# Census overlay moves-offline-precopy (parallel copies in lease.MirrorPrefix and the carlos move offline stage door, an offline-staging record state), loaded LAST, after design-plans-and-caps. RULED as census-ruling-moves-offline-precopy (the coordinator, as census owner for this branch, 2026-10-21), accepted as proposed, re-ruled for Astra's rounds 1 and 2 and the merge of main f550afa2: every row is rev3=census-ruling-moves-offline-precopy. The ruling, with each unit's executing identity: docs/superpowers/notes/census-proposal-moves-offline-precopy.md.
# Every unit here runs in the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos) or the console (user carlos-console) and makes no root decision, so each stays accepted legacy at the disposition census-ruling-moves-offline gave it or its sibling (J1 root-route for registry and route reads, J4 root-input for file reads).
# movesWorker.offlineSourceRevert re-frozen with its new digest: it calls offlineUnstage, which reads only the object store; its read sites are unchanged and one offset moved. offlineBegin is new: OfflineStart's body, moved unchanged with the state as a parameter; its one site is rec.ActiveRun.Open(), a method, not a file read. OfflineStart is retired by an H3 census-ruling removal (the carlos-run getJSON form); a removal is not in the seal.
# Round 1 (Astra, 692d41cf): the stage door pins the stager on the record (MoveState.Stager, written through SetRecordMove like every other move field); offlineUnstage cleans whenever staged_at is set, on the pinned stager only; the console's finish of a staged move waits for that stager's reverted report; MirrorPrefixKeep reads the receipts book before its workers start.
# Round 2 (Astra, 0a6bb375): the stage door also fixes the staging destination on the record (MoveState.StageBucket, StageRegion, from the one target box's edges file, refusing a source box's own bucket, MV-O191); the stage round, the seal's hand-over (offlineTakeSeal, re-frozen here) and an abort's cleanup use only those; the stager re-reads the record (provision.GetRecord, the object store) before a round and before its delete phase (stageDeleteGate) and acknowledges it has stopped (offlineStagerStopped, its own stager report through writeOfflineReport); the console's start and seal doors wait for that acknowledgement and refuse a missing stager (MV-O190) or changed coordinates (MV-O192). No new root read or record write. Three frozen declarations in all, so the seal moves.
# Envelopes re-pinned on the merged tree (main f550afa2 with this branch): . (move.go: the stage subcommand, its status and abort lines; no read), internal/console (the stage door, offlineBeginChecks, the stager pin and destination, the seal and start barriers, the finish gate, the status view; no read site but offlineClaimEvidence's, unchanged), internal/edgesfile (PlacementView reads data_bucket_region; no read site), internal/host (movesoffline_stage.go reads only the object store; edgesfile.go publishes offline-stage-1; the box-side stager election is gone, only the pinned box stages or cleans; offlineRound's staging branch), internal/lease (mirror.go: the round's copies and deletes run side by side; forEachParallel; the book read up front), internal/moves (the stager role, staged phase, report fields, OfflineStager) and internal/provision (offline_move.go: OfflineStage, which needs a StageTarget, OfflineRestage, OfflineStartStaged; provision.go: MoveState.StagedAt, Stager, StageBucket, StageRegion).
@legacy	e7c1242684b2da24edf4c9f56545d1208bd8433562aa494a911dda42e55d3452	internal/host/movesoffline.go	movesWorker.offlineSourceRevert	legacy	accepted-legacy	accepted-legacy;rev3=census-ruling-moves-offline-precopy;basis=root-route (J1, census-ruling-moves-offline's disposition); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos), on abort: census-ruling-moves-offline's body (reads the row's hold and releases only this move's hold, under reconcileMu), now calling offlineUnstage before it reports reverted. offlineUnstage acts only for a move carrying staged_at and only on the stager the stage door pinned on the record (move.stager); it reads only the object store (its own stager report, this box's receipts object) and deletes moves/<host>/ in the staging bucket and region the stage fixed on the record (move.stage_bucket, move.stage_region; it refuses a missing one or this box's own bucket and then acknowledges nothing) and this box's move-receipts/<host>.json, then writes its stager report reverted; it reads no local file and makes no root decision. Read sites unchanged; one offset moved (whole:Route@701 to @843)	registry:HoldOp@562,whole:Route@549,whole:Route@843	b917ac2d1976eec14839ed65e3e562327d54af956e86f5218ed011731182aa1b
internal/host/movesoffline.go	movesWorker.offlineSourceRevert	legacy	accepted-legacy	accepted-legacy;rev3=census-ruling-moves-offline-precopy;basis=root-route (J1, census-ruling-moves-offline's disposition); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos), on abort: census-ruling-moves-offline's body (reads the row's hold and releases only this move's hold, under reconcileMu), now calling offlineUnstage before it reports reverted. offlineUnstage acts only for a move carrying staged_at and only on the stager the stage door pinned on the record (move.stager); it reads only the object store (its own stager report, this box's receipts object) and deletes moves/<host>/ in the staging bucket and region the stage fixed on the record (move.stage_bucket, move.stage_region; it refuses a missing one or this box's own bucket and then acknowledges nothing) and this box's move-receipts/<host>.json, then writes its stager report reverted; it reads no local file and makes no root decision. Read sites unchanged; one offset moved (whole:Route@701 to @843)	registry:HoldOp@562,whole:Route@549,whole:Route@843	b917ac2d1976eec14839ed65e3e562327d54af956e86f5218ed011731182aa1b
@legacy	06eb20ca59fc8172dfa9ef5bc6872987974b44f08202417705566816ecaeaf9f	internal/host/movesoffline_seal.go	movesWorker.offlineTakeSeal	legacy	accepted-legacy	accepted-legacy;rev3=census-ruling-moves-offline-precopy;basis=root-route (J1, census-ruling-moves-offline's disposition); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): census-ruling-moves-offline's body (seal steps 1 to 9 from the row: database path, next due, replication rung and timer rows, read for the seal) with one refusal before the mirror: a staged move (staged_at set) is sealed only into the staging bucket and region the stage fixed on the record (move.stage_bucket, move.stage_region), a comparison of record and edges-file fields that reads and writes nothing new. Read sites unchanged; every offset after the check moved by 487 bytes	registry:DBPath@2621,registry:NextDue@12050,registry:NextDue@12962,registry:Replication@11955,registry:Replication@12937,whole:Route@10690,whole:Route@1713,whole:Route@2682,whole:Route@3463,whole:Route@5452,whole:Route@8226,whole:Timer@9377,whole:Timer@9442,whole:Timer@9448,whole:Timer@9707,whole:Timer@9806	f606873fb09e8644d449a36ae64cecbb84b2f83791d4ebec4cb491d3d3f7cdaa
internal/host/movesoffline_seal.go	movesWorker.offlineTakeSeal	legacy	accepted-legacy	accepted-legacy;rev3=census-ruling-moves-offline-precopy;basis=root-route (J1, census-ruling-moves-offline's disposition); the agent (/opt/carlos/carlos agent, carlos-edge.service, user carlos): census-ruling-moves-offline's body (seal steps 1 to 9 from the row: database path, next due, replication rung and timer rows, read for the seal) with one refusal before the mirror: a staged move (staged_at set) is sealed only into the staging bucket and region the stage fixed on the record (move.stage_bucket, move.stage_region), a comparison of record and edges-file fields that reads and writes nothing new. Read sites unchanged; every offset after the check moved by 487 bytes	registry:DBPath@2621,registry:NextDue@12050,registry:NextDue@12962,registry:Replication@11955,registry:Replication@12937,whole:Route@10690,whole:Route@1713,whole:Route@2682,whole:Route@3463,whole:Route@5452,whole:Route@8226,whole:Timer@9377,whole:Timer@9442,whole:Timer@9448,whole:Timer@9707,whole:Timer@9806	f606873fb09e8644d449a36ae64cecbb84b2f83791d4ebec4cb491d3d3f7cdaa
@legacy	5e6a7aa9d23e5559c9b93f3a5c038e019a9a5d3bbcfbcf9229725ce7682b936a	internal/provision/offline_move.go	offlineBegin	legacy	accepted-legacy	accepted-legacy;rev3=census-ruling-moves-offline-precopy;basis=root-input (J4, as OfflineStart); the console (cmd/console serve under console.service, user carlos-console): new, OfflineStart's body moved unchanged with the state as a parameter (offline-stopping for OfflineStart, behaviour-identical; offline-staging plus staged_at for OfflineStage), the record transition the start and stage doors apply through SetRecordMove; its one site is rec.ActiveRun.Open(), a method on the record's run state (RunState.Open), not a file read	file:Open@198	66e0216314538687d102a4cee1089a19896c7693260f748a046a5ff16e76dc1e
internal/provision/offline_move.go	offlineBegin	legacy	accepted-legacy	accepted-legacy;rev3=census-ruling-moves-offline-precopy;basis=root-input (J4, as OfflineStart); the console (cmd/console serve under console.service, user carlos-console): new, OfflineStart's body moved unchanged with the state as a parameter (offline-stopping for OfflineStart, behaviour-identical; offline-staging plus staged_at for OfflineStage), the record transition the start and stage doors apply through SetRecordMove; its one site is rec.ActiveRun.Open(), a method on the record's run state (RunState.Open), not a file read	file:Open@198	66e0216314538687d102a4cee1089a19896c7693260f748a046a5ff16e76dc1e
# OfflineStart retired (H3, the carlos-run form). A removal is not in the seal.
@remove	internal/provision/offline_move.go	OfflineStart
@removed	internal/provision/offline_move.go	OfflineStart	H3	census-ruling-moves-offline-precopy: still declared, and reads nothing now: its body and its one site (rec.ActiveRun.Open(), a method, not a file read) moved unchanged into offlineBegin, an accepted-legacy row in this overlay; OfflineStart calls offlineBegin with offline-stopping and is behaviour-identical. It runs in the console as carlos-console.
@coverage	.	649bb6a5f474312600edb213fb76a1a6444c6ff37a39412d1bbb04eeed49eabd
@coverage	internal/console	7bdd3caafb3a474a1bb3797c26c5a38e76b11ca7f0a46cd9c3a6af8ca62781c9
@coverage	internal/edgesfile	716924380656f85e428541c170e8c5bab9f0ad9c8abe931488f7a44e7953811e
@coverage	internal/host	d58c8e606d61557dce896f82fc41c06969d99fd1e097b863aa986e0fa416e219
@coverage	internal/lease	980f38c4804ae1485c0c0df77bade8990b1d0248c0f44e41e0194c7731562a14
@coverage	internal/moves	33c7b507f13b4f4081c3bdb0a84e31d875e2cf1be61b480a7ca856193125e071
@coverage	internal/provision	210b174030fa650ef7345999643ef7e98add1a24378802cc134f9dea64d234dc