# Census: the offline move's harness fixes (Run 9, defects 6 to 8)

Status: RULED. Every row carries `rev3=PROPOSED-moves-offline-fixes`. The
ruling is asked of the census owner, platform-1c.

The branch is `moves-offline-fixes`, from main after 54ae7fb9 (v0.28.5). It
fixes three defects the deployment harness found in the offline operator move
(harness RUNLOG, Run 9). It adds one census overlay,
`internal/provision/testdata/plan14-root-reads-moves-offline-fixes.tsv`,
loaded last in `TestPlan14RootReadCensus`, after armed-box-updates. The
record-write census (`TestPlan9B8RecordWriteCensus`) does not change: no
record write is added or moved.

## The footing

Every unit in the overlay runs in the box agent (`/opt/carlos/carlos agent`,
carlos-edge.service, `User=carlos`). None is reached from a root process, and
none makes a root decision. So each is proposed accepted legacy at the
disposition main gives it or its siblings: J1 (root-route) for registry and
route reads, J4 (root-input) for file reads, J1,J4 where a unit does both.
That is the footing census-ruling-moves-offline accepted for the offline
move's own units.

## The units, by defect

### Defect 6: config.env for a nested row whose instance directory is not made yet

| unit | change | executing identity | disposition |
|---|---|---|---|
| `internal/appconfig/syncexec.go` `SyncExecWithCallbacks` | changed legacy: a write that found no instance directory is named and skipped (`errInstanceDirAbsent`, `WhenInstanceDirAbsent`), and the pass goes on; no new read site | the agent, through `syncExecSerialized` (config loops) | re-frozen, J1,J4 |
| `internal/appconfig/syncexec.go` `renderExecConfigBefore` | changed legacy: one `Lstat` of the nested row's instance directory after its write failed, to tell "not made yet" from any other failure; follows no link | the agent: config sync and the moves worker's held render | re-frozen, J1,J4 |
| `internal/host/agent.go` `configGenLoop` | changed legacy: the tick's body moved into `configGenTick`; the registry listing stays | the agent | re-frozen, J1 |
| `internal/host/agent.go` `configGenTick` | new: `configGenLoop`'s tick over the routes it listed; also runs the agent's own config pass once a directory the last pass waited for exists | the agent | accepted legacy, J1 (as `configGenLoop`) |
| `internal/host/agent.go` `pendingDirs.appeared` | new: an `Lstat` (never follows a link) of the instance directories the last config pass could not write into | the agent | accepted legacy, J4 (as the moves units' `isDir`, `lexists`) |

Envelopes re-pinned: `internal/appconfig`, `internal/host`.

### Defect 7: fresh reports at every door step

No unit row. The re-assert (`movesWorker.offlineReassert`, run by
`offlineReassertLoop` in the agent every 15 s or so) reads the record from the
deployment store and calls the source and sealer steps
census-ruling-moves-offline already classified (`offlineSourceStop`,
`offlineKeepStop`); it has no root read of its own. The console's stale-report
refusal (MV-O178) reads nothing new. Envelopes re-pinned: `internal/console`,
`internal/host`.

### Defect 8: the source's scheduler wrote the moved host's env file after open

The schedule runner is built only by the agent (`armSchedule`, from
`runAgent`); no root process makes one.

| unit | change | executing identity | disposition |
|---|---|---|---|
| `internal/host/schedule_wiring.go` `newScheduleDeps` | changed legacy: the runner's `Skip` is set to `scheduleSkip`; no new read site | the agent | re-frozen, J1 |
| `internal/host/schedule_wiring.go` `scheduleSkip` | new: reads a row's status (any hold) and host (the armed offline view says the record names another region) to tell the runner to leave the host alone; it only withholds a tick | the agent's schedule runner | accepted legacy, J1 (as the runner's own hold checks) |
| `internal/schedule/runner.go` `Runner.Tick` | changed legacy: a host `Skip` names gets no tick and no bookkeeping at the pre-filter | the agent's schedule runner | re-frozen at census-ruling-seeded-instances' disposition |
| `internal/schedule/runner.go` `Runner.fire` | re-pinned: with `Skip` set, the row is read again before the token, and a skipped host gets no token and no record | the agent's schedule runner (overlay e names the service controller and root callbacks for the claim design; neither sets `Skip`) | hint, E2, unchanged |

Envelopes re-pinned: `internal/host`, `internal/schedule`.

### Fix round 1 (Astra's review)

| finding | unit | change | executing identity | disposition |
|---|---|---|---|---|
| 1 | `internal/schedule/runner.go` `Runner.Tick` | re-pinned: its due query moved into `Runner.dueRows` | the agent's schedule runner | re-frozen, as above |
| 1 | `internal/schedule/runner.go` `Runner.dueRows` | new: held hosts left out by the query when `Skip` is set, and hosts `Skip` names paged past before the limit (one row read per host in the batch) | the agent's schedule runner | accepted legacy, J1 (as `Runner.Tick`) |
| 2 | none | the refresh calls `offlineSealerRefresh` (seal, lease and source reports read, only the report written, the lease never), no root read of its own | the agent | envelope `internal/host` only |
| 3 | `internal/appconfig/syncexec.go` `SyncExecWithCallbacks` | re-pinned: names each in-scope host done or not once the pass has gone through every route (`WithHostOutcome`); no new read site | the agent | re-frozen, J1,J4 |
| 3 | `internal/host/agent.go` `pendingDirs.appeared` | re-pinned: the same `Lstat`, with a retry backoff for a host a pass left undone | the agent | re-frozen, J4 |


## The seal

The accepted-legacy rows add frozen declarations, so the legacy seal moves,
from `393e7f45…bec29` (main, after moves-offline and armed-box-updates) to
`edc04f7349acf2b9ea98ffc8a1d3b71516a6ddb95505abfc2e38e49fd802ccc2` (after fix round 1). The test
checks main's seal before it loads this overlay, so a change on main's side
still shows on its own.

## What the ruling is asked to decide

1. That every unit above runs only in the agent and makes no root decision,
   so accepted legacy at main's disposition is the right footing.
2. That `Runner.fire` keeps its class and task (hint, E2): the change only
   withholds a token and a record for a host `Skip` names.
3. That the re-assert of defect 7 needs no row: it calls only steps already
   classified under census-ruling-moves-offline.

## Ruling (platform-1c, 2026-10-20): census-ruling-moves-offline-fixes, ACCEPTED as proposed

Accepted at d75b7e0b (F1 to F4) and re-ruled for fix round 1 at 7cd5db4d (F5 to F7). After Astra's scoped re-review, the backoff counter saturates (agent.go `pendingDirs.record`): an internal/host envelope re-pin only. The rev3 tag was rewritten to the ruling's name, so the seal moves to 826c54be…a62f.
- After merging main 21850356 (install-console-upgrade, loaded before this overlay): internal/host envelope re-pinned to the combined tree; seal unchanged.