# Root apply of a platform self-update (spec §6): re-verify the pointer,
# copy the candidate into a root-owned dir, journal, swap the binary and
# units, restart the edge, gate it, roll back to carlos.prev on failure.
#
# ExecStart goes through one line of shell so that when a journal is open
# (a previous apply was cut off) and carlos.prev exists, the RECOVERY runs
# from carlos.prev rather than from the candidate that did not work.
#
# The moves protocol floor (moves spec §11) narrows that choice: once a
# floor is armed (/data/.moves/floor.min-release is there and not empty),
# carlos.prev runs only when its verdict file (/opt/carlos/carlos.prev.allowed,
# written by root after comparing versions in Go) names that same floor,
# byte for byte. A floor path that is a symlink or anything but a regular
# file (a dangling link, a FIFO, a directory) never reads as "no floor":
# the current binary runs (#267). carlos.prev's own floor gate (carlos
# system floor-allows-prev) makes the comparison: it opens each file once,
# without following a symlink or waiting on a FIFO, refuses anything but a
# small single-link regular file with the expected owner, and exits 0 only
# for a match. Not cmp: the agent owns /data and could swap the floor file
# between the shell's tests and cmp's open.
# Otherwise the current binary runs, and its own check refuses to restore a
# carlos.prev below the floor. No floor file: the choice is exactly as
# before. The line carries no percent sign and no dollar sign, both of which
# systemd expands before the shell sees them.
#
# The seeds floor (seeded-instances spec §3.3) adds the same test for its
# own files: once /data/.moves/seeds-floor.min-release is there and not
# empty, carlos.prev runs only when /opt/carlos/carlos.prev.seeds-allowed
# names that same floor, byte for byte.
#
# Deliberately no filesystem-sandboxing directive and no dedicated run
# account: it must write /opt/carlos and /etc/systemd/system, which only
# root can do. StartLimitIntervalSec=0 because the path unit can fire in
# bursts. TimeoutStartSec bounds a hung apply; OnFailure= makes a killed or
# timed-out apply recover without waiting for a touch.
[Unit]
Description=carlos platform self-update (root apply)
After=network-online.target
Wants=network-online.target
StartLimitIntervalSec=0
OnFailure=carlos-system-recover.service

[Service]
Type=oneshot
TimeoutStartSec=15min
EnvironmentFile=-/etc/carlos/host.env
ExecStart=/bin/sh -c 'if [ -x /opt/carlos/system/guard/carlos ] && { [ -e /var/lib/carlos-claims/authority/exec/census.json ] || [ -L /var/lib/carlos-claims/authority/exec/census.json ] || [ -e /opt/carlos/system/guard/moves ] || [ -L /opt/carlos/system/guard/moves ]; }; then exec /opt/carlos/system/guard/carlos system guard-exec apply; fi; if [ -f /opt/carlos/system/router/journal.json ] && [ -x /opt/carlos/carlos.prev ] && [ ! -L /data/.moves/floor.min-release ] && { [ ! -e /data/.moves/floor.min-release ] || [ -f /data/.moves/floor.min-release ]; } && { ! [ -s /data/.moves/floor.min-release ] || /opt/carlos/carlos.prev system floor-allows-prev /data/.moves/floor.min-release /opt/carlos/carlos.prev.allowed; } && [ ! -L /data/.moves/seeds-floor.min-release ] && { [ ! -e /data/.moves/seeds-floor.min-release ] || [ -f /data/.moves/seeds-floor.min-release ]; } && { ! [ -s /data/.moves/seeds-floor.min-release ] || /opt/carlos/carlos.prev system floor-allows-prev /data/.moves/seeds-floor.min-release /opt/carlos/carlos.prev.seeds-allowed; }; then exec /opt/carlos/carlos.prev system apply; fi; exec /opt/carlos/carlos system apply'

# --- hardening (the carlos-stage.service set) ---
ProtectHome=yes
PrivateTmp=yes
PrivateDevices=yes
ProtectClock=yes
ProtectHostname=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
RestrictNamespaces=yes
RestrictRealtime=yes
LockPersonality=yes
MemoryDenyWriteExecute=yes
MemoryMax=256M
TasksMax=64