Host space: archives

The janitor never takes user data, so what a machine cannot hold any more and nobody can rebuild (datasets, downloaded papers, recordings) is moved to a host of the fleet with room, not deleted. space candidates lists such data as user_owned proposals, and its text heading of the user-data rows names space archive move PATH --to HOST --root DIR as the way to move one.

space archive move PATH --to TARGET --root DIR --reason TEXT --apply does, in this order, and stops at the first step that fails with nothing removed here:

1. Reads PATH: an absolute directory or regular file spelled by its own real path, holding only directories, regular files and links whose names are UTF-8 on one line without a backslash. Every file's size and SHA-256 is read into the manifest.
2. Refuses a tree anything under which changed within the last hour (another session may still be writing it), and a tree a Git repository tracks files in, unless it is that repository's top directory, which moves whole with its history.
3. Makes DIR/<id>/data on TARGET. DIR must lie outside every area the host's janitor takes from: the account's home, where the build-cache and package-cache cleaners sweep anywhere, and the declared work root, where the job, run and checkout cleaners sweep. Both are compared on the real path, links followed, so the archive is never the fleet's to delete.
4. Copies the tree to DIR/<id>/data/<name> with rsync -a over the target's Stado SSH route (in place when TARGET is this machine), links kept as links.
5. Computes on TARGET the SHA-256 of every file the copy holds and compares each with the manifest: a file missing, extra or holding other bytes stops the move, naming how many and the first.
6. Keeps the manifest at ~/.stado/space/archives/<id>.json and a copy beside the archive as DIR/<id>/manifest.json, so the archive names its own contents without this machine, and records the archive in ~/.stado/space/archives.json with the reason and who moved it.
7. Only then removes PATH here.

space archive restore ID --apply refuses when anything is at the original path (it never writes over it), copies the archive back, and verifies every file against the manifest; the copy on the host stays and the register records when it was restored.

Refusals, each with its cause in stado errors show stado.space: an applied move without a reason (archive-reason-missing), a path that is not such a tree (archive-path-unusable), one changed within the hour (archive-path-recent), one a repository tracks (archive-path-tracked), one with an unreadable file or directory (archive-path-unread), a root in the host's home or work root (archive-root-unsafe), a copy whose checksums differ (archive-copy-differs), a tree verified on the host that could not be removed here (archive-local-left, the archive is recorded and restorable), a damaged register (archive-register-unreadable), an unknown id (archive-unknown), and a restore onto an existing path (archive-restore-occupied).

Real test: tests/space/archive.rs (--test space-archive) moves a tree to this machine as the registry names it, sees it verified, removed and listed, restores it bit for bit, and provokes each refusal above but the host answering without the script's report (archive-host-unreported), which only a host whose shell does not run the script produces.