# Recovery of an interrupted platform self-update (spec §6, "every run
# begins with recovery"). Runs once per boot, BEFORE the edge, and on the
# update oneshot's failure. It restores files only — carlos.prev over
# carlos, the previous unit set — and never restarts or gates the edge
# from inside a unit the edge is ordered after: at boot the edge's own
# start IS the restart. At runtime (edge already started this boot) it
# issues a non-blocking restart and exits.
#
# When a journal is open and carlos.prev exists, the recovery runs from
# carlos.prev.
# The moves protocol floor (moves spec §11) narrows that choice: once a
# floor is armed (/data/.moves/floor.min-release is there and not empty),
# carlos.prev runs only when its verdict file (/opt/carlos/carlos.prev.allowed,
# written by root after comparing versions in Go) names that same floor,
# byte for byte. A floor path that is a symlink or anything but a regular
# file (a dangling link, a FIFO, a directory) never reads as "no floor":
# the current binary runs (#267). carlos.prev's own floor gate (carlos
# system floor-allows-prev) makes the comparison: it opens each file once,
# without following a symlink or waiting on a FIFO, refuses anything but a
# small single-link regular file with the expected owner, and exits 0 only
# for a match. Not cmp: the agent owns /data and could swap the floor file
# between the shell's tests and cmp's open.
# Otherwise the current binary runs, and its own check refuses to restore a
# carlos.prev below the floor. No floor file: the choice is exactly as
# before. The line carries no percent sign and no dollar sign, both of which
# systemd expands before the shell sees them.
#
# The seeds floor (seeded-instances spec §3.3) adds the same test for its
# own files: once /data/.moves/seeds-floor.min-release is there and not
# empty, carlos.prev runs only when /opt/carlos/carlos.prev.seeds-allowed
# names that same floor, byte for byte.
[Unit]
Description=carlos platform self-update recovery
Before=carlos-edge.service
DefaultDependencies=yes

[Service]
Type=oneshot
TimeoutStartSec=10min
EnvironmentFile=-/etc/carlos/host.env
ExecStart=/bin/sh -c 'if [ -x /opt/carlos/system/guard/carlos ] && { [ -e /var/lib/carlos-claims/authority/exec/census.json ] || [ -L /var/lib/carlos-claims/authority/exec/census.json ] || [ -e /opt/carlos/system/guard/moves ] || [ -L /opt/carlos/system/guard/moves ]; }; then exec /opt/carlos/system/guard/carlos system guard-exec recover; fi; if [ -f /opt/carlos/system/router/journal.json ] && [ -x /opt/carlos/carlos.prev ] && [ ! -L /data/.moves/floor.min-release ] && { [ ! -e /data/.moves/floor.min-release ] || [ -f /data/.moves/floor.min-release ]; } && { ! [ -s /data/.moves/floor.min-release ] || /opt/carlos/carlos.prev system floor-allows-prev /data/.moves/floor.min-release /opt/carlos/carlos.prev.allowed; } && [ ! -L /data/.moves/seeds-floor.min-release ] && { [ ! -e /data/.moves/seeds-floor.min-release ] || [ -f /data/.moves/seeds-floor.min-release ]; } && { ! [ -s /data/.moves/seeds-floor.min-release ] || /opt/carlos/carlos.prev system floor-allows-prev /data/.moves/seeds-floor.min-release /opt/carlos/carlos.prev.seeds-allowed; }; then exec /opt/carlos/carlos.prev system apply --recover; fi; exec /opt/carlos/carlos system apply --recover'

ProtectHome=yes
PrivateTmp=yes
PrivateDevices=yes
ProtectClock=yes
ProtectHostname=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
RestrictNamespaces=yes
RestrictRealtime=yes
LockPersonality=yes
MemoryDenyWriteExecute=yes
MemoryMax=256M
TasksMax=64

[Install]
WantedBy=multi-user.target