# Census overlay db-region-forward-1 (db region forward plan 1: the box side and the wire, dark; spec docs/superpowers/specs/2026-10-22-db-region-forward-design.md rev 6, §13), loaded LAST in TestPlan14RootReadCensus, after console-brand-name, the overlay main loads last at 5f341f33. Every row carries rev3=census-ruling-db-region-forward-1; the ruling is asked of the census owner on #280 (docs/superpowers/notes/census-proposal-db-region-forward-1.md).
# db.go runQueryContext is retired by an H3 removal: it reads nothing now, and its body is internal/dbquery RunContext, accepted legacy at the same J4 footing with both callers named (the CLI as the person, the db-read worker as a DynamicUser). New agent units are accepted legacy at J1/J4 (route-and-input) or J4, worker units at J4, the two carlos-dbread unit files join as external units, and the readiness probe is one diagnostic declaration row. Changed units are re-pinned at main's class, task and basis with this branch's change appended. Frozen declarations are added, so the seal moves; console-brand-name's seal is checked first.
@remove	db.go	runQueryContext
@removed	db.go	runQueryContext	H3	census-ruling-db-region-forward-1 (accepted by the census owner on #280, 2026-10-22): still declared, and reads nothing now: it calls dbquery.RunContext, which holds its former open and query unchanged but for the immutable=1 option, an accepted-legacy row in this overlay. It runs in the carlos CLI as the person.
@legacy	b7b1b54802e10fda1411f6f94aceb50e712524d5e5715b676cb1e0bc0ba2f331	internal/dbquery/dbquery.go	RunContext	legacy	accepted-legacy	accepted-legacy;rev3=census-ruling-db-region-forward-1;basis=root-input (J4, the footing main gave db.go runQueryContext); the carlos CLI on a person's machine, as the person, and the db-read worker (carlos system db-worker, carlos-dbread@.service, a DynamicUser with no network): db.go's runQueryContext body moved unchanged but for the immutable=1 open option the worker passes; opens one restored copy read-only (mode=ro, query_only, temp_store(2), no attached databases) and runs one guarded statement; neither caller is root and neither decides anything for root	file:Open@164,file:QueryContext@826	4b2af103a84564dd3642552fcc818dcd592ce47cea2e7521a1bded2f9b8901da
internal/dbquery/dbquery.go	RunContext	legacy	accepted-legacy	accepted-legacy;rev3=census-ruling-db-region-forward-1;basis=root-input (J4, the footing main gave db.go runQueryContext); the carlos CLI on a person's machine, as the person, and the db-read worker (carlos system db-worker, carlos-dbread@.service, a DynamicUser with no network): db.go's runQueryContext body moved unchanged but for the immutable=1 open option the worker passes; opens one restored copy read-only (mode=ro, query_only, temp_store(2), no attached databases) and runs one guarded statement; neither caller is root and neither decides anything for root	file:Open@164,file:QueryContext@826	4b2af103a84564dd3642552fcc818dcd592ce47cea2e7521a1bded2f9b8901da
@legacy	387dc6cc8dd4c5b75e7eb02ee5e9ab66dccd4aaf0c88fc139533e36435a3e26f	internal/dbreads/agent.go	nonce	legacy	accepted-legacy	accepted-legacy;rev3=census-ruling-db-region-forward-1;basis=route-and-input (J1,J4, as the offline move's agent units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, reads 16 random bytes from crypto/rand for the picked marker's attempt nonce (rand.Read, not a file); makes no root decision	file:Read@39	eaeef494190dfb8f52b0182a438d61702afd66eedca77382218fa45038de7e03
internal/dbreads/agent.go	nonce	legacy	accepted-legacy	accepted-legacy;rev3=census-ruling-db-region-forward-1;basis=route-and-input (J1,J4, as the offline move's agent units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, reads 16 random bytes from crypto/rand for the picked marker's attempt nonce (rand.Read, not a file); makes no root decision	file:Read@39	eaeef494190dfb8f52b0182a438d61702afd66eedca77382218fa45038de7e03
@legacy	8339337a77458a9a30264d710c57cef0a3814c107986e08795da18b9ec756d02	internal/dbreads/read.go	sendFile	legacy	accepted-legacy	accepted-legacy;rev3=census-ruling-db-region-forward-1;basis=route-and-input (J1,J4, as the offline move's agent units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, reads one planned LTX file whole from this box's own region replica through the read-only replica reader, between identity checks A and B, and frames it to the worker without decoding it; makes no root decision	file:Read@386	e14405e19aeb8806ea1c4798bf5cf1460152dca1c27728b4687c2282ec103fc9
internal/dbreads/read.go	sendFile	legacy	accepted-legacy	accepted-legacy;rev3=census-ruling-db-region-forward-1;basis=route-and-input (J1,J4, as the offline move's agent units); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, reads one planned LTX file whole from this box's own region replica through the read-only replica reader, between identity checks A and B, and frames it to the worker without decoding it; makes no root decision	file:Read@386	e14405e19aeb8806ea1c4798bf5cf1460152dca1c27728b4687c2282ec103fc9
@legacy	ed2f4d592997fb9547f644d4cd61587e16a530fbbe2c5ed3d77450be611d58d1	internal/dbreads/seal.go	open	legacy	accepted-legacy	accepted-legacy;rev3=census-ruling-db-region-forward-1;basis=root-input (J4); the carlos CLI on a person's machine, as the person (plan 2's forwarded query; plan 1 has no production caller): new, AES-GCM open of one sealed chunk or summary with the CLI's own ephemeral key (cipher.AEAD.Open, not a file); decides nothing for root	file:Open@476	5c1f46770835c16c08b320bd1b2d297c05c05f4e0ff8d8ae93f6473c19745403
internal/dbreads/seal.go	open	legacy	accepted-legacy	accepted-legacy;rev3=census-ruling-db-region-forward-1;basis=root-input (J4); the carlos CLI on a person's machine, as the person (plan 2's forwarded query; plan 1 has no production caller): new, AES-GCM open of one sealed chunk or summary with the CLI's own ephemeral key (cipher.AEAD.Open, not a file); decides nothing for root	file:Open@476	5c1f46770835c16c08b320bd1b2d297c05c05f4e0ff8d8ae93f6473c19745403
@legacy	c07416a480d0a742176cdd15c22ad0f8bb3ce4bf2062ea9730dd8da50b8596ef	internal/dbreads/worker.go	SelfView	legacy	accepted-legacy	accepted-legacy;rev3=census-ruling-db-region-forward-1;basis=root-input (J4); the db-read worker (carlos system db-worker, carlos-dbread@.service, a DynamicUser with no network, PrivateTmp, /data and /etc/carlos hidden): new, reads /proc/self/net/dev, lists /data and opens /etc/carlos/host.env only to report what its sandbox hides, for the agent's readiness probe; reads only the files the agent sent and its own scratch	data-literal@275,data-literal@402,file:Open@442,file:ReadDir@264,file:ReadFile@82	2003801d3ece96004be7f62d9d2827f52758ec74aa5a7d978d9e170ea168e92c
internal/dbreads/worker.go	SelfView	legacy	accepted-legacy	accepted-legacy;rev3=census-ruling-db-region-forward-1;basis=root-input (J4); the db-read worker (carlos system db-worker, carlos-dbread@.service, a DynamicUser with no network, PrivateTmp, /data and /etc/carlos hidden): new, reads /proc/self/net/dev, lists /data and opens /etc/carlos/host.env only to report what its sandbox hides, for the agent's readiness probe; reads only the files the agent sent and its own scratch	data-literal@275,data-literal@402,file:Open@442,file:ReadDir@264,file:ReadFile@82	2003801d3ece96004be7f62d9d2827f52758ec74aa5a7d978d9e170ea168e92c
@legacy	f143f173743b6ecec02a400cd49aef0ffa9a6f6535b4c174bfd8f31cee7269e0	internal/dbreads/worker.go	ServeWorker	legacy	accepted-legacy	accepted-legacy;rev3=census-ruling-db-region-forward-1;basis=root-input (J4); the db-read worker (carlos system db-worker, carlos-dbread@.service, a DynamicUser with no network, PrivateTmp, /data and /etc/carlos hidden): new, stats the copy it restored in its own private /var/tmp for the restored-size cap; reads only the files the agent sent and its own scratch; round 1: it refuses, before writing anything, a plan whose restored-size cap exceeds its own LimitFSIZE or whose files total more than twice that cap	file:Stat@2672	49f8ce8058469ac4ebec6dad82b69700d7a00a319550c12372e6266bb9db88cc
internal/dbreads/worker.go	ServeWorker	legacy	accepted-legacy	accepted-legacy;rev3=census-ruling-db-region-forward-1;basis=root-input (J4); the db-read worker (carlos system db-worker, carlos-dbread@.service, a DynamicUser with no network, PrivateTmp, /data and /etc/carlos hidden): new, stats the copy it restored in its own private /var/tmp for the restored-size cap; reads only the files the agent sent and its own scratch; round 1: it refuses, before writing anything, a plan whose restored-size cap exceeds its own LimitFSIZE or whose files total more than twice that cap	file:Stat@2672	49f8ce8058469ac4ebec6dad82b69700d7a00a319550c12372e6266bb9db88cc
@legacy	0f8f47f31959b3759046ef9ba5d1f461efc706f2056418b2ae13112c2bc5db6e	internal/dbreads/worker.go	receiveFile	legacy	accepted-legacy	accepted-legacy;rev3=census-ruling-db-region-forward-1;basis=root-input (J4); the db-read worker (carlos system db-worker, carlos-dbread@.service, a DynamicUser with no network, PrivateTmp, /data and /etc/carlos hidden): new, creates each planned LTX file the agent sent, exclusively, under its own private /var/tmp; reads only the files the agent sent and its own scratch	file:OpenFile@171	62b73deebff651b84e5a59400846909c849e4523795af9bbb09d16fb5b9ae615
internal/dbreads/worker.go	receiveFile	legacy	accepted-legacy	accepted-legacy;rev3=census-ruling-db-region-forward-1;basis=root-input (J4); the db-read worker (carlos system db-worker, carlos-dbread@.service, a DynamicUser with no network, PrivateTmp, /data and /etc/carlos hidden): new, creates each planned LTX file the agent sent, exclusively, under its own private /var/tmp; reads only the files the agent sent and its own scratch	file:OpenFile@171	62b73deebff651b84e5a59400846909c849e4523795af9bbb09d16fb5b9ae615
@legacy	79c1f8755b043dbf44df081dcb2a12e46a2759dd8132845c97507ce51111e149	internal/host/dbreads_linux.go	dbReadUnits	legacy	accepted-legacy	accepted-legacy;rev3=census-ruling-db-region-forward-1;basis=root-input (J4); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, systemctl list-units of carlos-dbread@ units, readable without privilege, for the orphan rule; makes no root decision	file:CommandContext@66	eec3780d161697ba67d285db1c9961356b2d150cce4ad7b4b8c7b8a68ad7c9fc
internal/host/dbreads_linux.go	dbReadUnits	legacy	accepted-legacy	accepted-legacy;rev3=census-ruling-db-region-forward-1;basis=root-input (J4); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, systemctl list-units of carlos-dbread@ units, readable without privilege, for the orphan rule; makes no root decision	file:CommandContext@66	eec3780d161697ba67d285db1c9961356b2d150cce4ad7b4b8c7b8a68ad7c9fc
@legacy	2fff139104d3518d70f9559dbcee8469d35719fcab35f905a83f9a35770fdffb	internal/host/dbreads_linux.go	varTmpFree	legacy	accepted-legacy	accepted-legacy;rev3=census-ruling-db-region-forward-1;basis=root-input (J4); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, one Statfs of /var/tmp for the disk reservation; makes no root decision	file:Statfs@77	f8028e70b69b019949bdf666818970a2754b6b4a8e434241377e03f3a5b304f9
internal/host/dbreads_linux.go	varTmpFree	legacy	accepted-legacy	accepted-legacy;rev3=census-ruling-db-region-forward-1;basis=root-input (J4); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): new, one Statfs of /var/tmp for the disk reservation; makes no root decision	file:Statfs@77	f8028e70b69b019949bdf666818970a2754b6b4a8e434241377e03f3a5b304f9
@legacy	9771143c9ec60adc46009328e2f853f2ede8b236e651bc29dfeb4e464c5977c4	internal/host/units/carlos-dbread.socket	external	legacy	accepted-legacy	accepted-legacy;rev3=census-ruling-db-region-forward-1;basis=the db-read worker's units (written by root's ensureSystemUnits; carlos-dbread.socket bound by PID 1 and owned by carlos; carlos-dbread@.service runs as a DynamicUser with no network, its own PrivateTmp, /data, /var/lib, /opt/carlos and /run/carlos empty, /etc/carlos inaccessible): new; round 1: it listens at /run/carlos/dbread/worker.sock, under the /run/carlos tree every tenant unit hides, and is armed only where host.env arms db reads	file:external@0	e21a31b98984fcf3495b24cb615ffb5e3df0638672d3d445bf5e59f5eee4326e
internal/host/units/carlos-dbread.socket	external	legacy	accepted-legacy	accepted-legacy;rev3=census-ruling-db-region-forward-1;basis=the db-read worker's units (written by root's ensureSystemUnits; carlos-dbread.socket bound by PID 1 and owned by carlos; carlos-dbread@.service runs as a DynamicUser with no network, its own PrivateTmp, /data, /var/lib, /opt/carlos and /run/carlos empty, /etc/carlos inaccessible): new; round 1: it listens at /run/carlos/dbread/worker.sock, under the /run/carlos tree every tenant unit hides, and is armed only where host.env arms db reads	file:external@0	e21a31b98984fcf3495b24cb615ffb5e3df0638672d3d445bf5e59f5eee4326e
@legacy	73e2ae48ba9d832cd09209e0447c2951839ebe1bee64906bc0ec548e95e623f2	internal/host/units/carlos-dbread@.service	external	legacy	accepted-legacy	accepted-legacy;rev3=census-ruling-db-region-forward-1;basis=the db-read worker's units (written by root's ensureSystemUnits; carlos-dbread.socket bound by PID 1 and owned by carlos; carlos-dbread@.service runs as a DynamicUser with no network, its own PrivateTmp, /data, /var/lib, /opt/carlos and /run/carlos empty, /etc/carlos inaccessible): new	file:external@0	a51ff9509ae8438c44f6930a0e2309d4ef021e6f322a6449c71a8483fec6a48a
internal/host/units/carlos-dbread@.service	external	legacy	accepted-legacy	accepted-legacy;rev3=census-ruling-db-region-forward-1;basis=the db-read worker's units (written by root's ensureSystemUnits; carlos-dbread.socket bound by PID 1 and owned by carlos; carlos-dbread@.service runs as a DynamicUser with no network, its own PrivateTmp, /data, /var/lib, /opt/carlos and /run/carlos empty, /etc/carlos inaccessible): new	file:external@0	a51ff9509ae8438c44f6930a0e2309d4ef021e6f322a6449c71a8483fec6a48a
@legacy	353cbb61170a1e51589abe1cb88bb40551edbda3223246e671b1bea7b48427b1	internal/host/edgesfile.go	edgesFileLoop	legacy	accepted-legacy	accepted-legacy;rev3=census-ruling-moves-offline;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body (census-ruling-seeded-instances) with offline-move-1 joining the published capabilities each pass while the armed moves worker is capable (withOfflineCapability), and headroom asked of region HA's capability alone; read site unchanged, offset moved; a report, not a decision;rev3=census-ruling-db-region-forward-1;basis=db-read-1 joins the published capabilities each pass while the armed db-reads loop's last readiness probe passed (withDBReadCapability), and the published draining flag is stored for that loop; read site unchanged, offset moved; a report, not a decision	file:Read@3048	d4cd28e081b2b6ecfea6df5a5ae04b4c98d8e4f9f64539323ff18c59328a83ad
internal/host/edgesfile.go	edgesFileLoop	legacy	accepted-legacy	accepted-legacy;rev3=census-ruling-moves-offline;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body (census-ruling-seeded-instances) with offline-move-1 joining the published capabilities each pass while the armed moves worker is capable (withOfflineCapability), and headroom asked of region HA's capability alone; read site unchanged, offset moved; a report, not a decision;rev3=census-ruling-db-region-forward-1;basis=db-read-1 joins the published capabilities each pass while the armed db-reads loop's last readiness probe passed (withDBReadCapability), and the published draining flag is stored for that loop; read site unchanged, offset moved; a report, not a decision	file:Read@3048	d4cd28e081b2b6ecfea6df5a5ae04b4c98d8e4f9f64539323ff18c59328a83ad
internal/host/agent.go	fastConvergeLoop	authority	B3	rev3=census-ruling-moves-offline;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body (census-ruling-carlos-run) with the offline keep view read before the first reconcile pass (refreshOfflineView); read sites unchanged, offsets moved; main's B3 authority retained;rev3=census-ruling-db-region-forward-1;basis=the serial pass also nudges the db-reads loop after the runs pass (nudgeDBReads, a channel send); read sites unchanged, offsets moved; main's B3 authority retained	whole:Route@9036,whole:Route@9599	c1ee6e325091f52865dd62ad0bcb500ef358e03fbebadbb2a315b833e3d4e3e5
internal/host/agent.go	runAgent	authority	B,C,D,F	rev3=census-ruling-seeded-instances;basis=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): main's body with wireSeedPlacement called in the activator start's Configure step, before armMovesPass, and the startup sweep's result stored for the import rollback in Recover; read sites unchanged, offsets moved; main's B,C,D,F authority retained PROPOSED E46: captured claim selection and root journal mutation; root RPC outside service host exclusion; SQL/route data never grants root authority. Executing identity: service controller; root for inventory/retirement callbacks.;rev3=PROPOSED-325;identity=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos);basis=passes the agent's log sink to armRunsPass; reads unchanged;rev3=census-ruling-db-region-forward-1;identity=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos);basis=arms the db-reads loop (armDBReads) beside armRunsPass in the activator start's Configure step; reads unchanged, offsets moved; main's authority retained	file:Exec@13802,file:Open@731,registry:App@10065,whole:Route@10057,whole:Route@23518	bfb4e24179044247af24b91a72b71fa5634fee616394421565c28c237d0779b4
internal/host/systemunits.go	ensureSystemUnits	authority	F,J4	rev3=PROPOSED-activation-tools;run=27;basis=automated offline transaction removed; retains preceding integrated classification: root-input;kept=F;scope=protected-decision-only;rev3=census-ruling-db-region-forward-1;identity=root (the adopt pass);basis=installs carlos-dbread.socket and carlos-dbread@.service with the other system units, asks one more is-active and arms the socket, never the service template; read sites unchanged, offsets moved; main's F authority retained; round 1: arms carlos-dbread.socket only when the installed host.env arms db reads (dbReadsSocketWanted reads its six db-reads keys through readClaimUnitFile, which the scanner does not name), and stops and disables it elsewhere	file:OpenFile@265,file:ReadFile@3396,file:ReadFile@3529,file:ReadFile@4688,file:Stat@3305	8b869a274b83ececef1eb2950694fee69866ce9de3111bcf0795a1ed5e77a838
system.go	runSystem	authority	B,C,D,F,G,J4	rev3=PROPOSED-activation-tools;identity=explicit operator CLI uid 0;basis=adds explicit system claims operator dispatch; every existing command branch unchanged;rev3=census-ruling-db-region-forward-1;basis=dispatches carlos system db-worker to dbreads.RunWorker (the db-read worker systemd starts per connection; never run by hand); every existing branch unchanged		22334957db7c2e7d3255af1f1c3f2ae69a752dbf6ad7e2cf90b51b02d361bca6
system.go	systemVerb	authority	B,C,D,F,G,J4	rev3=PROPOSED-activation-tools;identity=explicit operator CLI uid 0;basis=adds explicit system claims operator dispatch; every existing command branch unchanged;rev3=census-ruling-db-region-forward-1;basis=names db-worker as a system verb; every existing branch unchanged		d58c95cca3c473bdcffa99a465a1066068b374d9e8e2353c64e170593f89c895
internal/dbreads/agent.go	Agent.probe	diagnostic	J4	rev3=census-ruling-db-region-forward-1;identity=the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos);basis=the readiness probe: a hello on its own worker connection and the worker's report of its sandbox; decides only whether this box publishes db-read-1, never any root action; it reads nothing itself (a declaration row)		5b6f355a84ec41b1a6845c1c5ec4b5cb698696a4a0c51f556f2a7a255ddc20f0
@coverage	.	6e6ea47b610ecd2a61ec59a9b03cccbac6c47044eac5b1c8bf875ad66bd81060
@coverage	internal/console	e7a502ab8853a864fb16c072f01e2445b100e65a94fad33c0d81a75d91351472
@coverage	internal/dbdoor	c668f5bb72d53f71634425ed114c472199524501588aca698af2728abae81165
@coverage	internal/dbquery	09f18b6a1e0f254b4a5215ef29a57c4c467aa2632b7f1b936b5f0a0a75851075
@coverage	internal/dbreads	59c5cccb21ad03bebb4017ba368593a828cbb3ce40540ab9be30778d781a2714
@coverage	internal/dbreads/dbreadstest	55ba434bfd8eac5aebe932e3275a1c535c0ad284727deba3102fb80082ef4f58
@coverage	internal/host	49e2e0d84508e76f8e0b917bd73513ddb2c58a04e89753445e59c635f9bc12a3
@coverage	internal/host/units	1c3779f6369cfeb7682ed3d8ea5ee906efb6295f2fff799ebc8f3ee1edc4416f