| 1 | # Census overlay s3-change-index (amadan #336: the S3 change index; docs/superpowers/specs/2026-10-21-s3-change-index-design.md), loaded LAST, after db-region-forward-1. Proposed: new and re-pinned rows carry rev3=PROPOSED-s3-change-index and the H3 removals census-ruling-s3-change-index; the ruling is asked of the census owner on #280. |
| 2 | # What changed. The deployment stores bump control/changes.json after each successful mutation (Put, PutFrom, Delete, DeleteIfMatch split into a raw body plus the bump). Readers armed by CARLOS_CHANGE_INDEX=read (unset is exactly today's behaviour) read records through a record view snapshot, skip unchanged generation, canary pointer and telemetry reads behind a gate whose maximum age is the 30 minute backstop, and run a scoped pass over the apps whose scope moved. A pass over a snapshot that would remove a row on absence runs its own record walk again over the live bucket and decides every removal that pass from it (a walk that cannot read cleanly keeps every row); the moves pass uses the snapshot only to decide whether it has move work, and acts on its own walk of the bucket; with no change index armed, the telemetry pass is main's (final review R1 fixes). |
| 3 | # Who runs it. The new and changed units run in the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos), the console (cmd/console serve, user carlos-console), or are store methods every deployment-store opener shares, as their siblings. Root's carlos adopt reaches only PassFilter, type passConfig and passConfig.gatePointers, with the gate nil (unchanged pass). runSystemClaims (operator CLI, uid 0) now opens the deployment store with the change index, so its writes bump control/changes.json; the bump reads and rewrites that one object and decides nothing else. |
| 4 | # Re-pins keep each unit's class and append this branch's basis. New units take their siblings' class. Frozen declarations are added, so the seal moves; db-region-forward-1's is checked first. |
| 5 | # Merged over origin/main 13e2f75f (db-region-forward-1): runAgent and fastConvergeLoop keep main's db-region-forward-1 basis with this branch's appended; runAgent's digest and the ., internal/console and internal/host envelopes are re-pinned for the merged source (main's armDBReads, and its db-reads nudge, which moved with the pass legs into passLegs.run). |
| 6 | @legacy 8aed1441fabaa3bb95898b31bfd1d0e00dfc93ef0e608612c83c80e5b166d32c cmd/console/main.go serve legacy accepted-legacy accepted-legacy;rev3=PROPOSED-scan-demand-revival;basis=Console service wires the optional callback signer and starts the claim-guarded queue worker. The same three data path literals move; it does not add a privileged reader.;rev3=PROPOSED-email-signin;identity=the console (cmd/console serve under console.service, user carlos-console);basis=passes CARLOS_CONSOLE_NAME to NewServer as Config.ConsoleName, the name the console's emails use; the same three /data literals at the same offsets; no read added;rev3=PROPOSED-s3-change-index;identity=the console (cmd/console serve under console.service, user carlos-console);basis=arms the record view when CARLOS_CHANGE_INDEX=read (armChangeIndex) for the run and seed sweeps and starts its backstop loop; the same three /data literals at the same offsets; no read added data-literal@4077,data-literal@5178,data-literal@5415 32740c27448264baa40a1c8062fa847b992d02ca21b6117fa2e55dfaf10febdc |
| 7 | cmd/console/main.go serve legacy accepted-legacy accepted-legacy;rev3=PROPOSED-scan-demand-revival;basis=Console service wires the optional callback signer and starts the claim-guarded queue worker. The same three data path literals move; it does not add a privileged reader.;rev3=PROPOSED-email-signin;identity=the console (cmd/console serve under console.service, user carlos-console);basis=passes CARLOS_CONSOLE_NAME to NewServer as Config.ConsoleName, the name the console's emails use; the same three /data literals at the same offsets; no read added;rev3=PROPOSED-s3-change-index;identity=the console (cmd/console serve under console.service, user carlos-console);basis=arms the record view when CARLOS_CHANGE_INDEX=read (armChangeIndex) for the run and seed sweeps and starts its backstop loop; the same three /data literals at the same offsets; no read added data-literal@4077,data-literal@5178,data-literal@5415 32740c27448264baa40a1c8062fa847b992d02ca21b6117fa2e55dfaf10febdc |
| 8 | @legacy 7712d77765ffa0623a9f481c5634de12a3825d4b0ae188d01f4e183c633b9929 internal/appconfig/syncexec.go SyncExecWithCallbacks legacy accepted-legacy accepted-legacy;rev3=census-ruling-moves-offline-fixes;basis=route-and-input (J1,J4, main's disposition); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos), through syncExecSerialized: main's body, with a nested row whose write found no instance directory named and skipped (errInstanceDirAbsent, WhenInstanceDirAbsent) instead of failing the pass, and each in-scope host reported done or not done (WithHostOutcome) once the pass has gone through every route; no new read site;rev3=PROPOSED-s3-change-index;identity=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos);basis=the scoped pass's route filter (WithRouteFilter, syncOptions.kept) is checked in its three route loops, so a route the filter leaves out is out of scope before anything is read for it; three whole-Route sites added, each passing rt to kept; no bucket or file read added file:Stat@28647,registry:App@10371,registry:App@10586,registry:App@16132,registry:App@28532,registry:Environment@10379,registry:Environment@10594,registry:Environment@16140,registry:Environment@28540,registry:Host@1031,registry:Host@1066,registry:Host@1495,registry:Host@15640,registry:Host@15967,registry:Host@16065,registry:Host@16897,registry:Host@17248,registry:Host@18183,registry:Host@18724,registry:Host@21651,registry:Host@21868,registry:Host@22426,registry:Host@22616,registry:Host@22625,registry:Host@22644,registry:Host@25545,registry:Host@26162,registry:Host@26214,registry:Host@26370,registry:Host@29041,registry:Host@866,registry:Host@937,whole:Route@10141,whole:Route@10199,whole:Route@10264,whole:Route@10325,whole:Route@10366,whole:Route@10483,whole:Route@10517,whole:Route@10581,whole:Route@1447,whole:Route@1476,whole:Route@15552,whole:Route@15602,whole:Route@16127,whole:Route@25141,whole:Route@25555,whole:Route@26259,whole:Route@28416,whole:Route@28449,whole:Route@28464,whole:Route@28527,whole:Route@28628,whole:Route@29278,whole:Route@29351,whole:Route@693,whole:Route@721,whole:Route@750,whole:Route@776,whole:Route@811 41bbc2b0ed3fe93b4bd8376ce86e7fb82fa9276a85c3cf4edfa46d8c9d45fd7e |
| 9 | internal/appconfig/syncexec.go SyncExecWithCallbacks legacy accepted-legacy accepted-legacy;rev3=census-ruling-moves-offline-fixes;basis=route-and-input (J1,J4, main's disposition); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos), through syncExecSerialized: main's body, with a nested row whose write found no instance directory named and skipped (errInstanceDirAbsent, WhenInstanceDirAbsent) instead of failing the pass, and each in-scope host reported done or not done (WithHostOutcome) once the pass has gone through every route; no new read site;rev3=PROPOSED-s3-change-index;identity=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos);basis=the scoped pass's route filter (WithRouteFilter, syncOptions.kept) is checked in its three route loops, so a route the filter leaves out is out of scope before anything is read for it; three whole-Route sites added, each passing rt to kept; no bucket or file read added file:Stat@28647,registry:App@10371,registry:App@10586,registry:App@16132,registry:App@28532,registry:Environment@10379,registry:Environment@10594,registry:Environment@16140,registry:Environment@28540,registry:Host@1031,registry:Host@1066,registry:Host@1495,registry:Host@15640,registry:Host@15967,registry:Host@16065,registry:Host@16897,registry:Host@17248,registry:Host@18183,registry:Host@18724,registry:Host@21651,registry:Host@21868,registry:Host@22426,registry:Host@22616,registry:Host@22625,registry:Host@22644,registry:Host@25545,registry:Host@26162,registry:Host@26214,registry:Host@26370,registry:Host@29041,registry:Host@866,registry:Host@937,whole:Route@10141,whole:Route@10199,whole:Route@10264,whole:Route@10325,whole:Route@10366,whole:Route@10483,whole:Route@10517,whole:Route@10581,whole:Route@1447,whole:Route@1476,whole:Route@15552,whole:Route@15602,whole:Route@16127,whole:Route@25141,whole:Route@25555,whole:Route@26259,whole:Route@28416,whole:Route@28449,whole:Route@28464,whole:Route@28527,whole:Route@28628,whole:Route@29278,whole:Route@29351,whole:Route@693,whole:Route@721,whole:Route@750,whole:Route@776,whole:Route@811 41bbc2b0ed3fe93b4bd8376ce86e7fb82fa9276a85c3cf4edfa46d8c9d45fd7e |
| 10 | @legacy 147e791b4b64eb6112c4de13802081973d19d1428ed090e75f180d1bf93cb94a internal/console/runsweep.go Server.runSweepPass legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the console (cmd/console serve under console.service, user carlos-console): the console's run sweep: expires queued runs and ends lost ones by CAS on the record;rev3=PROPOSED-s3-change-index;identity=the console (cmd/console serve under console.service, user carlos-console);basis=armed, reads the records through the record view (recordWalkStore) and lists runs/ for orphans only for apps with a run-start audit row in the last 48 hours (orphanCandidates, Store.AppsWithActionSince), with a full orphan sweep at start and every 24 hours; every write and the runs/ listing stay on the bucket; read site unchanged, offset moved file:Open@1438 466d9bb74c5f5fa33d968c3862dfd5c9662b63b7659844ff43d55bb8d937ecc1 |
| 11 | internal/console/runsweep.go Server.runSweepPass legacy accepted-legacy accepted-legacy;rev3=census-ruling-carlos-run;basis=the console (cmd/console serve under console.service, user carlos-console): the console's run sweep: expires queued runs and ends lost ones by CAS on the record;rev3=PROPOSED-s3-change-index;identity=the console (cmd/console serve under console.service, user carlos-console);basis=armed, reads the records through the record view (recordWalkStore) and lists runs/ for orphans only for apps with a run-start audit row in the last 48 hours (orphanCandidates, Store.AppsWithActionSince), with a full orphan sweep at start and every 24 hours; every write and the runs/ listing stay on the bucket; read site unchanged, offset moved file:Open@1438 466d9bb74c5f5fa33d968c3862dfd5c9662b63b7659844ff43d55bb8d937ecc1 |
| 12 | @legacy d63b9da377834935321f22b7af726257ebbc1b6e6204afc6e85205850ffcc257 internal/host/agent.go configGenLoop legacy accepted-legacy accepted-legacy;rev3=census-ruling-moves-offline-fixes;basis=root-route (J1, main's disposition); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's loop, its tick's body moved into configGenTick; the registry listing stays here;rev3=PROPOSED-s3-change-index;identity=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos);basis=builds the generation cache's change gate (newChangeGate) after the agent armed the index; read site unchanged, offset moved whole:Route@1362 c5d039380bf66781652a6e75df4d4614d192e68c939ceef7c8875b383b0dcaeb |
| 13 | internal/host/agent.go configGenLoop legacy accepted-legacy accepted-legacy;rev3=census-ruling-moves-offline-fixes;basis=root-route (J1, main's disposition); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's loop, its tick's body moved into configGenTick; the registry listing stays here;rev3=PROPOSED-s3-change-index;identity=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos);basis=builds the generation cache's change gate (newChangeGate) after the agent armed the index; read site unchanged, offset moved whole:Route@1362 c5d039380bf66781652a6e75df4d4614d192e68c939ceef7c8875b383b0dcaeb |
| 14 | @legacy 619ddec1235e248f234943915a064de44f6c6c8e5c2c37ae432bd629e0e5d359 internal/host/agent.go fastTick legacy accepted-legacy accepted-legacy;rev3=J1;basis=root-route;rev3=PROPOSED-s3-change-index;identity=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos);basis=observes the change index before any pass (observeIndex), runs the backstop's requested full pass and a scoped pass for moved app scopes (indexTick), and arms the canary pointer gate on the sweep (canaryPointerGate) only on a tick whose own index observation succeeded; read site unchanged, offset moved registry:Host@4720 936882c271ea015144472e2726b9c51f926b9ed2ac7314702449359441b1f33f |
| 15 | internal/host/agent.go fastTick legacy accepted-legacy accepted-legacy;rev3=J1;basis=root-route;rev3=PROPOSED-s3-change-index;identity=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos);basis=observes the change index before any pass (observeIndex), runs the backstop's requested full pass and a scoped pass for moved app scopes (indexTick), and arms the canary pointer gate on the sweep (canaryPointerGate) only on a tick whose own index observation succeeded; read site unchanged, offset moved registry:Host@4720 936882c271ea015144472e2726b9c51f926b9ed2ac7314702449359441b1f33f |
| 16 | @legacy ce2cf944137713e8cb39ddade175b99907b510b0c0d6033f0a9d2c408f4e4e79 internal/host/agent.go genPollPass legacy accepted-legacy accepted-legacy;rev3=J1;basis=root-route;rev3=PROPOSED-s3-change-index;identity=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos);basis=armed, an app already in the cache skips its generation read unless its scope moved, its last read failed, or that read is the backstop's age (release.ReadGate); read sites unchanged at the same offsets whole:Route@399,whole:Route@639,whole:Route@685 cc5bfbdba246803782a029bc3868d1f250b92e1868a785a70783368b0f72091e |
| 17 | internal/host/agent.go genPollPass legacy accepted-legacy accepted-legacy;rev3=J1;basis=root-route;rev3=PROPOSED-s3-change-index;identity=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos);basis=armed, an app already in the cache skips its generation read unless its scope moved, its last read failed, or that read is the backstop's age (release.ReadGate); read sites unchanged at the same offsets whole:Route@399,whole:Route@639,whole:Route@685 cc5bfbdba246803782a029bc3868d1f250b92e1868a785a70783368b0f72091e |
| 18 | @legacy 3539c4d974f5965c27b0f61531f483b5ce395f24005e190de130bbece08a8f05 internal/host/steering_loop.go steeringPass legacy accepted-legacy accepted-legacy;rev3=J1;basis=root-route;rev3=PROPOSED-s3-change-index;identity=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos);basis=reads the steered records through the record view when it can vouch (viewStore), the bucket otherwise; read site unchanged, offset moved whole:Route@475 5db289406e7e014db706e6e37146396ae88865ffb8a8c43aed90c2433da1ed6d |
| 19 | internal/host/steering_loop.go steeringPass legacy accepted-legacy accepted-legacy;rev3=J1;basis=root-route;rev3=PROPOSED-s3-change-index;identity=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos);basis=reads the steered records through the record view when it can vouch (viewStore), the bucket otherwise; read site unchanged, offset moved whole:Route@475 5db289406e7e014db706e6e37146396ae88865ffb8a8c43aed90c2433da1ed6d |
| 20 | @legacy 5f09d85d9586e22f1d8447c122cde4c75a2ecacb28c85ab28e3f5e7090760460 internal/provision/reconcile.go Reconcile legacy accepted-legacy accepted-legacy;rev3=census-ruling-seeded-instances;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body with the import journal read before the records are acted on (journalPass), seeded records dispatched first (seedAction), journaled hosts kept out of the removal phase and a row's seed column converged from its record; the agent's own pass;rev3=PROPOSED-s3-change-index;identity=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos);basis=the record walk moves unchanged into the pass's scan closure (over a store argument) and the removal phase into its retire closure; over a record view snapshot, a pass that reaches a removal candidate proved by absence (record gone, app in the trash) removes nothing on the snapshot's word: it runs scan again over the bucket (freshStore) and decides every removal that pass from that walk, by the walk's own rules (unusable records protected before scope, hosts matched across every key, the bucket's trash marker); a walk that cannot read cleanly keeps every row; with no candidate, or disarmed (never a snapshot), nothing is read again; the registry sites are main's, moved; relative to main's single walk a removal can only be withheld, never added registry:Account@20586,registry:Account@21678,registry:Account@35895,registry:Account@35941,registry:App@20559,registry:App@21651,registry:App@35915,registry:App@35953,registry:ClaimOwnership@21173,registry:DBPath@27374,registry:DBPath@27389,registry:DBPath@27635,registry:DBPath@28166,registry:DBPath@28179,registry:Gate@24314,registry:Gate@24454,registry:Gate@24719,registry:Hibernate@23292,registry:Hibernate@23610,registry:Hibernate@23961,registry:Hibernate@24249,registry:Host@14463,registry:Host@35873,registry:Host@36043,registry:Host@36140,registry:Host@36255,registry:Host@36600,registry:Host@36697,registry:Host@36874,registry:Host@37032,registry:Host@37134,registry:Kind@21315,registry:Kind@21578,registry:Kind@27292,registry:Kind@27305,registry:Kind@27415,registry:Kind@27428,registry:Kind@28077,registry:Kind@28088,registry:Kind@35109,registry:Kind@36865,registry:Kind@37023,registry:Kind@37125,registry:Pool@35201,registry:Provisioned@20535,registry:Provisioned@21627,registry:Provisioned@35159,registry:Region@35190,registry:Replication@23695,registry:Replication@23822,registry:Seed@25794,registry:SeedSource@25299,registry:Socket@27340,registry:Socket@27355,registry:Socket@27652,registry:Socket@28136,registry:Socket@28149,registry:Unit@27258,registry:Unit@27271,registry:Unit@28103,registry:Unit@28114,whole:ClaimOwnership@21176,whole:ClaimOwnership@21193,whole:Route@14445,whole:Route@14456,whole:Route@14474,whole:Route@15574,whole:Route@15874,whole:Route@15881,whole:Route@15921,whole:Route@16282,whole:Route@16600,whole:Route@17461,whole:Route@17817,whole:Route@17826,whole:Route@17872,whole:Route@20180,whole:Route@20651,whole:Route@20661,whole:Route@21018,whole:Route@21025,whole:Route@21093,whole:Route@21416,whole:Route@22059,whole:Route@23382,whole:Route@27484,whole:Route@28963,whole:Route@29008,whole:Route@29018,whole:Route@29881,whole:Route@30633,whole:Route@34557,whole:Route@35226,whole:Route@36945 b93306e178252e56c67dd2ed58b87250e1b3756bddaa2589c3f7392d03300832 |
| 21 | internal/provision/reconcile.go Reconcile legacy accepted-legacy accepted-legacy;rev3=census-ruling-seeded-instances;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body with the import journal read before the records are acted on (journalPass), seeded records dispatched first (seedAction), journaled hosts kept out of the removal phase and a row's seed column converged from its record; the agent's own pass;rev3=PROPOSED-s3-change-index;identity=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos);basis=the record walk moves unchanged into the pass's scan closure (over a store argument) and the removal phase into its retire closure; over a record view snapshot, a pass that reaches a removal candidate proved by absence (record gone, app in the trash) removes nothing on the snapshot's word: it runs scan again over the bucket (freshStore) and decides every removal that pass from that walk, by the walk's own rules (unusable records protected before scope, hosts matched across every key, the bucket's trash marker); a walk that cannot read cleanly keeps every row; with no candidate, or disarmed (never a snapshot), nothing is read again; the registry sites are main's, moved; relative to main's single walk a removal can only be withheld, never added registry:Account@20586,registry:Account@21678,registry:Account@35895,registry:Account@35941,registry:App@20559,registry:App@21651,registry:App@35915,registry:App@35953,registry:ClaimOwnership@21173,registry:DBPath@27374,registry:DBPath@27389,registry:DBPath@27635,registry:DBPath@28166,registry:DBPath@28179,registry:Gate@24314,registry:Gate@24454,registry:Gate@24719,registry:Hibernate@23292,registry:Hibernate@23610,registry:Hibernate@23961,registry:Hibernate@24249,registry:Host@14463,registry:Host@35873,registry:Host@36043,registry:Host@36140,registry:Host@36255,registry:Host@36600,registry:Host@36697,registry:Host@36874,registry:Host@37032,registry:Host@37134,registry:Kind@21315,registry:Kind@21578,registry:Kind@27292,registry:Kind@27305,registry:Kind@27415,registry:Kind@27428,registry:Kind@28077,registry:Kind@28088,registry:Kind@35109,registry:Kind@36865,registry:Kind@37023,registry:Kind@37125,registry:Pool@35201,registry:Provisioned@20535,registry:Provisioned@21627,registry:Provisioned@35159,registry:Region@35190,registry:Replication@23695,registry:Replication@23822,registry:Seed@25794,registry:SeedSource@25299,registry:Socket@27340,registry:Socket@27355,registry:Socket@27652,registry:Socket@28136,registry:Socket@28149,registry:Unit@27258,registry:Unit@27271,registry:Unit@28103,registry:Unit@28114,whole:ClaimOwnership@21176,whole:ClaimOwnership@21193,whole:Route@14445,whole:Route@14456,whole:Route@14474,whole:Route@15574,whole:Route@15874,whole:Route@15881,whole:Route@15921,whole:Route@16282,whole:Route@16600,whole:Route@17461,whole:Route@17817,whole:Route@17826,whole:Route@17872,whole:Route@20180,whole:Route@20651,whole:Route@20661,whole:Route@21018,whole:Route@21025,whole:Route@21093,whole:Route@21416,whole:Route@22059,whole:Route@23382,whole:Route@27484,whole:Route@28963,whole:Route@29008,whole:Route@29018,whole:Route@29881,whole:Route@30633,whole:Route@34557,whole:Route@35226,whole:Route@36945 b93306e178252e56c67dd2ed58b87250e1b3756bddaa2589c3f7392d03300832 |
| 22 | @legacy 96ccad12ba9ca42b8baf649552e8a9d63ad61439e00f1818c490df1e2d725804 internal/provision/reconcile.go holdExisting legacy accepted-legacy accepted-legacy;rev3=J1;basis=root-route;rev3=PROPOSED-s3-change-index;identity=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos);basis=the hold's record re-read reads the bucket (freshStore), never a record view snapshot; read sites unchanged, offsets moved registry:Account@640,registry:Account@795,registry:App@613,registry:App@781,registry:HoldOp@333,registry:HoldOp@371,registry:HoldOp@489,registry:Provisioned@589,registry:Status@1885,registry:Status@472 752df1628829a1effd249e58a5c52535e047c691affabc902c68f18f8fc8c28a |
| 23 | internal/provision/reconcile.go holdExisting legacy accepted-legacy accepted-legacy;rev3=J1;basis=root-route;rev3=PROPOSED-s3-change-index;identity=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos);basis=the hold's record re-read reads the bucket (freshStore), never a record view snapshot; read sites unchanged, offsets moved registry:Account@640,registry:Account@795,registry:App@613,registry:App@781,registry:HoldOp@333,registry:HoldOp@371,registry:HoldOp@489,registry:Provisioned@589,registry:Status@1885,registry:Status@472 752df1628829a1effd249e58a5c52535e047c691affabc902c68f18f8fc8c28a |
| 24 | @legacy 96cdfa7e1f0264c82646ee7f44d1a8147818a4a455e895fd00e6b6bd69ae51fa internal/provision/sidecar_reconcile.go ReconcileSidecars legacy accepted-legacy accepted-legacy;rev3=J1;basis=root-route;rev3=PROPOSED-s3-change-index;identity=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos);basis=the record walk and its sidecars manifest lookup move unchanged into the pass's scan closure (over a store argument) and the removal phase into its retire closure; over a record view snapshot, a pass that reaches a removal candidate (a sidecar gone or no longer placeable here) removes nothing on the snapshot's word: it runs scan again over the bucket (freshStore) and decides every removal that pass from that walk, by the walk's own rules (unusable records protected before scope, hosts matched across every key, placement from the bucket's record and sidecars manifest against this box's inbound); a walk that cannot read cleanly keeps every row; with no candidate, or disarmed, nothing is read again; the registry sites are main's, moved; relative to main's single walk a removal can only be withheld, never added registry:Account@11687,registry:Account@11926,registry:Account@12879,registry:Account@13629,registry:App@11660,registry:App@11912,registry:App@12852,registry:App@13615,registry:Args@12504,registry:Args@12775,registry:Channel@12492,registry:ClaimOwnership@12305,registry:Host@14965,registry:Host@15012,registry:Host@15135,registry:Host@15312,registry:Host@15461,registry:Host@15568,registry:Host@9281,registry:Kind@11601,registry:Kind@11875,registry:Kind@12792,registry:Kind@13578,registry:Kind@14798,registry:Pool@14916,registry:Provisioned@11633,registry:Provisioned@11890,registry:Provisioned@12824,registry:Provisioned@13593,registry:Provisioned@14825,registry:Region@14866,whole:ClaimOwnership@12308,whole:ClaimOwnership@12325,whole:Route@11289,whole:Route@12150,whole:Route@12157,whole:Route@12225,whole:Route@12560,whole:Route@12937,whole:Route@14783,whole:Route@15378,whole:Route@9263,whole:Route@9274,whole:Route@9292,whole:Route@9478,whole:Route@9847,whole:Route@9856 cc2aa4dbcb68f06f1190ad58a37c58e2608517e7388318b5b9e0b4bad0e8b5db |
| 25 | internal/provision/sidecar_reconcile.go ReconcileSidecars legacy accepted-legacy accepted-legacy;rev3=J1;basis=root-route;rev3=PROPOSED-s3-change-index;identity=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos);basis=the record walk and its sidecars manifest lookup move unchanged into the pass's scan closure (over a store argument) and the removal phase into its retire closure; over a record view snapshot, a pass that reaches a removal candidate (a sidecar gone or no longer placeable here) removes nothing on the snapshot's word: it runs scan again over the bucket (freshStore) and decides every removal that pass from that walk, by the walk's own rules (unusable records protected before scope, hosts matched across every key, placement from the bucket's record and sidecars manifest against this box's inbound); a walk that cannot read cleanly keeps every row; with no candidate, or disarmed, nothing is read again; the registry sites are main's, moved; relative to main's single walk a removal can only be withheld, never added registry:Account@11687,registry:Account@11926,registry:Account@12879,registry:Account@13629,registry:App@11660,registry:App@11912,registry:App@12852,registry:App@13615,registry:Args@12504,registry:Args@12775,registry:Channel@12492,registry:ClaimOwnership@12305,registry:Host@14965,registry:Host@15012,registry:Host@15135,registry:Host@15312,registry:Host@15461,registry:Host@15568,registry:Host@9281,registry:Kind@11601,registry:Kind@11875,registry:Kind@12792,registry:Kind@13578,registry:Kind@14798,registry:Pool@14916,registry:Provisioned@11633,registry:Provisioned@11890,registry:Provisioned@12824,registry:Provisioned@13593,registry:Provisioned@14825,registry:Region@14866,whole:ClaimOwnership@12308,whole:ClaimOwnership@12325,whole:Route@11289,whole:Route@12150,whole:Route@12157,whole:Route@12225,whole:Route@12560,whole:Route@12937,whole:Route@14783,whole:Route@15378,whole:Route@9263,whole:Route@9274,whole:Route@9292,whole:Route@9478,whole:Route@9847,whole:Route@9856 cc2aa4dbcb68f06f1190ad58a37c58e2608517e7388318b5b9e0b4bad0e8b5db |
| 26 | @legacy 047df94a818a724f8f2a922d08335c594677e9604cdd637c396f7d3465b893a6 internal/telemetry/telemetry.go Resolve legacy accepted-legacy accepted-legacy;rev3=J4;basis=root-input;rev3=PROPOSED-s3-change-index;identity=unchanged (the console and the agent);basis=the fold over the defaults moved into Fold, which the agent's switch pass calls over cached settings; the same two telemetry.Read calls, offsets moved file:Read@167,file:Read@279 a8ebfdad89a2b5ca7d41883bfe62c5c7a4a0989cf44909a131026b95178890f2 |
| 27 | internal/telemetry/telemetry.go Resolve legacy accepted-legacy accepted-legacy;rev3=J4;basis=root-input;rev3=PROPOSED-s3-change-index;identity=unchanged (the console and the agent);basis=the fold over the defaults moved into Fold, which the agent's switch pass calls over cached settings; the same two telemetry.Read calls, offsets moved file:Read@167,file:Read@279 a8ebfdad89a2b5ca7d41883bfe62c5c7a4a0989cf44909a131026b95178890f2 |
| 28 | internal/host/activation_command_linux.go runSystemClaims authority G,J4 rev3=census-ruling-install-console-upgrade;identity=explicit operator CLI uid 0;basis=as census-ruling-claim-step6-artifacts-fix1; install-console also takes --upgrade --from <sha256>, which upgradeFlagsRefused (no read site) admits only together and only for install-console, refusing them elsewhere as unknown flags were; without --upgrade the install path and its output are unchanged;rev3=PROPOSED-s3-change-index;identity=explicit operator CLI uid 0;basis=opens the deployment store with NewDeploymentS3StoreIn in place of NewS3StoreIn, so its deployment-bucket writes bump control/changes.json after they succeed (the bump reads and rewrites only that object and decides nothing else); read site unchanged, offset moved file:Read@1771 7541f194a34f6e85b8176e5ebb7302d9f99582caa3e40bef034af0e1ba6180c8 |
| 29 | internal/host/agent.go fastConvergeLoop authority B3 rev3=census-ruling-moves-offline;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body (census-ruling-carlos-run) with the offline keep view read before the first reconcile pass (refreshOfflineView); read sites unchanged, offsets moved; main's B3 authority retained;rev3=census-ruling-db-region-forward-1;basis=the serial pass also nudges the db-reads loop after the runs pass (nudgeDBReads, a channel send); read sites unchanged, offsets moved; main's B3 authority retained;rev3=PROPOSED-s3-change-index;identity=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos);basis=the full pass's legs moved unchanged into passLegs.full (changeindex.go), shared with the scoped pass; armed, it sets the watch, the scoped pass, the backstop request and the canary gate on the tick's deps; main's db-reads nudge (census-ruling-db-region-forward-1) moved with the legs into passLegs.run, so the full and the scoped pass both nudge (a channel send); read sites unchanged, offsets moved; B3 authority retained whole:Route@7551,whole:Route@8114 698576b28047cf9dd2a8cd7e0e5e1743c69a6c7b58faa3bbbc8e79e079fa3609 |
| 30 | internal/host/agent.go runAgent authority B,C,D,F rev3=census-ruling-seeded-instances;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body with wireSeedPlacement called in the activator start's Configure step, before armMovesPass, and the startup sweep's result stored for the import rollback in Recover; read sites unchanged, offsets moved; main's B,C,D,F authority retained PROPOSED E46: captured claim selection and root journal mutation; root RPC outside service host exclusion; SQL/route data never grants root authority. Executing identity: service controller; root for inventory/retirement callbacks.;rev3=PROPOSED-325;identity=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos);basis=passes the agent's log sink to armRunsPass; reads unchanged;rev3=census-ruling-db-region-forward-1;identity=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos);basis=arms the db-reads loop (armDBReads) beside armRunsPass in the activator start's Configure step; reads unchanged, offsets moved; main's authority retained;rev3=PROPOSED-s3-change-index;identity=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos);basis=arms the change index (armChangeIndex) and starts the record view's backstop loop before the loops that read through it, and hands the edge the watch loader (edge.WithChangeWatch); read sites unchanged at the same offsets file:Exec@13802,file:Open@731,registry:App@10065,whole:Route@10057,whole:Route@23518 b06b995907af5bea9f2e904824653b80c16ae29618f772b101088aa25964c1f0 |
| 31 | internal/release/adopt.go PassFilter authority B3,E3,J1,E1,E2 Signed named-unit recovery is independent of release and health history. Root rechecks canonical source, unit, process, signed target and trusted live pointer; captures attempt authority before publication; verifies readiness and resumes without repeated effects. Fixtures: TestPlan14SignedActiveFixIgnoresHistory, TestPlan14SignedActiveFixAuthority, TestPlan14SignedFixSupersedesOlderAttempt, TestPlan14ActiveRecoveryProcessCrash, TestPlan14SignedRestartWithoutHealthHistory, TestPlan14CapturedRollbackWithoutHealthHistory, TestPlan14SignedRestartRequiresTrustedLiveLink. E7 applies merge ruling 4: unbound no-census routes use the legacy pass and restart; ordinary candidates make no binding store call. Fixtures: TestR2UnguardedERecoveryUpdate, TestR2UnguardedERecoveryIncidentRecipe, TestPlan14ERecoveryBindingRefusalKeepsPromotedFix. E19: both destructive readers use the root reservation snapshot under existing release exclusion. Exact artifact and containing-tree identities are retained; missing completeness refuses destruction. Production installation/launch/kernel completeness and verified retirement remain unfinished. Fixtures: TestPlan14GenerationDeletionCannotUnpin, TestPlan14GenerationSnapshotCompleteness, TestPlan14GenerationSnapshotPermitsUnreservedRestage, TestPlan14GenerationSnapshotPinsContainingTree, TestPlan14GenerationSnapshotEmptyIsUnknown, TestPlan14GenerationConsumerMode.;rev3=PROPOSED-p3;run=8;identity=carlos adopt uid 0; legacy agent pass uid carlos;basis=resolves protected route inputs before filters, recovery and dispatch on census boxes and bypasses service-owned failure opener only there;rev3=PROPOSED-s3-change-index;identity=carlos adopt uid 0; legacy agent pass uid carlos;basis=asks the optional pointer gate (gatePointers) once per channel group before selection and reports each group's pointer outcome to it; only the agent's fast sweep arms a gate (WithPointerGate), so under carlos adopt the gate is nil and the pass is unchanged; a gate can only leave a group out of the pass, never add one; one whole-Route site added registry:App@10095,registry:App@27134,registry:App@29591,registry:App@30083,registry:App@30320,registry:App@31727,registry:App@6740,registry:App@9954,registry:Hibernate@29966,registry:Host@1061,registry:Host@1426,registry:Host@30136,registry:Host@31052,registry:Host@31780,registry:Host@3413,registry:Host@3480,registry:Host@3576,registry:Host@3611,registry:UpdateSettings@9832,whole:Route@10090,whole:Route@1046,whole:Route@1164,whole:Route@1188,whole:Route@1461,whole:Route@1622,whole:Route@27129,whole:Route@2726,whole:Route@2768,whole:Route@2877,whole:Route@2901,whole:Route@2932,whole:Route@29586,whole:Route@29844,whole:Route@29866,whole:Route@29913,whole:Route@29931,whole:Route@29941,whole:Route@29984,whole:Route@30005,whole:Route@30018,whole:Route@30078,whole:Route@30104,whole:Route@30178,whole:Route@30217,whole:Route@30233,whole:Route@30261,whole:Route@30315,whole:Route@30341,whole:Route@3074,whole:Route@31094,whole:Route@31148,whole:Route@31164,whole:Route@3139,whole:Route@31671,whole:Route@31722,whole:Route@31748,whole:Route@31822,whole:Route@31857,whole:Route@31873,whole:Route@3225,whole:Route@3247,whole:Route@3347,whole:Route@4430,whole:Route@5077,whole:Route@6662,whole:Route@6684,whole:Route@6735,whole:Route@6761,whole:Route@761,whole:Route@803,whole:Route@950,whole:Route@9783,whole:Route@988,whole:Route@9897,whole:Route@9942 16886bf9c97cfa09c83696c8551dd8754d618deecc84089a216e1c4923b7ba11 |
| 32 | internal/release/adopt.go type passConfig authority E2,E3 E19: both destructive readers use the root reservation snapshot under existing release exclusion. Exact artifact and containing-tree identities are retained; missing completeness refuses destruction. Production installation/launch/kernel completeness and verified retirement remain unfinished. Fixtures: TestPlan14GenerationDeletionCannotUnpin, TestPlan14GenerationSnapshotCompleteness, TestPlan14GenerationSnapshotPermitsUnreservedRestage, TestPlan14GenerationSnapshotPinsContainingTree, TestPlan14GenerationSnapshotEmptyIsUnknown, TestPlan14GenerationConsumerMode, TestPlan14GenerationProductionModeGate, TestPlan14GenerationSnapshotPermitsFreshTree.;rev3=PROPOSED-p3;run=8;identity=carlos adopt uid 0; legacy agent pass uid carlos;basis=stores the typed census-only root update provider and per-pass resolved input authority;rev3=census-ruling-315;identity=legacy agent pass uid carlos (RootRestartsUnits; never set on carlos adopt);basis=adds the unitsToRoot bool set by RootRestartsUnits; reads nothing;rev3=PROPOSED-s3-change-index;identity=carlos adopt uid 0; legacy agent pass uid carlos;basis=adds the pointerGate field, set only by WithPointerGate (the agent's fast sweep); reads nothing e0d69f63e9eff24f36565acc22c979ba5e02f3a4834c6bdd22b9b877b35ec0e6 |
| 33 | internal/host/buildstate.go buildStates.refreshAll authority E3,J1,J4 root-route;rev3=PROPOSED-s3-change-index;identity=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos);basis=its body moved into refreshKept, which it calls with a nil filter; reads nothing itself now 4176187b6c2e8f04c5c0852d2f050805d5fffa90f00cb2239c5a56820b0f5716 |
| 34 | @legacy e3977adb7e4ca02f89764e24f57d69f14f5d7083ad7b7e113b62a7042759aba0 internal/appconfig/syncexec.go syncOptions.kept legacy accepted-legacy accepted-legacy;rev3=PROPOSED-s3-change-index;basis=root-route; J1, as SyncExecWithCallbacks; the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): the scoped pass's route filter; a nil filter keeps every route, so it only ever narrows a pass whole:Route@84 c1fdeba96e3f8de8dd74bd1082bc704908de0352b9974229c235f662e8112bca |
| 35 | internal/appconfig/syncexec.go syncOptions.kept legacy accepted-legacy accepted-legacy;rev3=PROPOSED-s3-change-index;basis=root-route; J1, as SyncExecWithCallbacks; the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): the scoped pass's route filter; a nil filter keeps every route, so it only ever narrows a pass whole:Route@84 c1fdeba96e3f8de8dd74bd1082bc704908de0352b9974229c235f662e8112bca |
| 36 | @legacy b55d739eb0dea7335f1ac74733f2e960f1b3d3bb210f318ed6cf9835e076a9bc internal/console/store.go Store.AppsWithActionSince legacy accepted-legacy accepted-legacy;rev3=PROPOSED-s3-change-index;basis=root-input; console SQL on its own audit table, a plain SELECT like Store.Events, as its store siblings (J4); the console (cmd/console serve under console.service, user carlos-console): the run sweep's orphan candidates file:Query@102 687ad5b1aa378b7bec6eae7eb6799dc02bd29431a3bb4dab00d5b8ee93a8382b |
| 37 | internal/console/store.go Store.AppsWithActionSince legacy accepted-legacy accepted-legacy;rev3=PROPOSED-s3-change-index;basis=root-input; console SQL on its own audit table, a plain SELECT like Store.Events, as its store siblings (J4); the console (cmd/console serve under console.service, user carlos-console): the run sweep's orphan candidates file:Query@102 687ad5b1aa378b7bec6eae7eb6799dc02bd29431a3bb4dab00d5b8ee93a8382b |
| 38 | @legacy 922094bdd23498a803000cd5f18ad4da362bf0b2b2db6e041a48f42c68780c02 internal/host/agent.go fastDeps.canaryPointerGate legacy accepted-legacy accepted-legacy;rev3=PROPOSED-s3-change-index;basis=root-route; J1, as fastTick; the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): the fast sweep's pointer gate skips a canary group's pointer read only while its app scope has not moved since the group's own last good read (its head, the generation captured before it and its time, kept per account, app and channel), that read is younger than the gate's maximum age, and every route of the group is live on that read's head (canarySettled); otherwise the pointer is read as before. Non-canary groups are never gated whole:Route@486 341b7dbfc3846fbc00b65a78a457ba08d29d27bd4da363d712c4f504a686bd08 |
| 39 | internal/host/agent.go fastDeps.canaryPointerGate legacy accepted-legacy accepted-legacy;rev3=PROPOSED-s3-change-index;basis=root-route; J1, as fastTick; the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): the fast sweep's pointer gate skips a canary group's pointer read only while its app scope has not moved since the group's own last good read (its head, the generation captured before it and its time, kept per account, app and channel), that read is younger than the gate's maximum age, and every route of the group is live on that read's head (canarySettled); otherwise the pointer is read as before. Non-canary groups are never gated whole:Route@486 341b7dbfc3846fbc00b65a78a457ba08d29d27bd4da363d712c4f504a686bd08 |
| 40 | @legacy be4f50bf8ed1f25ea01a813ad7fd229cc19e9d4528fd9e0d0ae3c86aa4db1112 internal/host/agent.go fastDeps.canarySettled legacy accepted-legacy accepted-legacy;rev3=PROPOSED-s3-change-index;basis=root-route; J1, as fastTick; the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): checks the group's own last good read against the generation the gate returned and the gate's maximum age (ReadGate.MaxAge), then compares each route's live version (release.LiveVersion under the agent's opt dir) with that read's head; any doubt answers false and the pointer is read registry:Host@328,whole:Route@163,whole:Route@274 feafad16a8ffce66c7d8db1014f7a60bf23a65c78d5f8786af6d878640c4d30c |
| 41 | internal/host/agent.go fastDeps.canarySettled legacy accepted-legacy accepted-legacy;rev3=PROPOSED-s3-change-index;basis=root-route; J1, as fastTick; the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): checks the group's own last good read against the generation the gate returned and the gate's maximum age (ReadGate.MaxAge), then compares each route's live version (release.LiveVersion under the agent's opt dir) with that read's head; any doubt answers false and the pointer is read registry:Host@328,whole:Route@163,whole:Route@274 feafad16a8ffce66c7d8db1014f7a60bf23a65c78d5f8786af6d878640c4d30c |
| 42 | internal/host/buildstate.go buildStates.refreshKept authority E3,J1,J4 root-route;rev3=PROPOSED-s3-change-index;identity=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos);basis=refreshAll's body, moved, with an optional route filter for the scoped pass; a filtered call reads only the hosts it keeps and never moves the rotation point; refreshAll's E3,J1,J4 authority carried over registry:Host@549,whole:Route@442,whole:Route@472,whole:Route@517 ae4f5c22ca45a5234ccf839949f57704a12e7998b40463a845c96b8ddc3e7665 |
| 43 | @legacy 2b132b661a502799e3d1cc6441f558042e84152cdde7a7b3f56985e550e7ff07 internal/host/changeindex.go movedRoutes legacy accepted-legacy accepted-legacy;rev3=PROPOSED-s3-change-index;basis=root-route; J1; the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): the scoped pass's route filter, keeping the routes whose app scope the change index says moved registry:App@297,whole:Route@292 3d4f7ef1ca7ebe9573f8f9b02d9bebcc4f8a8dac6762c4314e5f655575598624 |
| 44 | internal/host/changeindex.go movedRoutes legacy accepted-legacy accepted-legacy;rev3=PROPOSED-s3-change-index;basis=root-route; J1; the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): the scoped pass's route filter, keeping the routes whose app scope the change index says moved registry:App@297,whole:Route@292 3d4f7ef1ca7ebe9573f8f9b02d9bebcc4f8a8dac6762c4314e5f655575598624 |
| 45 | @legacy cbe3829c5481a82e62de8f1a6c02f1491428c194ba7474465818232caf23aa15 internal/host/telemetry_pass.go telemetryReads.read legacy accepted-legacy accepted-legacy;rev3=PROPOSED-s3-change-index;basis=root-input; J4, as telemetry.Resolve; the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): the switch pass's read of one telemetry settings object (telemetry.Read), skipped while its scope has not moved and a last good value is held; a failed read keeps the last good value and marks the scope for a re-read file:Read@396 3fe9990dab690ff466226f7f65939ab82ba09ef31ddd5ab60f6ad3d8b64354f0 |
| 46 | internal/host/telemetry_pass.go telemetryReads.read legacy accepted-legacy accepted-legacy;rev3=PROPOSED-s3-change-index;basis=root-input; J4, as telemetry.Resolve; the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): the switch pass's read of one telemetry settings object (telemetry.Read), skipped while its scope has not moved and a last good value is held; a failed read keeps the last good value and marks the scope for a re-read file:Read@396 3fe9990dab690ff466226f7f65939ab82ba09ef31ddd5ab60f6ad3d8b64354f0 |
| 47 | @legacy 99ce28f0e8f9754f4e33ed4b67c0edd4aaec3c7fe2c7be3cbf08f558c796da26 internal/host/telemetry_pass.go telemetrySwitchesWith legacy accepted-legacy accepted-legacy;rev3=PROPOSED-s3-change-index;basis=root-route; J1, as telemetrySwitches; the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): with a change index armed, telemetrySwitches' body, moved, reading through telemetryReads under its own mutex; a pair with no good value at either level is left off, the safe side of the switch. With none armed (a nil watch) it hands the pass to telemetrySwitchesResolve, main's body, before reading anything registry:App@538,registry:App@626,registry:App@921,registry:Kind@515,whole:Route@501,whole:Route@600 8976b8a38f4c02a002b22336543be59169ac99fc0bf941bae5202517c7bc621a |
| 48 | internal/host/telemetry_pass.go telemetrySwitchesWith legacy accepted-legacy accepted-legacy;rev3=PROPOSED-s3-change-index;basis=root-route; J1, as telemetrySwitches; the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): with a change index armed, telemetrySwitches' body, moved, reading through telemetryReads under its own mutex; a pair with no good value at either level is left off, the safe side of the switch. With none armed (a nil watch) it hands the pass to telemetrySwitchesResolve, main's body, before reading anything registry:App@538,registry:App@626,registry:App@921,registry:Kind@515,whole:Route@501,whole:Route@600 8976b8a38f4c02a002b22336543be59169ac99fc0bf941bae5202517c7bc621a |
| 49 | @legacy a5465363888fad7a0da13831699aad0c7ed0df31228b7afcf3da62a3f9086f93 internal/provision/recordview_store.go snapStore.Open legacy accepted-legacy accepted-legacy;rev3=PROPOSED-s3-change-index;basis=root-input; J4, as the other store wrappers' Open; the agent and the console through the record view: forwards to the live store (release.OpenObject); the snapshot caches no bodies for Open file:Open@20 41ea2555c81b1091989cf1acd25b6ccf8c7081a6135f0a86e128b3c9fd775e1c |
| 50 | internal/provision/recordview_store.go snapStore.Open legacy accepted-legacy accepted-legacy;rev3=PROPOSED-s3-change-index;basis=root-input; J4, as the other store wrappers' Open; the agent and the console through the record view: forwards to the live store (release.OpenObject); the snapshot caches no bodies for Open file:Open@20 41ea2555c81b1091989cf1acd25b6ccf8c7081a6135f0a86e128b3c9fd775e1c |
| 51 | internal/release/adopt.go passConfig.gatePointers authority B3,E3,J1 root-route;kept=B3,E3;scope=protected-decision-only;rev3=PROPOSED-s3-change-index;identity=carlos adopt uid 0 (gate nil: returns adopts unchanged, reads nothing); the agent's fast sweep uid carlos (gate armed);basis=groups the routes adopts admits by (account, app, channel) and asks the gate once per group; it can only narrow adopts, never widen it; PassFilter's B3,E3,J1 authority registry:App@305,whole:Route@300,whole:Route@326,whole:Route@420,whole:Route@442,whole:Route@479,whole:Route@497,whole:Route@548,whole:Route@567,whole:Route@578,whole:Route@750,whole:Route@955,whole:Route@979 e9f5ff820fdf8522b3613b9c102c32d474391cf83761c6f5795629fadea02c31 |
| 52 | @legacy 17e4b1fcf789646f705702fd2a975867a5f50aae1760453a9f944b9f2bf246f8 internal/release/conditional_delete.go DirStore.deleteIfMatchRaw legacy accepted-legacy accepted-legacy;rev3=PROPOSED-s3-change-index;basis=root-input; J4, as DirStore.DeleteIfMatch was; every process that opens a deployment store, as its siblings: DeleteIfMatch's body and its one site, moved unchanged; DeleteIfMatch calls it and bumps the change index after a successful delete file:ReadFile@244 987f7f91ca5755752e5cc672eb3ff1a83bbaa5848bc0e08bd7ea4d9965121fbb |
| 53 | internal/release/conditional_delete.go DirStore.deleteIfMatchRaw legacy accepted-legacy accepted-legacy;rev3=PROPOSED-s3-change-index;basis=root-input; J4, as DirStore.DeleteIfMatch was; every process that opens a deployment store, as its siblings: DeleteIfMatch's body and its one site, moved unchanged; DeleteIfMatch calls it and bumps the change index after a successful delete file:ReadFile@244 987f7f91ca5755752e5cc672eb3ff1a83bbaa5848bc0e08bd7ea4d9965121fbb |
| 54 | @legacy 9c4c1dc2689813405f2ec1d88145de6789af4d5e27598c9156b06b7332021360 internal/release/store.go DirStore.putRaw legacy accepted-legacy accepted-legacy;rev3=PROPOSED-s3-change-index;basis=root-input; J4, as DirStore.Put was; every process that opens a deployment store, as its siblings: Put's body and its one site, moved unchanged; Put calls it and bumps the change index after a successful write file:Stat@443 6fa73bb52e3eddf17d11f45f0e528041f8e0d9ad2f99a04b784b3c920bb16715 |
| 55 | internal/release/store.go DirStore.putRaw legacy accepted-legacy accepted-legacy;rev3=PROPOSED-s3-change-index;basis=root-input; J4, as DirStore.Put was; every process that opens a deployment store, as its siblings: Put's body and its one site, moved unchanged; Put calls it and bumps the change index after a successful write file:Stat@443 6fa73bb52e3eddf17d11f45f0e528041f8e0d9ad2f99a04b784b3c920bb16715 |
| 56 | @legacy 076c048c2d32b1f45a7da2f122482962173398a35efbb447f7613d54c7487635 internal/release/store.go DirStore.putFromRaw legacy accepted-legacy accepted-legacy;rev3=PROPOSED-s3-change-index;basis=root-input; J4, as DirStore.PutFrom was; every process that opens a deployment store, as its siblings: PutFrom's body and its one site, moved unchanged; PutFrom calls it and bumps the change index after a successful write file:Stat@462 036cd7896e1c78439bdd7cecc6764f98945047ad48412b37780d7ec846e25831 |
| 57 | internal/release/store.go DirStore.putFromRaw legacy accepted-legacy accepted-legacy;rev3=PROPOSED-s3-change-index;basis=root-input; J4, as DirStore.PutFrom was; every process that opens a deployment store, as its siblings: PutFrom's body and its one site, moved unchanged; PutFrom calls it and bumps the change index after a successful write file:Stat@462 036cd7896e1c78439bdd7cecc6764f98945047ad48412b37780d7ec846e25831 |
| 58 | @legacy 96662d9835256b9fb8a396eacf16fa81fc8d2b70ff06efa375cc13d3391100f3 internal/release/store.go DirStore.ListETags legacy accepted-legacy accepted-legacy;rev3=PROPOSED-s3-change-index;basis=root-input; J4, as DirStore.ListMod; every process that opens a deployment store, as its siblings: ListMod's walk with each file's content hash, the ETag listing the record view reads file:WalkDir@145 ac8b82bdec3524884d46fcc8d0c0daed2eae75e9d8438577567f4221cea1fe82 |
| 59 | internal/release/store.go DirStore.ListETags legacy accepted-legacy accepted-legacy;rev3=PROPOSED-s3-change-index;basis=root-input; J4, as DirStore.ListMod; every process that opens a deployment store, as its siblings: ListMod's walk with each file's content hash, the ETag listing the record view reads file:WalkDir@145 ac8b82bdec3524884d46fcc8d0c0daed2eae75e9d8438577567f4221cea1fe82 |
| 60 | @legacy c93045dc7bc00cc27518f23dba471a499989b910d0197bf2b3d99d94d12f916c internal/release/store.go S3Store.GetIfChanged legacy accepted-legacy accepted-legacy;rev3=PROPOSED-s3-change-index;basis=root-input; J4, as S3Store.Get; every process that opens a deployment store, as its siblings: S3Store.Get's read sent with If-None-Match, a 304 answering unchanged without the body file:ReadAll@511 959fea16d1332f47c2444ced07034544d733b4d831b7b0382517e100aa431dcc |
| 61 | internal/release/store.go S3Store.GetIfChanged legacy accepted-legacy accepted-legacy;rev3=PROPOSED-s3-change-index;basis=root-input; J4, as S3Store.Get; every process that opens a deployment store, as its siblings: S3Store.Get's read sent with If-None-Match, a 304 answering unchanged without the body file:ReadAll@511 959fea16d1332f47c2444ced07034544d733b4d831b7b0382517e100aa431dcc |
| 62 | # Four frozen units still declared now read nothing; each is retired by an H3 census-ruling removal, in the form email-signin used. A removal is not in the seal. |
| 63 | @legacy 42299887c5c59955ac44f8d7af640818cc8e07963f084da46c734ff77b1ced66 internal/host/movespass.go movesDirHolds legacy accepted-legacy accepted-legacy;rev3=PROPOSED-s3-change-index;basis=root-input; J4, as movesWorker.sweepFinalJournals; the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): lists <DataDir>/.moves and each directory directly beneath it, only to learn whether an op journal or a page outbox entry exists, in which case the moves pass walks the bucket as before the index; it opens, reads and changes nothing inside them, and an unreadable directory counts as holding something (the walk runs) file:ReadDir@136,file:ReadDir@322 31c55e433debcbc511f97b0eb723a87304f5839ffd9c73f68bcd6d58855bc817 |
| 64 | internal/host/movespass.go movesDirHolds legacy accepted-legacy accepted-legacy;rev3=PROPOSED-s3-change-index;basis=root-input; J4, as movesWorker.sweepFinalJournals; the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): lists <DataDir>/.moves and each directory directly beneath it, only to learn whether an op journal or a page outbox entry exists, in which case the moves pass walks the bucket as before the index; it opens, reads and changes nothing inside them, and an unreadable directory counts as holding something (the walk runs) file:ReadDir@136,file:ReadDir@322 31c55e433debcbc511f97b0eb723a87304f5839ffd9c73f68bcd6d58855bc817 |
| 65 | @legacy 5516c964c4348ca37231ab08f3a87f36ef8e35d6bab6d9bf21f00d46bbe13949 internal/host/telemetry_pass.go telemetrySwitchesResolve legacy accepted-legacy accepted-legacy;rev3=J1;basis=root-route;rev3=PROPOSED-s3-change-index;identity=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos);basis=main's telemetrySwitches body, unchanged but for its name, with the same six sites at the same relative offsets (shifted by the longer name); runs only when no change index is armed, through telemetrySwitchesWith over a nil watch, so a disarmed box resolves each app on its own exactly as main registry:App@293,registry:App@381,registry:App@486,registry:Kind@270,whole:Route@256,whole:Route@355 cb6e294852b19939d12818472f125f639e6c7dab77a0aaac271735de6259476e |
| 66 | internal/host/telemetry_pass.go telemetrySwitchesResolve legacy accepted-legacy accepted-legacy;rev3=J1;basis=root-route;rev3=PROPOSED-s3-change-index;identity=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos);basis=main's telemetrySwitches body, unchanged but for its name, with the same six sites at the same relative offsets (shifted by the longer name); runs only when no change index is armed, through telemetrySwitchesWith over a nil watch, so a disarmed box resolves each app on its own exactly as main registry:App@293,registry:App@381,registry:App@486,registry:Kind@270,whole:Route@256,whole:Route@355 cb6e294852b19939d12818472f125f639e6c7dab77a0aaac271735de6259476e |
| 67 | @remove internal/release/store.go DirStore.Put |
| 68 | @removed internal/release/store.go DirStore.Put H3 census-ruling-s3-change-index (PROPOSED, awaiting the census owner on #280): still declared, and reads nothing now: its body and its one site (file:Stat) moved unchanged into DirStore.putRaw, an accepted-legacy row in this overlay; Put calls it and, after a successful write, bumps the change index. |
| 69 | @remove internal/release/store.go DirStore.PutFrom |
| 70 | @removed internal/release/store.go DirStore.PutFrom H3 census-ruling-s3-change-index (PROPOSED, awaiting the census owner on #280): still declared, and reads nothing now: its body and its one site (file:Stat) moved unchanged into DirStore.putFromRaw, an accepted-legacy row in this overlay; PutFrom calls it and, after a successful write, bumps the change index. |
| 71 | @remove internal/release/conditional_delete.go DirStore.DeleteIfMatch |
| 72 | @removed internal/release/conditional_delete.go DirStore.DeleteIfMatch H3 census-ruling-s3-change-index (PROPOSED, awaiting the census owner on #280): still declared, and reads nothing now: its body and its one site (file:ReadFile) moved unchanged into DirStore.deleteIfMatchRaw, an accepted-legacy row in this overlay; DeleteIfMatch calls it and, after a successful delete, bumps the change index. |
| 73 | @remove internal/host/telemetry_pass.go telemetrySwitches |
| 74 | @removed internal/host/telemetry_pass.go telemetrySwitches H3 census-ruling-s3-change-index (PROPOSED, awaiting the census owner on #280): still declared, and reads nothing: it calls telemetrySwitchesWith with the process's telemetryReads and the time, which runs main's body (telemetrySwitchesResolve, an accepted-legacy row in this overlay) when no change index is armed and the gated pass otherwise, both accepted-legacy rows in this overlay. It runs in the agent as carlos. |
| 75 | # Envelopes re-pinned: ., cmd/console, internal/appconfig, internal/console, internal/edge, internal/host, internal/hostops, internal/ops, internal/provision, internal/release, internal/telemetry, internal/vet. The scan's only read-site changes are the rows above. |
| 76 | @coverage . e1793be49471389de1c3d5e150d404f511399e6f468a5733be5f7d8760a5f38d |
| 77 | @coverage cmd/console 3f8cf7ac42db92a130af5bba06bdd34f5f53bd8728ee7ff7bf0a51d20a11a6ee |
| 78 | @coverage internal/appconfig ec91c8e0e6bc3599f021ff360e1549559bf61d80d60d8dd9ae9ef0c38bd5503c |
| 79 | @coverage internal/console c2d13e26cde58d661227db42f0be8bcc254dcde4a604cec8da93861c5b92df0f |
| 80 | @coverage internal/edge 1cc0801c03b5f087cdbcbab3c816afc95ec656846be58563294f8164b2e269d1 |
| 81 | @coverage internal/host 12d474698a62bec2fa05921a13f14f9f541f5f7643918b5e3ab82cc4c24909d4 |
| 82 | @coverage internal/hostops fe58f0e6036bfccdf39ab6d9575addf11f94f87b17fd139964b4f5f22cb93be4 |
| 83 | @coverage internal/ops afe4c144d6cd68e3fc46b2967767b605747300dead1259e81a484276b1b1088b |
| 84 | @coverage internal/provision 8d82529f3fb0628598e600c05581a90efef570924bf87044e988e60370dd49fa |
| 85 | @coverage internal/release 17d277cdc333b1c67a2b6c5953f613001346505543f962069433e056b71e7800 |
| 86 | @coverage internal/telemetry 4f3f802bac2db2136eeaaee607678f34a629e19d305f327f42f34594a6ff65f8 |
| 87 | @coverage internal/vet 933738430ab95c59f0570e0d892f91c99c3de8cfcc6b2f7d8b1caaad21c1847d |
| 88 | |
amadan