# Census: db region forward, plan 3 (`carlos db pull` and `pull --at` for an instance in another region)

Status: ACCEPTED in full by the census owner on #280, 2026-10-23, as
`census-ruling-db-region-forward-3`, for every row below and the round 1 fix
rows. Every row now carries `rev3=census-ruling-db-region-forward-3`; the
`@legacy` fingerprints were recomputed and the seal moved to
`79cb56b4c7d3a8e155d1eff1902715d818fcf4c09b1d8a82921c413b116938a9`.

The census owner's rationale: the box-side reads stay the agent's or the
sandboxed worker's; the CLI reads only its own spool; the `admitDBRead`
re-pin is the same write class; Astra matched every digest.

The branch is `db-region-forward-3`, cut from amadan `main` at 0d9e81dc. It
builds plan 3 of `docs/superpowers/specs/2026-10-22-db-region-forward-design.md`
(rev 7): the box's worker holds a pull's planned LTX files, verifies their
checksums and sends them back after the agent's check B; the agent seals them
as the `ltx` stream in 1 MiB chunks, with the plan in the summary; the console
forwards and audits the new op; the CLI spools the sealed chunks to a private
directory, checks the file list, the count and the SHA-256, restores locally
with `dbdoor.RestoreLocal` and saves the copy with today's `copyOut`. The
box never restores for a pull.

It adds one root-read overlay,
`internal/provision/testdata/plan14-root-reads-db-region-forward-3.tsv`,
loaded last in `TestPlan14RootReadCensus`, after `static-redirects` (the
overlay main loads last at 0d9e81dc). Its record-write entry is layered on
`plans3aWriteCensusInventory` in
`internal/provision/db_region_forward_3_census_test.go`.

## Root reads

Executing identities, named once:

- **the worker**: `carlos system db-worker` under `carlos-dbread@.service`, a
  DynamicUser with no network, its own PrivateTmp, `/data` and `/etc/carlos`
  hidden.
- **the CLI**: `carlos db pull` on a person's machine, as the person.

The scanner names no agent, console or host unit: the agent's pull branch in
`attempt`, `NewAgent`'s `MaxPull`, the console's op check and audit detail,
and `CARLOS_DB_PULL_MAX_BYTES` in `dbReadsSettings` make no read it counts
(plan 1's R8 again).

| unit | change | executing identity | proposed disposition |
|---|---|---|---|
| `internal/dbreads/worker.go` `holdAndSend` | new: opens each planned LTX file it received and verified, in its own private `/var/tmp`, after check B, and copies it back over its socket | the worker | legacy, accepted-legacy, J4 (`root-input`, as `receiveFile`) |
| `internal/dbreads/worker.go` `verifyLTX` | new: opens one received LTX file and decodes it whole to check its checksums, before ready | the worker | legacy, accepted-legacy, J4 |
| `internal/dbreads/worker.go` `ServeWorker` | changed: accepts a pull header and hands it to `holdAndSend` after the same bounded receive; the `Stat` is unchanged | the worker | re-frozen at `census-ruling-db-region-forward-1` with this change appended |
| `dbforward.go` `dbPullForward` | new: the same bounded 64 KiB read of a refused reads-route answer as `dbQueryForward` (`io.ReadAll` over the response body, not a file); creates and removes the pull's private 0700 directory | the CLI | legacy, accepted-legacy, J4 (main's footing for `db.go`'s units) |
| `dbforward.go` `fileSink.chunk` | new: reads back one sealed chunk it spooled itself, 0600 in that directory, admitted by the chunk bound before it was written | the CLI | legacy, accepted-legacy, J4 |
| `dbforward.go` `openDBPull` | new: creates each planned LTX file exclusively (`O_EXCL`, 0600) in that directory, only after the whole file list is checked; then restores, checks and removes them | the CLI | legacy, accepted-legacy, J4 |
| `internal/dbdoor/plan_from.go` `ctxReadCloser.Read` | new (Astra round 1, finding 2): `RestoreLocal` wraps its local replica's reads so each checks the restore's context first; litestream's compaction checks none of its own | the CLI and the worker | legacy, accepted-legacy, J4 (as main's `downloaded.Read`) |
| `dbforward.go` `dbQueryForward` | changed: keeps its chunks in a `memSink` and opens them after `readDBForward` returns the result; the same bounded refusal read | the CLI | re-frozen at `census-ruling-db-region-forward-2` with this change appended |

Round 1 (Astra on cc77ca95): `ServeWorker` now checks every received file's
LTX header against its plan entry through `verifyLTX`, for a query as well as a
pull, and the plan's end against its target; `holdAndSend` only sends the checked
files back; `openDBPull` compares each rebuilt file's header with its manifest
entry and checks its context per chunk. Their rows carry a round 1 clause; no
read is added to them.

Envelopes re-pinned: `.`, `internal/console`, `internal/dbdoor`,
`internal/dbreads`, `internal/host`. Frozen declarations are added, so the seal moves:
static-redirects' `65857c29…` is checked first, the proposed seal was
`36ecd2eca043f1d0056f086be47ba1fb887dcdc2eda67427e698c2b6d1b9031b` (79cb56b4… once the markers flipped).

## Record writes (9B8)

`internal/console/apidbforward.go` `Server.admitDBRead` is re-digested and
stays `nonrecord`: it admits a pull beside a query and audits it with its own
detail; its writes are the same conditional creates under `db-reads/` in the
deployment bucket. No write site is added.

## Unchanged

Claim routes (no new route: a pull uses plan 2's reads route), `go.mod`.