0711f7092a78e391af67eca8c4a5b30224297bbddb8c7a92add8c375faef3bff"}, |
| 721 | // Re-reviewed at the merge of carlos-run into seeded-instances (2026-10-13): main's body with the seed rule ahead of its writes (placeSeedBlock, a strict read that writes nothing) and SetRecordRegion's seed refusal answered as its sentence; the stamp is still SetRecordRegion. |
| 722 | {"internal/console/fleets.go", "Server.placeAppTarget", "record-writer", "key:RecordsPrefix,key:SetRecordRegion", "4db293feeb0709c6c9c113e6bf438525f7d60a7d16849d8610c4db0c553f8dbf"}, |
| 723 | {"internal/console/geoipfeed.go", "geoipFeeder.writeStatus", "nonrecord", "sel:Put", "ec634a43acb480fd1a65723bf370f7ce4e13faaf48229ddfa682efb50807ee07"}, |
| 724 | {"internal/console/geoippublish.go", "geoipPublisher.Commit", "nonrecord", "sel:Put,sel:PutObjectFrom", "c86ed5277e20e40b0fef15badc2baa4da03625bc7d9b0456ead59fcd79257234"}, |
| 725 | {"internal/console/geoippublish.go", "geoipPublisher.ExpireIfDue", "nonrecord", "sel:Put", "a7d4f24a25c7bda40f18268d34a99203b58aa07bc10eda0db2306b54cb08302b"}, |
| 726 | {"internal/console/hostreports.go", "putHostReport", "nonrecord", "sel:Put", "d8ba8c77b5f0ee5bcde5c11f4a608cf2bd2491c36b8cb9bf26753a230d485ad4"}, |
| 727 | {"internal/console/infrapass.go", "Server.putInventory", "nonrecord", "sel:Put", "c5d930ec178ee206d25194a2b265738ac42c6f00bd9b73626e4d46d769d370ad"}, |
| 728 | {"internal/console/instancepage.go", "Server.handleAppInstance", "key-site", "lit:instances", "abc4169a7d1d865fa7a31ec858aba7c3f48f15bcd327125320b9dcd772664720"}, |
| 729 | {"internal/console/relayops.go", "Server.relayAcquire", "nonrecord", "sel:Put", "3c757e1c92f1c0ce41c3b5f00aa1397ce5a0c4faabc2f176b23355cf5a41f5fb"}, |
| 730 | {"internal/console/relayops.go", "Server.relayPublishOnce", "nonrecord", "sel:Put", "783a3c20337914e08f92be783f6b48ab14288437a8043c0d5bf29f281a7a9b1d"}, |
| 731 | {"internal/console/relayops.go", "Server.relayRotate", "nonrecord", "sel:Put", "58e0090a4990e2d5e793cec2ec7bcbfb3626b4043307f64484a55766099e1434"}, |
| 732 | // Re-reviewed at the merge of carlos-run into seeded-instances (2026-10-13): main's body plus the start of the seed scratch pool; no record write. |
| 733 | {"internal/console/server.go", "NewServer", "key-site", "lit:instances", "4d82a68616a6754966ced46d8d12541fcda64de9e1856c3440a127a9c533b032"}, |
| 734 | {"internal/console/server.go", "Server.PublishMovesConsole", "nonrecord", "sel:PutReplace", "b228397d413769f93209645db9ac6bd4a47cc9db31f06c8699cb540cffea9b5a"}, |
| 735 | {"internal/console/server.go", "Server.handleAppInstances", "key-site", "lit:instances", "7368e00fa1bf20365b61361815db216441b7fd21b3d330349dc09170045d45b7"}, |
| 736 | {"internal/console/server.go", "Server.handleAppActivity", "key-site", "lit:instances", "265425be83a63bf2fbcd88e1b75600933cf1a2e8b7fa9cc90046fdd329db9786"}, |
| 737 | {"internal/dbverify/dbverify.go", "RemoveHost", "nonrecord", "sel:Put", "a96ff33a7a9e701ad101882a0f547daf31dda54e014d8d072288a48d4b95bdeb"}, |
| 738 | {"internal/dbverify/dbverify.go", "Publish", "nonrecord", "sel:Put", "b6a7ef8e5a55e6f8e5bc15ef1c4f2f67563415d47ecfbb6abde030a514e521ee"}, |
| 739 | {"internal/domains/claims.go", "instanceRecordsPrefix", "key-site", "key:instanceRecordsPrefix,lit:instances", "02326f5fa12f8089efb9663fa6d173f46dd6fcfdbc825486eace92620c99e593"}, |
| 740 | {"internal/domains/claims.go", "InstanceLabelCounts", "key-site", "key:instanceRecordsPrefix", "b5f1973882f03cfebe014aae4738170801c5c9e766ebc552d5843a68007f3eb1"}, |
| 741 | {"internal/domains/claims.go", "claimRawAttachInstanceCatchall", "nonrecord", "sel:Put", "518862e2aea95872024effbb16a621dba4ebf7314a18d5ddd7acb1671d6776e7"}, |
| 742 | {"internal/domains/claims.go", "AttachClaimProven", "nonrecord", "sel:Put", "82ea07f38d6a9a83e9253b9b336a344bfe692ed61a6c8246450bdf739a8c5d3b"}, |
| 743 | {"internal/domains/claims.go", "claimRawSetClaimCapabilities", "nonrecord", "sel:Put", "96dcbb0646559b45d7a7e2920fab2c770ed57c30666a7d52e18d379c50cc9fea"}, |
| 744 | {"internal/domains/claims.go", "claimRawSetClaimPaths", "nonrecord", "sel:Put", "03506119ddd2397713b2ba2cfb0b22a986229789061fcdbf970c8b7eb052069c"}, |
| 745 | {"internal/domains/mint.go", "MintAccount", "nonrecord", "sel:Put", "1fda85a4c1a4b09a718a96e03d65880d72cdaa2fd098ad305605eeb98a0349e7"}, |
| 746 | {"internal/domains/mint.go", "TombstoneAccount", "nonrecord", "sel:Put", "9a400aa9e915f5df8060840701356e381bdf9be7c5af6f312cc09ab428900ecd"}, |
| 747 | {"internal/doorkey/doorkey.go", "RecordKey", "key-site", "key:RecordKey", "a29b62f6e3a9e9f0e412dae7e477db7e7d5702afb3a92080b41bde37008d9ace"}, |
| 748 | // Updates only the in-memory HTTP response cache and its indexes. |
| 749 | {"internal/edge/cache.go", "Cache.Put", "nonrecord", "def:Put", "e8e181c0cfcb4d209fbf2e2f799d8ef4613fbb40d0798cecb7c39d2c3f0c6860"}, |
| 750 | {"internal/edge/certsync.go", "publishingCache.Put", "nonrecord", "def:Put,sel:Put", "7bec290d7bb8ba424de938cb6c497d882c863f9d0470bee4f22b56fd292f6d57"}, |
| 751 | {"internal/edge/certsync.go", "putCAS", "nonrecord", "sel:Put", "31e2563a764ea33230161c2c2f12b307a4f171d287b835b5027d0db98448ded9"}, |
| 752 | {"internal/edge/certsync.go", "certMirror.reconcileLocal", "nonrecord", "sel:Put", "df50be24efba72ae51d6ca85ef7ddebc1b10509d3cc062be97af5e6573dcc1d5"}, |
| 753 | {"internal/edge/certwarm.go", "certWarm.fail", "key-site", "key:writeRecord", "0a0b03ee3a35396dba8fe6c9a66d20bbf2140667851432e621e4ef0029f81403"}, |
| 754 | {"internal/edge/certwarm.go", "certWarm.writeRecord", "key-site", "key:writeRecord", "0e85abae4c53c673f288898e7ae299929f4fcecc6b6abfe0d1a1bd7af6bcc5c3"}, |
| 755 | {"internal/edge/compress.go", "gzipWriter.finish", "nonrecord", "sel:Put", "501f6118a3e983ea6b197a64dd9495afde8bbb0fb439a2bd6aab1f241fd68c20"}, |
| 756 | // Calls the in-memory edge Cache.Put, not a deployment store writer. |
| 757 | {"internal/edge/edge.go", "Edge.maybeStore", "nonrecord", "sel:Put", "89231cd6ebfa293c307f502a7bf7236373199489e6846e0c3b8ccf281594b9ab"}, |
| 758 | {"internal/edge/mesh.go", "mintMeshKey", "nonrecord", "sel:Put", "bfb55866660051d4c55b2a1be96e7f997c76042119a8f57472fbc41908a2dcc0"}, |
| 759 | {"internal/edge/storedoor.go", "storeDoor.serveObject", "record-transport", "sel:Put", "95fef5f91ed7a5f07a3818b1a55baded4209e97d43d48ba21cb69be3d2c7299d"}, |
| 760 | {"internal/edge/wildcard.go", "wildcardManager.obtain", "nonrecord", "sel:Put", "752840841afb596cba318e5c7ece964c5146a7a24edde91f9c9dc0024753dc3b"}, |
| 761 | {"internal/edge/wildcard.go", "wildcardManager.accountKey", "nonrecord", "sel:Put", "77f7da94e302045eff8cbbb1be311bdcbaf75cc4cdd8f794d474e508fbf35a51"}, |
| 762 | {"internal/fleetapi/fleetapi.go", "store.Put", "record-transport", "def:Put", "68f7424cbbaf8fffde48429ae29198cf6e4fcf768c512657b305224febc11186"}, |
| 763 | {"internal/genselect/select.go", "requestLocation", "key-site", "lit:instances", "12ef5b8f94be7575ec7ab5f169736320ee6938440387fe5ea99b96f2a528cca0"}, |
| 764 | {"internal/host/bootstrap.go", "const tmpfilesConf", "key-site", "lit:instances", "71d83f240cb1c3ab6f9dd2954b1f3e93b90133362ec12193746f60e75aeced7d"}, |
| 765 | {"internal/host/bootstrap.go", "bootstrapWith", "key-site", "lit:instances", "36ff18685872be8adfbf02d05676990bf9097c0fcc9695d3cae2f905ec59665c"}, |
| 766 | // Region HA stage B: installs root's relocating attempt reader behind CARLOS_REGION_HA; names the instances root for the launch, writes nothing. |
| 767 | {"internal/host/claimlaunch_production.go", "claimLaunchFor", "key-site", "lit:instances", "b6c4f60ed5783496e89c45c9c612cbd8758b6a05c19a706c5eb5640dfea2505d"}, |
| 768 | {"internal/host/claimretire_transport.go", "retirementAcknowledgement", "nonrecord", "sel:Put", "5c09795fbe9b952436d16bcd58e846ac27e9dbcf959fcf1cd6c432af0f3ee416"}, |
| 769 | // D1 compares the retained registration's record key to the fresh claim; no record write. |
| 770 | {"internal/host/rootexecution_authority.go", "ClaimRootHTTP.executionAuthority", "key-site", "key:RecordKey", "107989f561409fd8c11c2666d0672b8dbeb368842fe00ad6a7b84fece2150438"}, |
| 771 | // Re-digested for fix-empty-app-key (census-ruling-fix-empty-app-key, platform-1e 2026-10-16): a chunk key the errors builder refuses (empty or invalid account or app) drops that app's records and logs once; no Put happens for it. Same single Put of the errors chunk; no record key. |
| 772 | {"internal/host/errship.go", "errshipFlush", "nonrecord", "sel:Put", "b340b3dede6d5cab08a13a2ee8dbef5bb6dfb4943264e9835489292c479a379d"}, |
| 773 | {"internal/host/fleetbind.go", "WriteFleetBinding", "nonrecord", "sel:Put", "44ab984c2c9b30abcc938132118f61a6922ccc0cd40ed2b6cb61c7654aa0a1c3"}, |
| 774 | // Re-digested for fix-empty-app-key (census-ruling-fix-empty-app-key, platform-1e 2026-10-16): as errshipFlush, for the logs family. Same single Put of the log chunk; no record key. |
| 775 | {"internal/host/logship.go", "logshipFlush", "nonrecord", "sel:Put", "214a52ecc3bef193b8edcd6998cdaa75da182d552f4e605f68a5dededa4ffb68"}, |
| 776 | {"internal/host/metrics_loop.go", "putAlertState", "nonrecord", "sel:Put", "d5b6e8b34dc5a731d6bbafeac0b7d0c5c20706d6f413dff38088b3321b35a26c"}, |
| 777 | // Clears an aborting record through SetRecordMove (MoveGuardedAbortComplete) once nothing is owed under the op, then ReleaseAbort: record first, ruling M4. |
| 778 | {"internal/host/movesabort.go", "movesWorker.abortSource", "record-writer", "key:SetRecordMove", "51bafe02fe16f07c1f1e08cfbc224ba21c8277ec065fff1142349afe0dde675b"}, |
| 779 | {"internal/host/movesarchive.go", "cutRun.publishCutArchive", "nonrecord", "sel:CopyVersioned,sel:PutIfAbsent", "6c7fcfd2d4b2a0319ac15ecbfe003ed0292fe160457fd5704be508c2ab302a1b"}, |
| 780 | {"internal/host/movescut.go", "cutRun.cutTransition", "record-writer", "key:SetRecordMove", "3ec34659c98aa9ec12221b30363d0e79a3b2d77b99051e0484f2a923c884c0af"}, |
| 781 | {"internal/host/movescut.go", "publishStoppedReport", "nonrecord", "sel:Put", "c710682f31d99127ad76524add246fda9f640c63934940e45c79ea25ba36eb3c"}, |
| 782 | {"internal/host/movescut.go", "cutRun.snapshotTimers", "nonrecord", "sel:PutIfAbsent", "9137042d3c269f8cfc94bd9d04cde24423e8824986521906c73159cd0a552ca4"}, |
| 783 | {"internal/host/movesguard.go", "guardedMirror.CopyVersioned", "versioned-transport", "def:CopyVersioned,sel:CopyVersionedAt", "069edf385ccc13d50452bd97eae222c0312a629a48d619c922f9985aa1c99a7b"}, |
| 784 | {"internal/host/movesguard.go", "guardedMirror.Copy", "versioned-transport", "sel:CopyVersioned", "1689745fdd642c0dbe855b12b8d1ef220f3a9c3daed7ca49bdeddfd6ff9d5ade"}, |
| 785 | {"internal/host/movesguard.go", "guardedMirror.PutIfAbsentVersioned", "versioned-transport", "def:PutIfAbsentVersioned,sel:PutIfAbsentVersionedAt", "68457755ed3c8b470064e9ccbefe42c819f877d596352669d7126d6032a7726f"}, |
| 786 | {"internal/host/movesguard.go", "guardedMirror.Put", "versioned-transport", "def:Put,sel:Put", "a3168524604a41ea42e8fcf6e5a1335e4ea7be77fde089aca6ad74dc64b43649"}, |
| 787 | {"internal/host/movesland.go", "landingRun.transition", "record-writer", "key:SetRecordMove", "0b197834835dc9afad77f89358d2bcab9512128dcf43070a3765e430526dbfb1"}, |
| 788 | {"internal/host/moveslandpark.go", "leasedStore.CopyVersion", "versioned-transport", "def:CopyVersion,sel:CopyVersion", "a8b33c9f61f59477b76fa50472250622c717ab2883f32837c601da5eeb497e9d"}, |
| 789 | {"internal/host/moveslandpark.go", "leasedStore.PutIfAbsent", "versioned-transport", "def:PutIfAbsent,sel:PutIfAbsent", "33542589bf2a336b181f685bd0dc5faa0285449e5ca9e850e9f4e0e7e4164c6b"}, |
| 790 | {"internal/host/movesmeasure.go", "measureS3", "nonrecord", "sel:Put", "3ae9fc093b453e19a5b19be0929533b30a0e2a3e998ba8dc766f41287db2caca"}, |
| 791 | // settings-4: added step 3b, cfg.CarryRequest into build-state.json at the |
| 792 | // hibernate prefix in OwnBucket (buildStates.write); record writes are still SetRecordMove only. |
| 793 | {"internal/host/movespass.go", "legacyMoveRound", "record-writer", "key:SetRecordMove", "ea9e188a104cfd4a69193e8be67b8c64ebb82478a69580104f8e46d8cf1f9663"}, |
| 794 | {"internal/host/movesphase1.go", "writeMoveLedger", "nonrecord", "sel:Put", "597a70ac06ceb4e9eb52bb9f61b28a4937e703fa4a0916f64bd95d9594f0556e"}, |
| 795 | // settings-4: added the build-state lane (mirrorBuildState: holder location's |
| 796 | // build-state.json to the move lane's state/ prefix in the data bucket); no record key. |
| 797 | // moves-overcap-cut (#236): sourceRefusal is passed the claim holder for the |
| 798 | // files manifest preflight; the write sites are unchanged. |
| 799 | {"internal/host/movesphase1.go", "movesWorker.sourceRound", "nonrecord", "sel:PutIfAbsentVersioned", "aacb3d17ad302c969e05ccfc0e091c4c6a2b0d6cc3791fa5f717ee7ad905a9e7"}, |
| 800 | {"internal/host/movesphase1.go", "movesWorker.refreshCrossRate", "nonrecord", "sel:CopyVersioned", "7e03e680bd61be26dddcf168cacd2427bb535571dfd326c4a3130ebe65ea1968"}, |
| 801 | // Re-reviewed for home part 2, Task 2b fix round 2 (ruling owed): the |
| 802 | // report's env is moves.ReportLaunch with the instance's layer names; it |
| 803 | // still writes only the source report under the move's report prefix. |
| 804 | {"internal/host/movesphase1.go", "movesWorker.writeSourceReport", "nonrecord", "sel:PutReplace", "585c0c5bb9b8c20d5a5d77dc08e49720268951ec30bbc1175db9c83900c817f2"}, |
| 805 | {"internal/host/movesphase1.go", "movesWorker.decideReady", "record-writer", "key:SetRecordMove", "d29c22eafacfb894b96cd0c40ec447b6ab02f46ea087201685627861f992085d"}, |
| 806 | {"internal/host/movesreport.go", "movesWorker.targetReport", "nonrecord", "sel:PutReplace", "9a761daeb0a9018ad409ed353c6da6f9e523c63d46ab2c248000327d5f7fcd4f"}, |
| 807 | {"internal/host/movesstore.go", "laneProbe", "nonrecord", "sel:PutIfAbsent", "f4a17a1143e7370b9039b2e66e736606015c46619bab92c553ce7b1ad6b7918b"}, |
| 808 | // The relocation build's write-through store (region HA ruling 59): every write re-checks the install authority (claim, guard, Local) first, |
| 809 | // writes only P's generation under the data bucket through moves' shared build, never a record key, and never deletes. |
| 810 | {"internal/host/relocationbuild.go", "authorityStore.CopyVersion", "versioned-transport", "def:CopyVersion,sel:CopyVersion", "43094463f918b134d6260d5f8db154e83edd07a738e89f020a2df563334b10cd"}, |
| 811 | {"internal/host/relocationbuild.go", "authorityStore.PutIfAbsent", "versioned-transport", "def:PutIfAbsent,sel:PutIfAbsent", "b72a077c23b92c84d67a1f4563299014ccfc9046c3137f0d8ca707ac3991099f"}, |
| 812 | // Reads the relocating host's record at its key and mints the nested route from it (RouteFor, ruling 45); no write. |
| 813 | // Re-reviewed 2026-10-12: it also reads the app manifest's update policy for RouteFor (relocationUpdatePolicy, a Get); still no write. |
| 814 | {"internal/host/relocationinstall.go", "relocationRecord", "key-site", "key:RecordKey", "4271b1a1b0500da0cf1d4c52de1e6f26e7ac9c9bda85a64ff735ab584e9c5ee3"}, |
| 815 | {"internal/host/snapshot_loop.go", "registrySnapshotPass", "nonrecord", "sel:Put", "6b01b46b361c3a2d1d432659a0d234c01975849b9a8ac5571858fdd78d376849"}, |
| 816 | {"internal/host/snapshot_loop.go", "putReplacing", "nonrecord", "sel:Put", "11e8639effce142eab707b67cbdd425d0d7cea510ddf95d292bdba8f79c9b510"}, |
| 817 | {"internal/hostactors/censuskey.go", "Directory.BindCensusKey", "nonrecord", "sel:Put", "7d9d673435e8c8a6aac3105e3a754bde2adcbc5d603945dd599cef703f334a5b"}, |
| 818 | {"internal/hostactors/invitation.go", "Directory.Invite", "nonrecord", "sel:Put", "356618a75a23d0157d8e0402e20187a42956f67a4332d698bb22bf05133ac489"}, |
| 819 | {"internal/hostactors/roster.go", "Directory.Replace", "nonrecord", "sel:Put", "e6e8ac0070650dfacc4a438b080cb69738530b3d9013de55c1bcf06431b0a847"}, |
| 820 | // Region HA plan 2b (Task 4): the store a membership read binds to its |
| 821 | // deadline; it forwards Put, refuses it once the deadline passes, gives |
| 822 | // it at most storeCallTimeout, and reports one that answers late as |
| 823 | // unknown. |
| 824 | {"internal/hostactors/membershipread.go", "deadlineStore.Put", "nonrecord", "def:Put,sel:Put", "13b4bb3bcdd74076f4c1edece9b888fb8889fe3de459c468d61336240a42b685"}, |
| 825 | {"internal/hostbox/regionalworker.go", "RegionalWorker.Census", "key-site", "lit:instances", "477bcb896b5ae8ec80af592d68eceb7992ad8a23cd6cff6043ad03b3ef2a8085"}, |
| 826 | {"internal/hostbox/requeststore.go", "RequestStore.CopyVersion", "versioned-transport", "def:CopyVersion,sel:CopyVersion", "3a50049ce7ca7f2cbc770bef46218944cdc7000205a86c20e4932f0b510da28f"}, |
| 827 | {"internal/hostbox/requeststore.go", "RequestStore.PutIfAbsent", "versioned-transport", "def:PutIfAbsent,sel:PutIfAbsent", "3666cbe5d2b91c1c652ffb4459c10a374fbd92e325e4e5c574fa3525d0ce2ffe"}, |
| 828 | {"internal/hostclaim/adopt.go", "Adopt", "key-site", "lit:instances", "24c06b99cce6c638acb19826985cfadd3c736fd0ace7289bcf7ac3dfe784f05a"}, |
| 829 | {"internal/hostclaim/claim.go", "ParkScope.Validate", "key-site", "lit:instances", "80b798b0cb679d8c533ff562c0c4804c06f53e7dba126250a3c8182f7ff0c08c"}, |
| 830 | {"internal/hostclaim/claim.go", "holderKeyMatches", "key-site", "lit:instances,lit:sidecars", "d15a6841ea6f8cbfa9c8407fd3af020ddeacdfa0743b9e17de412f113faf7979"}, |
| 831 | {"internal/hostclaim/claim.go", "Claim.Validate", "key-site", "lit:instances", "2debcd30dda4747b8b3b00d576998f1fdc1d364ad9bacba1e1279df0b7dfb694"}, |
| 832 | {"internal/hostclaim/create.go", "BeginCreate", "key-site", "lit:instances", "45ee1e2b1fc9fa8ffdef4f27cf983dccfa3acf7218dccd06f0ee6d12572f4a44"}, |
| 833 | {"internal/hostclaim/lossrecord.go", "LossRecordKey", "key-site", "key:LossRecordKey", "1b109b49a8fcdb09f01dbf908a173394072f01afb0c9e324023fb9b3f71f98b3"}, |
| 834 | {"internal/hostclaim/lossrecord.go", "ReadLossRecord", "key-site", "key:LossRecordKey", "1237dd3fa3e79a81e6c35f371bf545c9a04841a6297c078d96852daf25b7b483"}, |
| 835 | {"internal/hostclaim/lossrecord.go", "CreateLossRecord", "foreign-recordkey", "key:LossRecordKey,sel:Put", "e62263731fa572ed6f195a267abb63ff5a1bf44284db3db76a819ccaec238191"}, |
| 836 | {"internal/hostclaim/lossrecord.go", "ReplaceLossRecord", "foreign-recordkey", "key:LossRecordKey,sel:Put", "576589457e4a18b64e6b56892603051982bd01770c355504305e72d53149bc52"}, |
| 837 | {"internal/hostclaim/origins.go", "originTuple.valid", "key-site", "lit:instances", "7f6f20f51e51694d665588f0b986def85bda4789f24623ee1993289265b01355"}, |
| 838 | {"internal/hostclaim/origins.go", "commitOrigins", "nonrecord", "sel:Put", "2d3a27e56510db9ec2d54d85b354f72b72da1080c7b4182535040f2d30e36888"}, |
| 839 | {"internal/hostclaim/store.go", "Update", "nonrecord", "sel:Put", "083ddd3e076a07db2b5fca70a9b56fa022782deafb9ad56c77f8f32515633906"}, |
| 840 | {"internal/hostevidence/signature.go", "immutable", "nonrecord", "sel:Put", "54fb2bdc230c2cb4193f3b808004b63bcfd092266846fc0c03e61617c3ad0ab5"}, |
| 841 | {"internal/hostexec/controller.go", "Controller.run", "nonrecord", "sel:Put", "03df11b375761730700ce30c0db05c57f0828629eda0a5de126ea1a2f2f7501c"}, |
| 842 | // D1: conditional execution lease write under control/hosts/<host>/exec/<box>.json; no deployment record key. |
| 843 | {"internal/hostexec/rootbroker.go", "RootBroker.acquire", "nonrecord", "sel:Put", "63226d41e26fb28dfc0fd2168386cde8191c02391d07d5d449aa5f963f498147"}, |
| 844 | {"internal/hostfence/termination.go", "TerminationWorker.persist", "nonrecord", "sel:Put", "47758114adcc3c493a9d1ead0fa7087ad0d1e49595c891bab4dfb51c9058a8a1"}, |
| 845 | {"internal/hostfiles/contract.go", "CopyManifest", "nonrecord", "sel:Put", "9754b113ca2cad5e267402a44ac25de778e332d0c87027767f9a7daa4937d9fd"}, |
| 846 | {"internal/hostfiles/publisher.go", "Publisher.put", "nonrecord", "sel:Put", "4bf1d0c4ab995f4e5afa8d7675cbd00446da006a82a659764f8013c011f9efaa"}, |
| 847 | {"internal/hostfiles/publisher.go", "Publisher.Commit", "nonrecord", "sel:Put", "ac478b1481392013e39f50d6650f049e625992de313cd4ba593909b9e3e14a10"}, // reviewed 2026-10-12: adds the 4095-byte path-cap refusal (400a3302) before the same manifest Put; class unchanged |
| 848 | // prepared.go (moves Task 6, C8): the create-only prepared manifest and its |
| 849 | // sequence-0 objects under a generation's files prefix; never a record. |
| 850 | {"internal/hostfiles/prepared.go", "Prepared.Commit", "nonrecord", "sel:Put", "375def2559531419376e77104d3b86c318a0b6181055947aa6d57e68b53061de"}, |
| 851 | {"internal/hostfiles/prepared.go", "Prepared.put", "nonrecord", "sel:Put", "902a2f060e7475a68d5d3eb2cfbff14f8de2cbcef35d690931f81e25ae3d9182"}, |
| 852 | {"internal/hostguard/record.go", "writeRecord", "key-site", "key:writeRecord", "0ba1097cba3d4a5f5fc0b06765de6f8ee535befb939e83f1cc7167c7996ac60b"}, |
| 853 | // Re-reviewed for merge review S2 (2026-10-13): before it checks the frozen hosts, Publish refuses the census while any box's report carries no seed state, any box journals or gates an import, or any record's seed is unfinished (activationSeedRefusal, reads only). Its one Put, of the backfill manifest, is unchanged. |
| 854 | {"internal/hostops/backfill_publish.go", "Backfill.Publish", "nonrecord", "sel:Put", "e38e617a2f62b857cdf5c0fadf7ffe11d32e7287c15d46cc6f08f1aa812ac6bb"}, |
| 855 | {"internal/hostops/backfill_publish.go", "PublishCensusReport", "nonrecord", "sel:Put", "5c7ae54a82c3cf47d166c3b02123b60a9aff06e52b500a34d84cd668f4e29b36"}, |
| 856 | {"internal/hostops/control_writer.go", "ControlWriter.updateAdmission", "nonrecord", "sel:Put", "b8777d9f07582d452e6d12a4e2f417e9c1804f1b87d32b13cb7172c515854cf5"}, |
| 857 | {"internal/hostops/create_effects.go", "ProductionAuthority.RecordEffects", "record-writer", "key:WriteRecord,sel:Put", "21550e2b7d739956fcfad7b9ad7aaaf7a3f8c98948de8417ad9fd557f666251f"}, |
| 858 | {"internal/hostops/enroll.go", "ControlWriter.EnrollNewApp", "nonrecord", "sel:Put", "93cfb1ab60a67dcfa13bf674736284edfb60076fcf5a22d6eefae2c31ce50275"}, |
| 859 | {"internal/hostops/enroll.go", "ControlWriter.EnrollBackfillApp", "nonrecord", "sel:Put", "db2de4e780333bb4c2507e50ef81be2bb87467b2ea38ae7599fa283eedcb056b"}, |
| 860 | {"internal/hostops/geoip_classifier.go", "classifyGeoip", "reference", "str:Put", "f752cc89ab5c507fe5681bfce9fd99d8870b83af5c81ec30ddcaf70847ad02f5"}, |
| 861 | {"internal/hostops/lifecycle_grant.go", "authorizeSignedControl", "reference", "str:Put", "cf012aebc7b4e0ea8dfef48ea3817a7466f1dabacd7cf1e5be07b2302bf183ba"}, |
| 862 | {"internal/hostops/lifecycle_record.go", "type lifecycleRecordKey", "key-site", "key:lifecycleRecordKey", "09ab1fd62d0be032bd735d1f60488cdb19128f8573b00bbd7a70f582208da75d"}, |
| 863 | {"internal/hostops/lifecycle_record.go", "setLifecycleRecordMove", "record-writer", "key:SetRecordMove,key:lifecycleRecordKey", "37691dfd5158c644b12e28383243f92a7868e075eade79be79e7149a18f8d420"}, |
| 864 | {"internal/hostops/lifecycle_record.go", "conditionalRecordStore.putLifecycle", "record-writer", "key:putSequencedRecord", "b30ba2a61b2b15af36b464b2f5284923c8e137d5f46bde344f4f55474ebd90cd"}, |
| 865 | {"internal/hostops/mail_gate.go", "ControlWriter.AcquireMailGate", "nonrecord", "sel:Put", "f37147b214f176da0565268aba714f15216f3bdd9c5f279d6c404098a499b482"}, |
| 866 | {"internal/hostops/mail_gate.go", "ControlWriter.ReleaseMailGate", "nonrecord", "sel:Put", "aea8bc583a0a28cd61e8c81c6d466b02e4fb6a086ba921f01fdd7dfdb286191c"}, |
| 867 | {"internal/hostops/mail_gate.go", "ControlWriter.RecordMailGateMember", "nonrecord", "sel:Put", "ed87514c0cfd15664765deb5aa0051c37b14ecebf0ba1a77459da4f8b7e7465f"}, |
| 868 | {"internal/hostops/mail_reconcile.go", "ControlWriter.ReconcileMailGate", "nonrecord", "sel:Put", "6f9d68daf39704885ada14b7dc9f3e8e5a0424455489aed45fc7b166bdb8e726"}, |
| 869 | {"internal/hostops/move_start_resolve.go", "moveStartRecorder.Put", "record-transport", "def:Put,sel:Put", "a8c7bd673b4af12624ce0f12198c51eef1fc1dc658e9aec7e45bfc2f72124b95"}, |
| 870 | {"internal/hostops/move_start_resolve.go", "decideMoveStart", "record-writer", "key:WriteRecord", "11a22d2cfd9cc4efb6afc3417e034fa881c1ff1491fba11a4dd04dfb3d9dcdea"}, |
| 871 | {"internal/hostops/mutation_boundary.go", "mutationBoundary.Put", "record-transport", "def:Put,sel:Put,str:Put", "c4222199cdbfa8cce1f97f91bf41fe94857f4d833e30b17636c40f1aae39ff67"}, |
| 872 | {"internal/hostops/mutation_boundary_putfrom.go", "mutationBoundary.PutFrom", "record-transport", "def:PutFrom,sel:Put,sel:PutObjectFrom,str:Put", "8d015a924901f0c41e142181f986cb9d2a3bdfa6a9e078dfda05a2d1e7cf9b24"}, |
| 873 | {"internal/hostops/mutation_boundary_putfrom.go", "conditionalRecordStore.PutFrom", "record-transport", "def:PutFrom,sel:Put,sel:PutObjectFrom", "3c3cb33a601eab5c4d74042a7ca8baf411c0549508b5a8273ef88f4ee0e9636c"}, |
| 874 | {"internal/hostops/mutation_classifier.go", "lifecycleFamily", "reference", "str:Put", "75df2a3966d0bfe4b4b367617de3ebe28055a38ef4738f352859ba94ddbff241"}, |
| 875 | // Classifies mutation keys and method names without executing a store write. |
| 876 | {"internal/hostops/mutation_classifier.go", "ClassifyMutation", "reference", "str:Put", "2d22e1d4a99a69ebff6f033a667f59c778855a66828ee5c7646a6b1d18573b65"}, |
| 877 | {"internal/hostops/mutation_classifier.go", "ownerUnion", "reference", "str:Put", "0c35233653dfe9ca6cc78bc54bac2c6991f82c9a7c2fd27c228c125f099f489b"}, |
| 878 | {"internal/hostops/mutation_classifier.go", "classifyRelayAuthority", "reference", "str:Put", "2887dce5f9f73b637c3a66308fe315f3ee20369263aa462b644d85048cdffc08"}, |
| 879 | {"internal/hostops/mutation_classifier.go", "classifyRelayIssuer", "reference", "str:Put", "106e4975e12208e561ac4a021a24db9390ac0ad6e40e76d68886be3275335cc1"}, |
| 880 | // Region HA (d1ce3f72): the executor is selected once before the create CAS (SelectExecutor, BeginCreateOn, claim writes); the record is still written through WriteRecord. |
| 881 | {"internal/hostops/operations.go", "Controller.Attempt", "record-writer", "key:WriteRecord", "518d0f8375c7f414c34250de05e4db93683ee04b9251b8075c729982d801425b"}, |
| 882 | {"internal/hostops/purge.go", "ReservePurge", "nonrecord", "sel:Put", "176d5e62d9410122043d2c5e534bda4dfc66b438226c54482389f5e5b0bf8976"}, |
| 883 | {"internal/hostops/purge.go", "AdvancePurge", "nonrecord", "sel:Put", "f0fc6dabadaa5cc6a34c8656f3a6ca04ead8bc56d0bca1e539b0cde937d23c17"}, |
| 884 | {"internal/hostops/purge_control.go", "ControlWriter.ReservePurge", "nonrecord", "sel:Put", "902ee70445e47674aa91e80a377346dfef46ad25451a885acf69a6c017ba11a0"}, |
| 885 | {"internal/hostops/purge_control.go", "ControlWriter.SavePurgeJournal", "nonrecord", "sel:Put", "b993c774d2d78de826f2cc33ee0f7f7086cf9452dee328f4bc2b017c1f1989c2"}, |
| 886 | {"internal/hostops/purge_journal.go", "PreparePurgeSweep", "key-site", "lit:instances,lit:sidecars", "e267dc12d744cdb041e94676c7420d8183a4924c03f87e5d1e5061366f3e70d0"}, |
| 887 | {"internal/hostops/record.go", "ReadRecord", "key-site", "key:RecordKey,key:SidecarRecordKey,lit:instances,lit:sidecars", "312a2accb2ccb01f1f55a63ad6b97362e234959a0db07593ae5d37c0448e6d4e"}, |
| 888 | {"internal/hostops/record.go", "Records", "key-site", "key:RecordsPrefix,key:SidecarsPrefix", "7c0055d4e5e2ee8b269b0016f4637dad1bb93bac10273403cfb4f20ef567dfd0"}, |
| 889 | {"internal/hostops/record.go", "PrepareInstance", "key-site", "key:RecordKey", "ba2f91ad03e8e7dbe61c4ea4be41fdfb117e024f4ff98ba528214de368737105"}, |
| 890 | {"internal/hostops/record.go", "PrepareSidecar", "key-site", "key:SidecarRecordKey", "87f836e68baef64540fa76b4b53f7e02c09811bb9fc1e88ac8316fcf71a50593"}, |
| 891 | {"internal/hostops/record_sequence.go", "putSequencedRecord", "record-writer", "key:WriteRecord,key:putSequencedRecord", "918911815b9b686ddce3ac72244f0e6c2c0167aeb2b81ee8e72d7b5f12fc407b"}, |
| 892 | {"internal/hostops/record_writes.go", "provisioningKey", "key-site", "key:IsRecordKey", "02956434b2d58bf6b7803eaef1355e31e7bf5ae9b46dcf21b5150d03ce018f1a"}, |
| 893 | {"internal/hostops/record_writes.go", "conditionalRecordStore.Put", "record-transport", "def:Put,key:lifecycleRecordKey,key:putSequencedRecord,sel:Put", "ac3b57df2e57d691d6d8c5456ca02b303e93aab43ce87e544e255f65586f7436"}, |
| 894 | {"internal/hostops/retirement.go", "Controller.RetireRecord", "key-site", "key:RecordKey,key:SidecarRecordKey", "6baf2d85f03536957f39b576dfcd0b24101da0fed7846dd15d56355d2198aa73"}, |
| 895 | {"internal/hostops/sidecarwake.go", "ProductionAuthority.TouchSidecarWake", "key-site", "key:SidecarRecordKey", "c6fb9c19d0c3097cdb879133ac93e681e5b2d0ac37cc829695bdc25f1ff3f2dc"}, |
| 896 | {"internal/hostops/storage_classifier.go", "classifyDeploymentFamily", "reference", "str:Put", "9b690dd8ee599fdb337615eb9ca56274b5b19c68c9a0df743c4023d06a16af16"}, |
| 897 | {"internal/hostops/versioned_boundary.go", "versionedBoundary.classify", "key-site", "lit:instances", "6edc0d81310fa92b273e2ea98903d53d1adcde53df01c1ca9e8c89f0cc51fc66"}, |
| 898 | {"internal/hostops/versioned_boundary.go", "versionedBoundary.CopyVersion", "versioned-transport", "def:CopyVersion,sel:CopyVersion,str:CopyVersion", "63f158fd4372fb58b67f24bb99ce6fb286b0818c4ee2a762e452ec9a4b9d2d1e"}, |
| 899 | {"internal/hostops/versioned_boundary.go", "versionedBoundary.PutIfAbsent", "versioned-transport", "def:PutIfAbsent,sel:PutIfAbsent,str:Put", "63e387d09247046d9886e11150b92f86c27a79cdb7b7eb06542bada68ea9afd9"}, |
| 900 | {"internal/hostresolve/service.go", "acceptanceKey", "key-site", "key:LossRecordKey", "64b38b14a779519167ccb041705cb17daaeaad11944975bbc28de66b65549a93"}, |
| 901 | // Reads a local instance launch file and execs its validated command; does not write provision records. |
| 902 | {"internal/instanceexec/exec.go", "execLaunch", "key-site", "lit:instances", "2719b7fa5431c0de1f62c68c272bab91c94824aa824a473c3d7abbb91bfd2670"}, |
| 903 | {"internal/instanceexec/exit.go", "RunExit", "key-site", "lit:instances", "aa5c1d7630601adc541920f2c35064d9dae7629fb7b910cf297cffeb484e9a3b"}, |
| 904 | // Writes a local invocation exit file under the runtime instances directory, not a deployment record. |
| 905 | {"internal/instanceexec/exit.go", "writeExitRecord", "key-site", "lit:instances", "2a523d575a1956c4d097f4cbf834751a2a41a067974057f0b8f7bbb9028ae78b"}, |
| 906 | {"internal/instanceexec/probe.go", "runChecks", "key-site", "lit:instances", "da0d0ab869742d938ed6474ad84a2ae1283935b66402261e3338ce6644e39116"}, |
| 907 | {"internal/layout/plan.go", "nestedFiles", "key-site", "lit:instances", "f7add773fc8440c54708c49edd9507dd1ef8344605d841e6614ca344d392b974"}, |
| 908 | {"internal/layout/plan.go", "PlanFor", "key-site", "lit:instances", "cf4461a2970d4c75fc9e2b4a2164a2ad0a64753ec89d6bb580848550eec96451"}, |
| 909 | {"internal/lease/mirror.go", "type MirrorStore", "reference", "id:Put", "aa6ae137b4c418d6b67f8f81ed9370c0b1d6571b502bf7cd2f92cb3fe907bb0f"}, |
| 910 | {"internal/lease/mirror.go", "type VersionedCopier", "reference", "id:CopyVersioned", "f5a89ac86e0dd0166a541e4ea233159363d2de3ed300e19ece59a9295b7e2835"}, |
| 911 | {"internal/lease/mirror.go", "MirrorPrefixKeep", "versioned-transport", "sel:CopyVersioned", "8a58fdbc7ff769ee235834dc3dba09271cfd52024778189ee1cd2bc957cc5541"}, |
| 912 | {"internal/lease/mirror.go", "receiptLedger.save", "versioned-transport", "sel:Put", "9ccc7f0b3f6b836de3cd4e5d609130126ce3ae9a4b1dcfb94a19dae33d81656f"}, |
| 913 | {"internal/lease/mirror.go", "s3Mirror.Put", "versioned-transport", "def:Put", "c57f634a2acd76e578e92b60aae22f89aff38fe3c74a99f92ca80fe94ce4de50"}, |
| 914 | {"internal/lease/staging.go", "type StagingWriter", "reference", "id:CopyVersionedAt,id:PutIfAbsentVersionedAt", "69da8042e79db6c0aff7c0f80b3ca45f1308ac6484124da15ec9afb56bfa6c01"}, |
| 915 | {"internal/lease/staging.go", "StagingMirror.CopyVersionedAt", "versioned-transport", "def:CopyVersionedAt", "57c4bf86ffd632cb92d8583afaf011987df415927c6959cb9eba651cd9242c78"}, |
| 916 | {"internal/lease/staging.go", "StagingMirror.PutIfAbsentVersionedAt", "versioned-transport", "def:PutIfAbsentVersionedAt", "8d2c41d739e4dba9500c6024f0a280e8d1d95f847739206e8b73c370517502f4"}, |
| 917 | {"internal/lease/versioned.go", "type VersionedStore", "reference", "id:CopyVersion,id:PutIfAbsent", "b66751605e2096748dbe25db1711c3398d499f85c8401404af97e8576acca634"}, |
| 918 | {"internal/lease/versioned.go", "versionedS3.CopyVersion", "versioned-transport", "def:CopyVersion", "69411c6bd1aa320f1b63a2055a011bfb6731e2fab5de6dab9ac5569c82681b73"}, |
| 919 | {"internal/lease/versioned.go", "versionedS3.PutIfAbsent", "versioned-transport", "def:PutIfAbsent", "ee832e720c79bd3e2df7318701fe8138215a41a3836b9fcbd628aad8a083295d"}, |
| 920 | {"internal/lease/leasetest/bucket.go", "VersionedBucket.Put", "testsupport", "def:Put", "3c43a27aa85614e017e3594651c9a96378cfbaab7eb9c9547fb8888586c20f10"}, |
| 921 | {"internal/lease/leasetest/bucket.go", "VersionedBucket.CopyVersion", "testsupport", "def:CopyVersion", "db31daeb0a938d214e42bbeb2377a03e856a05b589beb53d1db3f349b3e0ac96"}, |
| 922 | {"internal/lease/leasetest/bucket.go", "VersionedBucket.PutIfAbsent", "testsupport", "def:PutIfAbsent", "bc77cff80b5a36ffadff0a3ee058daa14d0041672c10f845deaf9a729a1061cb"}, |
| 923 | {"internal/lease/leasetest/contract.go", "RunVersionedStoreContract", "testsupport", "sel:CopyVersion,sel:Put,sel:PutIfAbsent", "4dd3215813c8136f197b2abe1dbca0372930494ed7582bea9c5470cfc97e2064"}, |
| 924 | {"internal/ledger/append.go", "claimRawAppend", "nonrecord", "sel:Put", "df8964d0eaa3c10dfb67a8f45014482f27c19b36c618b5cbe6152e7cca73a54a"}, |
| 925 | {"internal/ledger/blob.go", "claimRawPutBlob", "nonrecord", "sel:Put", "13ab752b369f7d5337bed20f49b968d2bdf962e50c2f2b41b82b7de1eed35f42"}, |
| 926 | {"internal/ledger/manifest.go", "claimRawUpdateManifest", "nonrecord", "sel:Put", "0555b5c27dcbdab706296715a547e6616474bc476deeb90d81d6a1b6a204535b"}, |
| 927 | {"internal/mail/claim_gate.go", "ClaimMailStore.Put", "record-transport", "def:Put,sel:Put,str:Put", "3a65d4aa9beae7b04c9cecfc535cca721a6e8b0b29aacae5705a0e8e6ff9528f"}, |
| 928 | {"internal/mail/domain.go", "claimUnserializedPutDomain", "nonrecord", "sel:Put", "28c54e01762f183c6acd300bbf90eaa8147908f57e7fdd7061765bbb0fd37250"}, |
| 929 | {"internal/mail/domainclaim.go", "claimDomain", "nonrecord", "sel:Put", "1a243e3ddeaa91bfe9adf18a8063ab57246f8eba99c5ff47f0baa0169a97cf3e"}, |
| 930 | {"internal/mail/domainclaim.go", "updateOwnClaim", "nonrecord", "sel:Put", "a2f77a02681ea901d8b64ba79112fc1e1a37dd9da2d990b8e72785dda5bf46cf"}, |
| 931 | {"internal/mail/domainclaim.go", "takeLapsedClaim", "nonrecord", "sel:Put", "5ca88f3eaa637fe205ea40805d481279e9ca193ea0a8067a2c4b612ed7e275b9"}, |
| 932 | {"internal/mail/mail.go", "claimUnserializedPutSender", "nonrecord", "sel:Put", "17f674a7ccb2399cf99fbf00b55dd4cf7509c0860f7c11ecfc2abb87264b85b1"}, |
| 933 | {"internal/mail/mail.go", "Put", "nonrecord", "def:Put", "16b0ddaddbbd7b91eab8d251835753f765e276da3bf1306325471a3ccf5f2ac3"}, |
| 934 | {"internal/mail/sender.go", "claimUnserializedPutCallerIndex", "nonrecord", "sel:Put", "e6d3db589e23430412bcee048153739c2f6abcace2cf8995327a797e1b211457"}, |
| 935 | {"internal/mail/walk.go", "claimUnserializedDeclare", "reference", "id:Put", "b2a49ced130ea3d9ccb75bbfc6efc527ed449a4ceeaaaf8f1678f916892d1889"}, |
| 936 | {"internal/mail/walk.go", "claimUnserializedEnable", "reference", "id:Put", "f02b268deb95f1949f3d18607f2ab4dc2e97044ca696c00a37581230ec301afe"}, |
| 937 | {"internal/mail/walk.go", "claimUnserializedApplyGrant", "reference", "id:Put", "63b56194ecd00f6710871055ed80298f0cf2eab5f8afd1e2567bd1b11cdbec1c"}, |
| 938 | {"internal/mail/walk.go", "claimUnserializedRotate", "reference", "id:Put", "00f51a805d0ae7ace39d0af0e731be356ff2ad4e069a00e834333ee9bfe4ab1d"}, |
| 939 | {"internal/mail/walk.go", "claimUnserializedRotateFinish", "reference", "id:Put", "9a576cb8d6757779f66dade82ebe250bf04f70fcd7f89daa444b68c053cbcc98"}, |
| 940 | {"internal/mail/walk.go", "claimUnserializedCreateStandalone", "reference", "id:Put", "57e6a71b0f90ad900064c25d50e07315ee8e473bcb3a3199f578c1fa04ff522a"}, |
| 941 | {"internal/mail/walk.go", "claimUnserializedRevokeStandalone", "reference", "id:Put", "1559a16e0af4187c69afe47b9c957632198e477e2e031ae40aa7e8c98e5c9fcb"}, |
| 942 | {"internal/maintenanceguard/guard.go", "Repository.writeGuard", "nonrecord", "sel:Put", "f7fb0e390276f12912568a2cc120f4a214c949949064471a7d499471e7b5877d"}, |
| 943 | {"internal/maintenanceguard/lifecycle.go", "Repository.AcquireClaim", "nonrecord", "sel:Put", "854d783bc1290fdce4cd5cc2c900496c7e950263cd55a786021b231753d3d6c3"}, |
| 944 | {"internal/maintenanceguard/lifecycle.go", "Repository.ReleaseClaim", "nonrecord", "sel:Put", "5fcfb67c5693e9162b818e03b286de78d9d5950ebb44a1be6497f2190dc3b755"}, |
| 945 | {"internal/maintenanceguard/store.go", "type Store", "reference", "id:Put", "f824e9c20bb778bac2cc5f69d4d7417b3e0eb600630e3f19712de2292508ffaa"}, |
| 946 | {"internal/maintenanceguard/store.go", "Repository.putImmutable", "nonrecord", "sel:Put", "f2c831e0dd53ca7731ae32f21783a3b64ad7bd85d75a7b70a190e82c3d6e75a2"}, |
| 947 | {"internal/metrics/chunk.go", "WriteRaw", "nonrecord", "sel:Put", "157a416dc7c3d3b2d69a902a7585777ace4adaba1e9cbd75b7a8b1163f6b2149"}, |
| 948 | {"internal/metrics/rollup.go", "UpsertRollup", "nonrecord", "sel:Put", "4a72d2a8b68ba66f8efbdf66bbe08c9f4b43b0fae451e2b8a20ba1259c8e52eb"}, |
| 949 | {"internal/moves/build.go", "putOrReuse", "nonrecord", "sel:PutIfAbsent", "932e5852c1d7c747db1013954352bbeb00364329d3515ae723a144b074567562"}, |
| 950 | {"internal/moves/build.go", "putOrReadIntent", "nonrecord", "sel:PutIfAbsent", "d53112f8f9c0c48844f930d2b9ae5e58b75588ef31b0a3740b65a61c83fba613"}, |
| 951 | {"internal/moves/build.go", "putOrReadManifest", "nonrecord", "sel:PutIfAbsent", "3187b04355f4ec75b86edf311a732c6cfecd722322b509f0731479f738b52a85"}, |
| 952 | // Plan 6 Task 3: the move log, create-only objects under the report |
| 953 | // prefix; no record. |
| 954 | {"internal/moves/log.go", "WriteLog", "nonrecord", "sel:Put", "a3803e1ac4a43da86fb60d7fc5395ee2b0e9e8f86f33bf13bc251795dc3529cf"}, |
| 955 | {"internal/moves/readiness.go", "PutReplace", "nonrecord", "def:PutReplace,sel:Put", "3ec4d72cb252b34a402175cb7866dee4ab4f5b2441958f9fc455f687ffb2eafd"}, |
| 956 | {"internal/objstore/entitlement.go", "PutEntitlement", "nonrecord", "sel:Put", "35b3734ff8587089c913ba7151f17955e9b1f7456a2f5ae1b3fb0e6917104005"}, |
| 957 | {"internal/objstore/memscanner.go", "MemScanner.Put", "nonrecord", "def:Put", "bef5afd48d145dafdcbda197b4ad221766833d1c8ba8223f81df98495c860a4b"}, |
| 958 | {"internal/objstore/nameclaim.go", "claimName", "nonrecord", "sel:Put", "4a83752eec31d8b15612f42d22d80cc54bfd46239a884acb4fe7b56fa1839df6"}, |
| 959 | {"internal/objstore/objstore.go", "claimRawPutIn", "nonrecord", "sel:Put", "19e8f49ac1ffa115c126c31583257bc5fd4ec71e84c0eba54fbc7a27a7fc9d3b"}, |
| 960 | {"internal/objstore/objstore.go", "Put", "nonrecord", "def:Put", "a1b8b7a0ec9e1d98ab47d64341206fced4b17ac98c36b16c89337a4f5cde2ef9"}, |
| 961 | {"internal/objstore/queue.go", "claimRawEnqueue", "nonrecord", "sel:Put", "40b1e545727ca230206aa3c7c264c5e7efb9f1772c68318c6655a8f926a90386"}, |
| 962 | {"internal/objstore/scanresult.go", "claimRawWriteScanResult", "nonrecord", "sel:Put", "4be5c156346db152607a2c6437081c2e28e4ef600b097687c9cf0f2e22c85665"}, |
| 963 | {"internal/objstore/sidecar.go", "claimRawPutSidecar", "nonrecord", "sel:Put", "233e3d808dd462ff83aecdac5176b180556b948c552aa26f6e0b778df91a24c7"}, |
| 964 | {"internal/ops/litestream.go", "FleetDBsWithSkipped", "key-site", "lit:instances", "f62291df0685db15529c4946dca358a29aba66fc31e81aab299de579e37f60f1"}, |
| 965 | {"internal/park/remote.go", "locationOf", "key-site", "lit:instances", "83b3efca31b3faadcd5997dc181d81b7bb8fc866cc4a448683bf8423b1bea866"}, |
| 966 | {"internal/park/remote.go", "Engine.run", "versioned-transport", "sel:CopyVersion,sel:PutIfAbsent", "538230265e42b2d828bc8f842034d200b4fe3b0c908bd369a3d309c1c79af78d"}, |
| 967 | // settings-4: Decide also passes over the holder location's build-state.json |
| 968 | // (isBuildState); a pure decision, no write. |
| 969 | {"internal/park/sweep.go", "Decide", "key-site", "lit:instances", "0bbc952d4244c37f012db83e14b5b64beda696f48117183881b56896052286aa"}, |
| 970 | {"internal/park/sweep.go", "Engine.Discover", "key-site", "lit:instances", "69b83e6e859c1c9809ba76d46cb0192888df1ecdcd161b4f2b6435733eecdfa3"}, |
| 971 | {"internal/provision/claim_app_writes.go", "UpdateRecord", "record-writer", "key:UpdateRecord,key:claimRawUpdateRecord", "caf714cb78e1280d489c7ad5b3cefb1420e812d541108b1fe13d733abed97229"}, |
| 972 | {"internal/provision/provision.go", "ManifestKey", "key-site", "lit:instances", "b8ee0e77bdfade19af79a4012c411c1eb0b6ddca16037e5536fa8597f7cde270"}, |
| 973 | {"internal/provision/provision.go", "RecordsPrefix", "key-site", "key:RecordsPrefix,lit:instances", "19f1df727272f7d53a1c2250e31a73efc57087a548ea0ff2da0a7a21f3f7d3dd"}, |
| 974 | {"internal/provision/provision.go", "RecordKey", "key-site", "key:RecordKey,key:RecordsPrefix", "9e87f9f399f33b184d4ec9387733d8465d5de3a30f46576216a6ba60f36e845e"}, |
| 975 | {"internal/provision/provision.go", "ParseRecordKey", "key-site", "key:ParseRecordKey,lit:instances", "ab1740221c0c4ab0390b4273f92dd98fa170aaf0513d6c0b56fc7fe38ca935b3"}, |
| 976 | {"internal/provision/provision.go", "claimRawPutManifest", "nonrecord", "sel:Put", "cb88150470d6fe2a6273d37f0f65af54690c38b60c23f8ef79c4dc5e3ff1edf7"}, |
| 977 | {"internal/provision/provision.go", "claimRawPutManifestIfMatch", "nonrecord", "sel:Put", "66922918fe679fa9facbabe954aeefc49a2c4e10af9cf2a630e04d8fb33fc325"}, |
| 978 | {"internal/provision/provision.go", "CreateRecord", "record-writer", "key:CreateRecord,key:RecordKey,key:WriteRecord", "029e9dd2bfb9ae39911ba556159193a8cc3b8bc3dbba19431295ce06677c6911"}, |
| 979 | // Re-reviewed at the merge of carlos-run into seeded-instances (2026-10-13): refuses a region change of a seed that may not move yet (seedMoveRefusal) inside the same updateRecord closure; the write is unchanged. |
| 980 | {"internal/provision/provision.go", "SetRecordRegion", "record-writer", "key:SetRecordRegion,key:updateRecord", "79b0a949e85ff68c7d8ed81cacead3d0eb6e3fa4e2e267df6d52dce15201be26"}, |
| 981 | // Re-reviewed at the merge of carlos-run into seeded-instances (2026-10-13): now one call of updateRecordSeeding (below) with seedWrite false, so every caller is refused a change to Seed; its body, WriteRecord included, moved there. |
| 982 | {"internal/provision/provision.go", "updateRecord", "record-writer", "key:updateRecord", "40f49b5ea34dd4fd25449f0d04ab7bc4c77a7234db2cb9bf29647130fe07a6bb"}, |
| 983 | {"internal/provision/provision.go", "SetRecordMove", "record-writer", "key:SetRecordMove,key:updateRecord", "4823514845c8f036d37db3fbefdfe4a93a7f62b9ca3c0728a571dd9db1da4f9e"}, |
| 984 | {"internal/provision/provision.go", "DeleteRecord", "key-site", "key:RecordKey", "67e8f77d784d3e84626f2856bd45d219759ba4b603bc3daebbb9e315131c4945"}, |
| 985 | // Re-reviewed at the merge of carlos-run into seeded-instances (2026-10-13): main's body plus one refusal: a change to the record's seed is ErrSeedProtected, as in updateRecordSeeding; the write is still WriteRecord. |
| 986 | {"internal/provision/provision.go", "claimRawUpdateRecord", "record-writer", "key:RecordKey,key:WriteRecord,key:claimRawUpdateRecord", "9ecb91710e7460a8a91ad6299b3082ace6a8a38ba21b2edfef0199e6ab05d3e4"}, |
| 987 | {"internal/provision/provision.go", "GetRecordETag", "key-site", "key:RecordKey", "d9f71e5a52091dce7ea6b6aa3e5d725456d5944efa180727674e7df0006d4fa5"}, |
| 988 | // Re-reviewed at the merge of carlos-run into seeded-instances (2026-10-13): the host-list loop is factored into recordHosts, shared with ListRecordsStrict; reads only. |
| 989 | {"internal/provision/provision.go", "ListRecordsComplete", "key-site", "key:RecordsPrefix", "3231a8ccb6a058d899b296c9bf7420575e91b73875dc2daf2c1405ce21969487"}, |
| 990 | {"internal/provision/provision.go", "InstanceDir", "key-site", "lit:instances", "4defc7f996c83afe8d2d2efddd31f4de79d94a5c84e7ee99e8d639ca03d7bf81"}, |
| 991 | {"internal/provision/provision.go", "InstanceRunDir", "key-site", "lit:instances", "c0e58b35ea6c773c71524a7d9f5ab22c9a7bec46d0e0ab230784b935f77186c9"}, |
| 992 | {"internal/provision/provision.go", "NestedPaths", "key-site", "lit:instances", "64a91261fe43412aab90175f5af2333c35a5fef7232ce20c64fd678a27130826"}, |
| 993 | // Region HA stage B: routeFor exported as RouteFor so the relocation install mints the same route (relocationRecord); the reads are unchanged. |
| 994 | // Re-reviewed at the merge of main (2026-10-12): main's update-policy argument and its policy-unknown waits are kept as main wrote them; only the name differs. |
| 995 | // Re-reviewed at the merge of main into carlos-run (2026-10-13): main's body with the run pass's one RunSeen call on each record that carries a run; the reads are unchanged and nothing is written. |
| 996 | // Re-reviewed at the merge of carlos-run into seeded-instances (2026-10-13): main's body with the seed dispatch ahead of the per-record handling (the journal pass, then seedAction: skip, swap or finish an abort), the seed column's converge, and the import swap waiting on the app's update policy as a mint does (policyUnread). The pass's record writes are the seed transitions in the units below, each through SetRecordSeed. |
| 997 | {"internal/provision/reconcile.go", "Reconcile", "key-site", "key:ParseRecordKey,key:RecordKey,lit:instances", "4dbcb2300e2598da672bac77c37de9479ce04f7a29cfbe9ded8f36baed05abb6"}, |
| 998 | {"internal/provision/reconcile.go", "mintHeld", "key-site", "key:RecordKey", "7fae368f0465f2922f9a552358b0ab156ee5718d19dad46976c16cfdba57ee82"}, |
| 999 | // Reads every record, strictly (ListAllRecords) or tolerantly (ListAllRecordsTolerant, the run sweep); writes none. |
| 1000 | // Re-reviewed at the merge of carlos-run into seeded-instances (2026-10-13): also returns the hosts whose records did not decode, for the journal pass; reads only. |
| 1001 | {"internal/provision/reconcile.go", "readAllRecords", "key-site", "key:ParseRecordKey,lit:instances", "7d53a24dfca2e4dcaa0770486a45206b71aada94192ec10cc447ee3058b68e34"}, |
| 1002 | {"internal/provision/record_sequence.go", "IsRecordKey", "key-site", "key:IsRecordKey,lit:instances,lit:sidecars", "71ee3cc5e6c1399befa39612262a7a6656f2464c760419c1a87438d8c600b6cb"}, |
| 1003 | {"internal/provision/record_sequence.go", "type preparedRecordKey", "key-site", "key:preparedRecordKey", "76c4a83eb76398bbe14e31fe82f9999b863e030082c240389bcd990e2d0475dd"}, |
| 1004 | {"internal/provision/record_sequence.go", "WriteRecord", "record-primitive", "key:IsRecordKey,key:WriteRecord,key:preparedRecordKey,sel:Put", "8632f3fa656c3cbda8d7aafebaf193be4d810f43de3dc6be39c30584169949b2"}, |
| 1005 | {"internal/provision/replica.go", "CreateRecordReplica", "record-writer", "key:CreateRecord", "84c162fe2559edb54ceae44e80e0a2e944780fb1953289c66f07658adb829fbe"}, |
| 1006 | {"internal/provision/sidecar.go", "SidecarManifestKey", "key-site", "key:SidecarManifestKey,lit:sidecars", "966e3d9f62dda09061eb2d99484074478ed04b7aa9174f33e09c9250dc3482ed"}, |
| 1007 | {"internal/provision/sidecar.go", "SidecarsPrefix", "key-site", "key:SidecarsPrefix,lit:sidecars", "da2d221da0c8c6da9f4900105fa29879c89e85c42cbdc0646637d5d6a1be06bf"}, |
| 1008 | {"internal/provision/sidecar.go", "SidecarRecordKey", "key-site", "key:SidecarRecordKey,key:SidecarsPrefix", "c42823b31edb5b69e177645c497abaa5b14176e58c3d4be3930185d0e6568a17"}, |
| 1009 | {"internal/provision/sidecar.go", "ParseSidecarKey", "key-site", "key:ParseSidecarKey,lit:sidecars", "bcfcb2f6ef70e8c8f9f4ab8f19824659d45b030b2152c4b1682561a91cabf7a2"}, |
| 1010 | {"internal/provision/sidecar.go", "GetSidecarManifestETag", "key-site", "key:SidecarManifestKey", "39cd7c3c05318ab94d75b808aef957fe79d0ec724f1db54f2a3f60cb0e149a75"}, |
| 1011 | {"internal/provision/sidecar.go", "claimRawPutSidecarManifest", "nonrecord", "key:SidecarManifestKey,sel:Put", "66401ceb2d42a4fe11bc99441adc129db9698ebe767a6349dc11ac9c0e1ccc3d"}, |
| 1012 | {"internal/provision/sidecar.go", "claimRawPutSidecarManifestIfMatch", "nonrecord", "key:SidecarManifestKey,sel:Put", "89038c29241c04ab629e0fe90af058bc38a5cce3e3a73d1466293c69c620b9e8"}, |
| 1013 | {"internal/provision/sidecar.go", "CreateSidecarRecord", "record-writer", "key:CreateSidecarRecord,key:SidecarRecordKey,key:WriteRecord", "93de6854447d263138da0b47c325dd608a2bce699f00c5de1367c323528158c8"}, |
| 1014 | {"internal/provision/sidecar.go", "GetSidecarRecord", "key-site", "key:SidecarRecordKey", "0acb1da9d9e825e8ae17c50535ca62f606ece6e4bcffd410ec57319125947481"}, |
| 1015 | {"internal/provision/sidecar.go", "ListSidecarRecords", "key-site", "key:SidecarsPrefix", "1e9fcdf53f04a9fd9ffb35574f7f63e778307d0deda8f34150b36047443fddf0"}, |
| 1016 | {"internal/provision/sidecar.go", "DeleteSidecarRecord", "key-site", "key:SidecarRecordKey", "b4dc694473fdf9e9787e15a11bf701a24e6bc32f0bf83245ad949ec7408b81e6"}, |
| 1017 | {"internal/provision/sidecar_reconcile.go", "ReconcileSidecars", "key-site", "key:ParseSidecarKey,key:SidecarRecordKey,lit:sidecars", "f9afc65bd1fb5dcba13fc6fa386b6decadcba2c509c9020acb36bab7fc1b6da2"}, |
| 1018 | {"internal/relay/authority.go", "WriteHeartbeat", "nonrecord", "sel:Put", "286ea24e50f836f6d2857b249a3013b97e56e3755104acc0cffc7ac175be98cf"}, |
| 1019 | {"internal/relay/meter.go", "Meter.Flush", "nonrecord", "sel:Put", "a0bd6d6ddd67428aca3ad320985e4000d234743a241ac2811d0b8de32604923a"}, |
| 1020 | {"internal/relay/record.go", "RecordKey", "key-site", "key:RecordKey", "420c67cb7259661f04a834334779ab9aff2ff8bf7079d6dd2bdee09eb3dcefce"}, |
| 1021 | {"internal/relay/record.go", "GetRecord", "key-site", "key:RecordKey", "52bb878edc70d064148c98afc8e6a0585a7ec02b7fd3e058374894c2a9481e92"}, |
| 1022 | {"internal/relay/record.go", "PutRecord", "foreign-recordkey", "key:RecordKey,sel:Put", "120948d4a8b9a5c40b7b497b178bc72e02b472bdfbacd0da11fa05601d1e28c1"}, |
| 1023 | {"internal/release/claim_purge_request.go", "RequestClaimAutoPurge", "nonrecord", "sel:Put", "767be49513ff9be09dd01848b7b71ed3e7470e38ebf333bcf897ad1efdd309f5"}, |
| 1024 | {"internal/release/features.go", "claimRawUpdateFeatures", "nonrecord", "sel:Put", "366e6cbd3035e22ac92289493f10c664b80350dbe353b405fa2e725900034864"}, |
| 1025 | {"internal/release/layoutintent.go", "AppendLayoutIntent", "nonrecord", "sel:Put", "3b97c12b334c897d3d2133ae4785f89c299a129714ebf5a1d069df274c59df32"}, |
| 1026 | {"internal/release/pipeline.go", "claimRawSetPipeline", "nonrecord", "sel:Put", "760debafca52df092e9b318e05d38945ef91d3313923c39f4e2c0664dbfda798"}, |
| 1027 | {"internal/release/production.go", "claimRawSetProduction", "nonrecord", "sel:Put", "0dd1875a9fcf58da306e8f1a009291b370650b6deeb5fda92afa89f979866ec2"}, |
| 1028 | {"internal/release/proof.go", "PutProofPending", "nonrecord", "sel:Put", "cea0ebb0d4f6a3ec44df9aec22c9f27eb4440786d5135b6d942059208768016f"}, |
| 1029 | {"internal/release/release.go", "putImmutable", "nonrecord", "sel:Put", "c1fb19059ffc1a2b5f5c5031b987b86b6a5e7e63a925a3e28e260eb758f60d0e"}, |
| 1030 | // Promotion records are signed release objects at releases/<acct>/<app>/promoted/<version>; the name ends |
| 1031 | // in RecordKey, but no provisioning record (apps/<acct>/<app>/instances|sidecars) is built or written. |
| 1032 | {"internal/release/promotion.go", "PromotionRecordKey", "key-site", "key:PromotionRecordKey", "7dc4ab60059c02b0eaa1d2200e8b97de3c0f945c851e21ac64e372b82eb2eb8e"}, |
| 1033 | {"internal/release/promotion.go", "ReadPromotionRecord", "key-site", "key:PromotionRecordKey", "bcaaef3f8253b1cfe0f0ca4580977f9def67f463ef6d16c05cc54736cf59a6b0"}, |
| 1034 | // Puts the signed promotion record (release key grammar, hostops family promotion-record); not a provisioning record. |
| 1035 | {"internal/release/promotion.go", "Signer.WritePromotionRecord", "foreign-recordkey", "key:PromotionRecordKey,sel:Put", "ac2d87745d7e8a40e56342dafe8b5b49eeb31c37ed72d8f91b737c3ef77038ff"}, |
| 1036 | // Deletes the pruned version's promotion record; no Put and no provisioning record. |
| 1037 | {"internal/release/prune.go", "claimRawDeleteVersion", "key-site", "key:PromotionRecordKey", "8781c30f067735b81431df34beddd16f0a7af44776fe01a876a8944af8dbbfb2"}, |
| 1038 | // Writes a signed channels/<channel>.json pointer under the validated account and app; a new head's |
| 1039 | // promotion record (releases/<acct>/<app>/promoted/<version>) goes through Signer.WritePromotionRecord. |
| 1040 | {"internal/release/release.go", "Signer.claimRawPromote", "nonrecord", "sel:Put", "c08a9c111ba6a632ff3b598bf1f7b32c970cbd7fbc5648edeadc498625e5c68a"}, |
| 1041 | // Writes a signed channels/<channel>.json rollback pointer under the validated account and app. |
| 1042 | {"internal/release/release.go", "Signer.claimRawRollbackAuthorized", "nonrecord", "sel:Put", "592ab8576c9a81bc2963d8debc4c184903aabf0a7700e3a123090b91fd4359b1"}, |
| 1043 | // Writes a signed channels/<channel>.json fast-track pointer under the validated account and app. |
| 1044 | {"internal/release/release.go", "claimRawFastTrack", "nonrecord", "sel:Put", "de483b9f637ca8086618bb059900d800aa6422765a4245dca28b2d9730883de9"}, |
| 1045 | {"internal/release/restartgen.go", "claimRawTouchRestartGen", "nonrecord", "sel:Put", "4a2797646f540e3d02798e7c5f427afa582986ea9a0818492f90a58f684a5ce0"}, |
| 1046 | // The one CAS append of both request logs: apps/<acct>/<app>/restart-scope.json |
| 1047 | // (claimRawAppendRestartScope) and apps/<acct>/<app>/host-retry.json |
| 1048 | // (claimRawAppendHostRetry), each validating the account, app and entry first. |
| 1049 | {"internal/release/restartscope.go", "claimRawAppendRequestLog", "nonrecord", "sel:Put", "9a866d77b795361a342aa7fcdb84ef2a3647f24e269303f6669fe3f1c41e2670"}, |
| 1050 | {"internal/release/retention.go", "claimRawSetRetention", "nonrecord", "sel:Put", "05033e1266623712efe57b39ce282ecddf76d2b774e343df4dc5f81375d11662"}, |
| 1051 | {"internal/release/serial.go", "BumpSerial", "nonrecord", "sel:Put", "8b304349553e0daf5ac2affcf4bc5e2abc9ce1a6b3423f624e41f6bd80c8ccf0"}, |
| 1052 | {"internal/release/sidecarwake.go", "claimRawTouchSidecarWake", "nonrecord", "sel:Put", "2cf98594adc5096b6a1c69e561e32aabb16341134e226d73467110a6ae3fc686"}, |
| 1053 | {"internal/release/store.go", "type Store", "reference", "id:Put", "2ccf0a0f5b63b8670c80c8d3589890d170777c83e60d4f33ea49a177a66084f5"}, |
| 1054 | {"internal/release/store.go", "prefixStore.Put", "record-transport", "def:Put,sel:Put", "d257f767e3ecb0f7bcb4e4357cde1e45e869647c4e41aa72fa5782c50123ee16"}, |
| 1055 | {"internal/release/store.go", "prefixStore.PutFrom", "record-transport", "def:PutFrom,id:PutObjectFrom", "965ebec4c3349c7c103aab0687f1e08b11c624a13a9cd379658ca7185b3dc5d5"}, |
| 1056 | {"internal/release/store.go", "type PutStreamer", "reference", "id:PutFrom", "1e9ac4fc57072be0ed7e8d16b29f3bc588cb1462157bb352861bf072aa81e133"}, |
| 1057 | {"internal/release/store.go", "PutObjectFrom", "record-transport", "def:PutObjectFrom,sel:Put,sel:PutFrom", "30dd21f424804c0252b9303a9a96393042651d6fa53ece25ba6cc1af9feff00c"}, |
| 1058 | {"internal/release/store.go", "DirStore.Put", "record-transport", "def:Put", "cbf55e314641c00cc0dd0b8afd2d3ef975958065d3574247b5c7b294d3152e10"}, |
| 1059 | {"internal/release/store.go", "DirStore.PutFrom", "record-transport", "def:PutFrom", "83c432216ce25b6966d0a51be28f1f2fb1a11624ec1abfaf196d612ffb09047b"}, |
| 1060 | {"internal/release/store.go", "S3Store.Put", "record-transport", "def:Put", "43f9b7beec0d1ef16645473a574082a8fce1526d809536f7b7a48253d3c7b6b0"}, |
| 1061 | {"internal/release/store.go", "S3Store.PutFrom", "record-transport", "def:PutFrom", "46f0fc7ca6ce297a121386c78ba9ae2662687253c08a6cda490a63b9054abdce"}, |
| 1062 | {"internal/release/system.go", "PutAntivirus", "nonrecord", "sel:Put", "5fac12bfabd74baf7a5a9fc14583a346ccdaa7c6b4acc843365b99bf22e0d47d"}, |
| 1063 | {"internal/release/systemidentity.go", "PublishSystemIdentity", "nonrecord", "sel:Put", "2fd9e96c42ac7cd8c568cb77cc99408769954ea4dcaac94bf31b9bc45c18de06"}, |
| 1064 | {"internal/release/systemidentity.go", "CreateExact", "nonrecord", "sel:Put", "ebdaf47c1787fc6a6330e835aec0b0eb7c23ef8f07dc078ae6ab60013d4d5f58"}, |
| 1065 | {"internal/release/systempublication.go", "PublishSystemPublication", "nonrecord", "sel:Put", "4c0490ce92f910ca17654f80b99d9d6dbd8c68b3bb76851223c77aca73bc38ed"}, |
| 1066 | {"internal/release/systempublication.go", "CancelSystemPublication", "nonrecord", "sel:Put", "bd61ab14579121a194bdf60b23d000b3ade348e429542b0410fe5fdf3415fe43"}, |
| 1067 | {"internal/release/target.go", "setTargetUnchecked", "nonrecord", "sel:Put", "1217704647ff19e95bdcb6f22c62a08579cea00cd0892cc2ec51438f07390b45"}, |
| 1068 | {"internal/release/trash.go", "claimRawTrashApp", "nonrecord", "sel:Put", "c7a5f36b7866a98eebc3dc6cf153e809c7cdae635bb83b010811cc5246658789"}, |
| 1069 | {"internal/release/workerassignment.go", "type WorkerControlStore", "reference", "id:Put", "2d709d8015f70a1c476cd02dade0d71103959faf8bffd38b20869692f461dcca"}, |
| 1070 | {"internal/release/workerassignment.go", "CreateWorkerAssignment", "nonrecord", "sel:Put", "24d684bed7a466eb4a79b48c170567a6935d3e3880cf9c7a5b4d8493e00bbd23"}, |
| 1071 | {"internal/release/workerassignment.go", "AdvanceWorkerAssignment", "nonrecord", "sel:Put", "668ed1ec778a8ad91a413f8a7884ed42f97482362a9447fb56597c41878eae06"}, |
| 1072 | {"internal/schedule/declaration.go", "modify", "nonrecord", "sel:Put", "0e0aca1879e3eae4c4deed779f6c50f6cb1b9c3efb6a28cd6c226f4e8fc7c570"}, |
| 1073 | {"internal/schedule/declaration.go", "claimRawTouchRun", "nonrecord", "sel:Put", "4d25b353bc8ae5c16b11b848446c46b59128da0176f3c9584052ba5158abc829"}, |
| 1074 | {"internal/schedule/status.go", "claimRawWriteStatus", "nonrecord", "sel:Put", "ebad18e2a51ccd81fe73023cb18e475073eebba0a0c754cd858aae6a5dc72d58"}, |
| 1075 | {"internal/status/fleet.go", "putOverwrite", "nonrecord", "sel:Put", "527894a121c90ff71bc0ed9758ca423a576990456d5751f82fe7963dd77dc3c6"}, |
| 1076 | {"internal/status/snapshot.go", "WriteBox", "nonrecord", "sel:Put", "7583ce524d0606dbf9e5d60cdd550be8d0f6080e72737ad7f5c9043843d83394"}, |
| 1077 | {"internal/steering/route53.go", "gcHealthChecks", "key-site", "key:recordKey", "8f73ccc805fad4b9442a283c193eef72f9dacc19dcf75afab4d4f5707a41b7fa"}, |
| 1078 | {"internal/steering/route53.go", "recordKey", "key-site", "key:recordKey", "44de1074a7fdcd31ef0da6f187c4d0554949e774b315a7bfacc0b65b44b4226f"}, |
| 1079 | {"internal/steering/route53.go", "partitionManaged", "key-site", "key:recordKey", "f4d5ee2ee3afc988a7725a4f6ed6d9edfc01d08f5c44f57492d2f282fdee281a"}, |
| 1080 | {"internal/steering/route53.go", "recordChanges", "key-site", "key:recordKey", "d057e8edd577f1e8fd9b48936f96f108cbd543d9133b17073d8c29bb67500c82"}, |
| 1081 | {"internal/telemetry/telemetry.go", "Update", "nonrecord", "sel:Put", "7b0af146e7cd4904f2e5294de91eb287154f146e1c3d6b7a26e1a4e58a71a975"}, |
| 1082 | {"internal/usage/edge.go", "UpsertEdgeDay", "nonrecord", "sel:Put", "ddd80746e03de810dbc2147195ef6a319292da124c02358e06eb17f10194946b"}, |
| 1083 | {"internal/usage/statement.go", "UpsertStatement", "nonrecord", "sel:Put", "d4e69ee3b62fb292111680f1119fab74749ae4aa6d9ab09c75a839b47ee61fda"}, |
| 1084 | {"internal/usage/statement.go", "CreateDayObject", "nonrecord", "sel:Put", "047ea4bfa15d794d655f13dab54720fea80ee9a2e8a25be02a4c4c1d0b71fc81"}, |
| 1085 | // carlos run (#259), merged onto Plan 9 B8 on 2026-10-10: every unit reviewed. |
| 1086 | // Admits a run onto the record through SetRecordRun (RunAdmit). |
| 1087 | {"internal/console/apiruns.go", "Server.admitRun", "record-writer", "key:SetRecordRun", "5018e39854b4d5e96211f5adaaecbbbd0cfc7202c7ba481bcc1f5f7bf08963d3"}, |
| 1088 | // Writes a run's request.json and --file inputs under apps/<acct>/<app>/runs/<id>/, never a record key. |
| 1089 | {"internal/console/apiruns.go", "Server.writeRunObjects", "nonrecord", "sel:Put,sel:PutObjectFrom", "228773cd5a10ea4772c60450956e7fe43d2bf741303b29217f5d241513165b06"}, |
| 1090 | // Puts the run's audited marker under runs/<id>/; not a record object. |
| 1091 | {"internal/console/apirunsfollow.go", "Server.auditRunEnd", "nonrecord", "sel:Put", "74df5f7189faa30cb93f3c80a870adb4d0c5304808e63ba68744ea4c9ad95bce"}, |
| 1092 | // Clears an acknowledged terminal run through SetRecordRun (RunClear). |
| 1093 | {"internal/console/apirunsfollow.go", "Server.handleAPIRunAck", "record-writer", "key:SetRecordRun", "463d44dd5efb9d3da3ced08712bf9107afed708a9e503ea327b4bd8b1c062452"}, |
| 1094 | // Cancels a run through SetRecordRun (RunCancelTransition). |
| 1095 | {"internal/console/apirunsfollow.go", "Server.handleAPIRunCancel", "record-writer", "key:SetRecordRun", "5c59e678b121e39e4cd333819959f66569080bde32c8bca861c31162d3eb6aec"}, |
| 1096 | // Expires a queued run through SetRecordRun (RunExpire). |
| 1097 | {"internal/console/apirunsfollow.go", "Server.handleAPIRunExpire", "record-writer", "key:SetRecordRun", "903ab23c58ae0fc3c9dfda46dd185d364999fecc0592a1868cd7243a9b4f7644"}, |
| 1098 | // The run sweep's expiry through SetRecordRun (RunExpire). |
| 1099 | {"internal/console/runsweep.go", "Server.sweepExpireQueued", "record-writer", "key:SetRecordRun", "4c597abbafbda5ef667ae9dcb9796a16f6553e3b0ad688d6d9a580913bf58924"}, |
| 1100 | // The run sweep closes a lost run through SetRecordRun (RunFinish). |
| 1101 | {"internal/console/runsweep.go", "Server.sweepLostRun", "record-writer", "key:SetRecordRun", "c4be7204e06cc4f7a7afe2217f8feddadf67b7abfa5a9049bce24aab33aa3936"}, |
| 1102 | // The run sweep clears a terminal run past retention through SetRecordRun (RunClear). |
| 1103 | {"internal/console/runsweep.go", "Server.sweepTerminalRun", "record-writer", "key:SetRecordRun", "78e3510bbf056dbf28446391b552c87060094ca803a3b1a8b7d7013163ee136b"}, |
| 1104 | // The box records a run's end through SetRecordRun (runFinishOurs). |
| 1105 | // Re-reviewed for run-lifecycle-logs-325 (amadan #325, proposed): emits the run's end as a member log event once its result has landed (at most once); record writes unchanged. |
| 1106 | {"internal/host/runexec.go", "runsWorker.finish", "record-writer", "key:SetRecordRun", "42f8628f74fcdfd3a0a56d302caa6f423f6c8fe8726c3561028e94ad97037041"}, |
| 1107 | // The box closes a run an agent restart interrupted through SetRecordRun (runFinishOurs). |
| 1108 | // Re-reviewed for run-lifecycle-logs-325 (amadan #325, proposed): reads result.json before and after its create-only write and emits the run's end as a member log event only when the result is its own and its done CAS landed (at most once); record writes unchanged. |
| 1109 | {"internal/host/runs.go", "runsWorker.closeInterrupted", "record-writer", "key:SetRecordRun", "b540e246a977470c50d3ebbbef080f9b8a824490fd3bb8bd6f98537bc882adee"}, |
| 1110 | // The box finishes a run of this boot whose result is written through SetRecordRun (RunFinish). |
| 1111 | {"internal/host/runs.go", "runsWorker.finishStranded", "record-writer", "key:SetRecordRun", "2d775d33b9ba97e4ed2953eb1880d33affcfba95fe5857dcdde72eb0f9acadf0"}, |
| 1112 | // The box picks a queued run up by CAS through SetRecordRun (RunPick). |
| 1113 | {"internal/host/runs.go", "runsWorker.pickup", "record-writer", "key:SetRecordRun", "d5f092e8a69d0c9907dbfb065b06f46895cb1eeafd2251009622923f797ee3b5"}, |
| 1114 | // The run transitions' one writer: updateRecord's read-CAS-write through WriteRecord (carlos run, run spec §5.1). |
| 1115 | {"internal/provision/run.go", "SetRecordRun", "record-writer", "key:SetRecordRun,key:updateRecord", "9e355288ad58464da1af8a06f1604d3e4a51bc7c5b7e26c1e6c9910e674b102b"}, |
| 1116 | // Puts a run's output chunk under runs/<id>/out/; not a record object. |
| 1117 | {"internal/runs/chunker.go", "Chunker.flushLocked", "nonrecord", "sel:Put", "6ddb95192afb4b9e4f692fdbe8b440c63a361fb8043c57bc3226e13c7224689d"}, |
| 1118 | // Removes leftover run directories beneath local instance data directories; no store write. |
| 1119 | {"internal/runs/stage.go", "SweepRunDirs", "key-site", "lit:instances", "3c469bec8c6ec91936dff0dd18ca6708d30147c1f30c826ebbb02e0bafaa535c"}, |
| 1120 | // Puts a run's result.json under runs/<id>/; not a record object. |
| 1121 | {"internal/runs/store.go", "WriteResult", "nonrecord", "sel:Put", "49e910f0a26ac0c71b2fdbe0c9d82eb16e9f7730141766eadbb885cdaafdb8b3"}, |
| 1122 | // Builds the CLI's /instances/<host>/runs URL path; writes nothing. |
| 1123 | {"run.go", "runAPI.path", "key-site", "lit:instances", "f79afcb16fb7967e4948e5cf7b31763e9efe252208448f2b81ab4b4cec1a5da1"}, |
| 1124 | // BEGIN seeded instances (#260, #261) |
| 1125 | // Reviewed at the merge of carlos-run into seeded-instances (2026-10-13): the |
| 1126 | // seeded series was built before this census reached its base. Every record |
| 1127 | // write below goes through the typed API (CreateRecord, SetRecordSeed), every |
| 1128 | // record delete is a CAS on the etag read, and every console door refuses a |
| 1129 | // claim console before it writes (seedRegionReady, importGate, finishSeed, the |
| 1130 | // sweep). On a claim-armed box the swap and the rollback are not armed and the |
| 1131 | // journal pass only protects; the two writes left there are the swap's refusal |
| 1132 | // (swapImport) and the no-journal finish of an aborted seed (finishAbortedSeed), |
| 1133 | // both through SetRecordSeed. |
| 1134 | // Builds the import doors' path (/api/cli/apps/.../instances/<host>/import...); it writes no record. |
| 1135 | {"apimode.go", "importDoor", "key-site", "lit:instances", "96919f2814950abf43f4915bd8d231f73cc347a75e9ad787abae1e0434a0d7dd"}, |
| 1136 | // The import door's begin: creates the record with its seed at awaiting-upload through CreateRecord (create-only), after every check of the create door and after seedRegionReady, which refuses a claim console. |
| 1137 | {"internal/console/apiinstanceimport.go", "Server.beginImport", "record-writer", "key:CreateRecord", "d21e6b6ec8fd4f863eaddc5560f3d378891037a04b51d15f4fe4acbb26ebd0b9"}, |
| 1138 | // The ordinary delete bound to the etag the import rule read (DeleteIfMatch on the record's key). Never on a claim console, whose delete is the claim's. |
| 1139 | {"internal/console/apiinstanceimport.go", "Server.deleteRead", "key-site", "key:RecordKey", "21ccc54bc677dccd66168fe0632d39be820721986a9f76ffeda49f47ac4a98de"}, |
| 1140 | // Moves an import to aborted through SetRecordSeed (SeedAbort), behind importGate, which refuses a claim console. |
| 1141 | {"internal/console/apiinstanceimport.go", "Server.handleAPIImportAbort", "record-writer", "key:SetRecordSeed", "33d3aaaa898ff7916b0aafda1caa0c4578be598471e4567e392ee95f4c796192"}, |
| 1142 | // placed to committed through SetRecordSeed (SeedCommit), behind importGate. |
| 1143 | {"internal/console/apiinstanceimport.go", "Server.handleAPIImportCommit", "record-writer", "key:SetRecordSeed", "90cff112c9c64bc78590c585aabdd91d29cd1848afc26dabb9f02c665bb82355"}, |
| 1144 | // uploaded to ready through SetRecordSeed (SeedStopped), behind importGate. |
| 1145 | {"internal/console/apiinstanceimport.go", "Server.handleAPIImportStopped", "record-writer", "key:SetRecordSeed", "ee5be2c30d4c1aab2b396d5bf3f8a7ffc8c9d9057fe23d4bf2a6bdddfaf15463"}, |
| 1146 | // The delete door's import rule: an import no box has swapped is rolled back through SetRecordSeed (SeedRolledBackBeforeSwap) and finished; an uncommitted import on a claim console is refused. |
| 1147 | {"internal/console/apiinstanceimport.go", "Server.importDeleteRule", "record-writer", "key:SetRecordSeed", "99a68247f8f146b2822d8c20b407dd76524b3f01481ec48da93efdf0bfa04d3c"}, |
| 1148 | // Reads the record the delete rule decides on; writes none. |
| 1149 | {"internal/console/apiinstanceimport.go", "Server.readDeletedRecord", "key-site", "key:RecordKey", "c635b439ae4bec54933118a8ff983251d47b81b40d1bb42663e881b55a6452d3"}, |
| 1150 | // The detached upload: uploaded, or aborted with its reason, through SetRecordSeed (SeedUploaded, SeedAbortUploadBecause). |
| 1151 | {"internal/console/apiinstanceimport.go", "Server.runImportUpload", "record-writer", "key:SetRecordSeed", "89493b89ce87a88922be284ab0e004de6fb053857abf24dd9606a63ca281f584"}, |
| 1152 | // Undoes a begin that failed after its record was written: SetRecordSeed (SeedRolledBackBeforeSwap), then the finish. |
| 1153 | {"internal/console/apiinstanceimport.go", "Server.unbeginImport", "record-writer", "key:SetRecordSeed", "8c95ef345a005af753ae5e85672aa420972c415b22d9091bbe9c1c448fc520a0"}, |
| 1154 | // Writes an import's snapshot object (seeds/<host>/<id>/snapshot.db, create-only) to the home region's data bucket; no record key. |
| 1155 | {"internal/console/apiinstanceimport.go", "putSnapshot", "nonrecord", "sel:PutObjectFrom", "685e888b76285bddaef6fd424cd5b37df381ebd86da4740400ac90d9a666135d"}, |
| 1156 | // The --from door's reservation: creates the record with its seed at reserving through CreateRecord (create-only), after seedRegionReady, which refuses a claim console. |
| 1157 | {"internal/console/apiinstanceseed.go", "Server.beginFrom", "record-writer", "key:CreateRecord", "9343266a950ad056ce5a480a017bcb847460ea33ac69449f49e5ba64cb5037a3"}, |
| 1158 | // The detached copy: ready, or aborted with its reason, through SetRecordSeed (SeedPublishReplica, SeedAbortBecause). |
| 1159 | {"internal/console/apiinstanceseed.go", "Server.runFrom", "record-writer", "key:SetRecordSeed", "79932f08e270bc802608ab8284b8ce2cb86fec8688803fbbe9bb523fa37d5e53"}, |
| 1160 | // Writes a --from seed's snapshot object (seeds/<host>/<id>/snapshot.db, create-only) to the home region's data bucket; no record key. |
| 1161 | {"internal/console/apiinstanceseed.go", "uploadSnapshot", "nonrecord", "sel:PutObjectFrom", "bdbe065ac75e6d3b874f20ab4e2a3ecae72e282038e414126fa013e92b2e114e"}, |
| 1162 | // Writes control/legacy-route-owners.json by CAS; its door refuses a claim console first. No record key. |
| 1163 | {"internal/console/apilegacyroutes.go", "assignLegacyRoute", "nonrecord", "sel:Put", "e2053006c28db3a564ea2c5364ef6a87347118310c7528316d6cef28fb737536"}, |
| 1164 | // Deletes a rolled-back seed's record by CAS on the etag it read (DeleteIfMatch), last, after the store teardown and the snapshot; finishSeed refuses a claim console. |
| 1165 | {"internal/console/seedfinish.go", "Server.finishSeedOnce", "key-site", "key:RecordKey", "2cc0f6bc838e2a09e5e5accf068fad812ed763fe75f858ed1e3b4c0d48396289"}, |
| 1166 | // The sweep's abandon of a stale seed, to aborted through SetRecordSeed; the sweep is off on a claim console. |
| 1167 | {"internal/console/seedsweep.go", "Server.abandonSeed", "record-writer", "key:SetRecordSeed", "a1ac6747620b8d60a9d5222d593f22e1db41f7e03690882c2986cdc510a5bbfe"}, |
| 1168 | // The box's placed recorder: SetRecordSeed (SeedPlace) after the first upload, then the snapshot's delete. It is assigned whatever the claim flag says. Its two callers are the plain wake's step 5b and the seed fallback's finish, and neither runs with claim control on: a claims-on wake is the claim's own (doClaimWake), and the fallback refuses under ClaimArmed before it reaches the finish. (Corrected after merge review: it is not "wired only with claim control off".) |
| 1169 | {"internal/host/seedwiring.go", "seedPlacedHook", "record-writer", "key:SetRecordSeed", "8583e0cce0e00cd4c724162bed93f357fb326c2a0635a413e7666a71419bcf76"}, |
| 1170 | // Puts a store record back as it was, or deletes it, by CAS, under RevertIn's app mutation: a store record, not a host record. |
| 1171 | {"internal/objstore/objstore.go", "claimRawRevertIn", "nonrecord", "sel:Put", "bfbde7d63e304a08494280d250c4cd50179e5c465b6d37015d5f56b29c32a5fc"}, |
| 1172 | // Reads every record of an app, strictly; writes none. |
| 1173 | {"internal/provision/provision.go", "ListRecordsStrict", "key-site", "key:RecordKey,key:RecordsPrefix", "da53d4cc38f8fed89e530aa868dd8a44973ef1f5ce22c51c0b0bfbe53379ba78"}, |
| 1174 | // updateRecord's scaffold, moved here: read, mutate, refuse a change to a protected field or (unless seedWrite) to Seed, then WriteRecord, with one retry. |
| 1175 | {"internal/provision/provision.go", "updateRecordSeeding", "record-writer", "key:RecordKey,key:WriteRecord", "1382563a6a4ee430edfc3bb34c808b64cfed93c21afec2863dc6a04f3f273683"}, |
| 1176 | // The seed transitions' typed writer: updateRecordSeeding with seedWrite true. |
| 1177 | {"internal/provision/seed.go", "SetRecordSeed", "record-writer", "key:SetRecordSeed", "726f353d829549d36b2634cb6dc2ce98d30e5f8f565044f6b2f7315daefacea3"}, |
| 1178 | // An aborted seed with no journal row: deletes its snapshot, then SetRecordSeed (SeedRolledBack). |
| 1179 | {"internal/provision/seedreconcile.go", "finishAbortedSeed", "record-writer", "key:SetRecordSeed", "c8b2d4d24cda9430cecba42cb5a93ccde50ee02ed2c0c2aef42d7e01bf4a32f0"}, |
| 1180 | // Compares each journal row's record key with the record the pass read; writes no record. |
| 1181 | // Re-reviewed for merge review S2 (2026-10-13): with claim control on for the box every journaled host is protected and handled and nothing else is done: no rollback, no redone record CAS, no cleared gate. It still writes no record itself. |
| 1182 | {"internal/provision/seedreconcile.go", "journalPass", "key-site", "key:RecordKey", "ef46f7c4ae634f472ac53b4754c030f0f24317aa3bd8a13598e80aa23269a528"}, |
| 1183 | // Picks the record a journal row names, by key; reads only. |
| 1184 | {"internal/provision/seedreconcile.go", "journalRecord", "key-site", "key:RecordKey", "ed4f8cd033967157e6ba96cb84f95da7ed8a08898f18f8c66334eaeb62b97453"}, |
| 1185 | // The rollback's steps 6 to 8: the bucket cleanup, the journal row's delete, then SetRecordSeed (SeedRolledBack). |
| 1186 | {"internal/provision/seedrollback.go", "cleanUpImport", "record-writer", "key:SetRecordSeed", "08c1f537f2bd62c3349958f742ec460f2741433aa09d66e31a4013ae193c5d42"}, |
| 1187 | // Reads the record under the journal row's key; writes none. |
| 1188 | {"internal/provision/seedrollback.go", "journalRecordByKey", "key-site", "key:RecordKey", "3424932d53adbfd085c8ae4fb8dab4b0619ac0e56946a69087c4561d1355178a"}, |
| 1189 | // Lists the records that name the host, to decide whose replica it is; writes none. |
| 1190 | {"internal/provision/seedrollback.go", "replicaIsTheImports", "key-site", "key:ParseRecordKey,key:RecordKey,lit:instances", "2b1925d38da3102d13d372a700a458379f0936b393a0e06449e05ab9cea929ed"}, |
| 1191 | // ready to swapped through SetRecordSeed (SeedSwapped), after the registry transaction committed. |
| 1192 | {"internal/provision/seedswap.go", "markSwapped", "record-writer", "key:SetRecordSeed", "8d3c844b0370e574b73a7bbdf92d1749cd69ddc343357b5b450059e713d035d2"}, |
| 1193 | // The swap: it names the journal row's record key, and its one record write before the transaction is a refusal through SetRecordSeed (SeedRefuse), which is all it writes with claims on. |
| 1194 | // Re-reviewed for merge review S1 (2026-10-13): before its registry transaction the swap asks the box what the host's own env file holds (SeedHooks.EnvBefore) and keeps the answer in the journal row; a read that fails defers the swap. No record write was added. |
| 1195 | {"internal/provision/seedswap.go", "swapImport", "record-writer", "key:RecordKey,key:SetRecordSeed", "af87cf52f0588a695e273f6719c74ad9738db80cbb07282e0dac2a993e610016"}, |
| 1196 | // RecordKey here is the journal row's column naming its record; a registry transaction, no bucket write. |
| 1197 | // Re-reviewed for merge review S1 (2026-10-13): the journal row also stores EnvBefore (one of three values, or empty), in the same transaction; still no bucket write. |
| 1198 | {"internal/registry/importjournal.go", "Registry.SwapForImport", "key-site", "key:RecordKey", "f55fae3ef3a731c6ea57d82573c214082316a2c7e01255b0e8f549a6d4f25474"}, |
| 1199 | // Reads the journal's record_key column into the snapshot digest; no bucket write. |
| 1200 | // Re-reviewed for merge review S1 (2026-10-13): also folds env_before into the digest, when set; no bucket write. |
| 1201 | {"internal/registry/importjournal.go", "hashImportJournal", "key-site", "key:recordKey", "7c60d298ba3a000711feb49c5a2a6964d78c645ee5bbf0253a8d244f19920a46"}, |
| 1202 | // Scans a journal row, its record key among the columns; no bucket write. |
| 1203 | // Re-reviewed for merge review S1 (2026-10-13): scans env_before too; no bucket write. |
| 1204 | {"internal/registry/importjournal.go", "scanJournalRow", "key-site", "key:RecordKey", "752a3b638a5580ea0a1d03f3b031b5669539d1cfc899f0a520c51e2c845da983"}, |
| 1205 | // The journal row's struct; RecordKey is a field naming the import's record. |
| 1206 | // Re-reviewed for merge review S1 (2026-10-13): gains the EnvBefore field; RecordKey is unchanged. |
| 1207 | {"internal/registry/importjournal.go", "type ImportJournal", "key-site", "key:RecordKey", "905b3ca8c1a9366d8c4eb310d1fdbfb34c14cc57f30c722f424c3dd46c8d4515"}, |
| 1208 | // Writes control/seeds-protocol.json by CAS (classified in hostops' mutation classifier); no record key. |
| 1209 | {"internal/seeds/floor.go", "PublishFloor", "nonrecord", "sel:Put", "3085ce28914a709f1a55c5c430fe9ef9f66b94f1c6a54694d092dcff272978fe"}, |
| 1210 | // END seeded instances |
| 1211 | } |
| 1212 | |
| 1213 | // END REVIEWED INVENTORY |
| 1214 | |
amadan