← Branches
region-ha-1b-next-build
Commits
-
ff6adb887
Astra round 9: unedited — round-8 P2 closed, no new findings; relocation may merge dormant once CI is green
Paul Campbell
-
24a0abe79
Astra round 9 brief: replacement guard activation
Paul Campbell
-
6d4ba32f3
region ha: a replacement target activates its unopened installation at its new install stamp on the participant's path, so a target replaced at installed, or in probing before P's first admission, makes its local install instead of stalling on ErrNoRecord or ErrStampMismatch (Astra round 8, P2).
Paul Campbell
-
ca9e54b63
Astra round 8: unedited — round-7 stamp P2 closed; one new P2 (a replaced target never activates its new install guard, so it stalls)
Paul Campbell
-
f624686e2
Astra round 8 brief: the replacement-stamp fix, the T7 test fix, and the replacement guard question
Paul Campbell
-
a96107870
release: the Task 8c held-verify test follows main's T7 rule: VerifyHeldLive writes nothing and reads under the claim (moves Task 7), so the test asserts it passes there rather than refusing (CI on 03212a8b)
Paul Campbell
-
15ffddfaf
region ha: the relocation's prepared-files binding holds P's build stamp and the replacement's install stamp apart, each exactly, so a target replaced at installed, or in probing before P's first admission, which keeps P and its prepared authority under a new install stamp, establishes P's files through main's C8 provider (Astra round 7, P2).
Paul Campbell
-
911c49053
Astra round 7: unedited — round-6 findings closed; one new P2 (a replaced target's new install stamp fails the prepared-authority stamp check)
Paul Campbell
-
03212a8bb
Astra round 7 brief: round-6 fixes and the moves-plan15-proof merge
Paul Campbell
-
6317c1afe
Merge origin/main (moves-plan15-proof, region-ha-two-box-build, settings-5-surfaces) into region-ha-1b-next-build
Paul Campbell
-
e77d59126
region ha: relocation's first probe establishes its files manifest through main's C8 provider: the provider reads the env file the launch source minted, found through the host's row (a nested row's in its instance directory, read beneath it; fenced, conflicting, missing or moved rows refuse, never a guess at the flat path), reads P's prepared manifest by the binding relocation's own install journals (prepared_authority's digest and stamp, the local_install receipt's journal digest, the install journal's files_manifest step with key, op, stamp, sha256 and exact version), chosen by the claim's op kind, never by which journal exists, and treats a relocating P's opening as prepared whether or not its database is empty, so an empty database still starts from P's files by compare-and-swap over P's manifest (merge round 6, findings 2, 3 and 4).
Paul Campbell
-
52449165c
region ha: relocation names a generation's files by main's one rule, <location>/files/g-<generation>/ (moves.GenerationFilesPrefix, the twin of GenerationPrefix), in its pinner and allowed-reference rule, build, prepared verifier, install, release flush and probe evidence; main's C8 provider (movesFilesPrefix) and the park view's files live set delegate to it, so a failover finds the provider's manifests, the provider consumes relocation's prepared manifest, and the park view classifies and pins relocation's files (merge round 6, finding 1).
Paul Campbell
-
4607728c6
region ha: the moves wake-source test passes relocation's completed-handover argument (nil), so internal/host vets again after the main merge (round 6, CI)
Paul Campbell
-
7664f7c5a
Astra round 6: unedited — four P2s where main's moves C8 files provider meets relocation (prefix, nested env, prepared authority, empty-DB files)
Paul Campbell
-
1887a22a9
Astra round 6 brief: the moves-phase1-5f / claim-admitted-provenance merge against relocation
Paul Campbell
-
87146236b
Merge origin/main (moves-phase1-5f, claim-admitted-provenance) into region-ha-1b-next-build
Paul Campbell
-
f43959418
Astra L18 joint round, round 5: unedited — both round-4 items closed, no new findings; relocation may merge dormant once CI is green
Paul Campbell
-
c8aa4780a
Astra L18 joint round, round 5 brief: confirm the round-4 items closed
Paul Campbell
-
3320b9ce4
region ha: the relocation probe's launch names the build its executable was hashed as (Staged), so the activator's claimed-build check admits the probe start with BeforeExec set (L18 joint round 4, item 1).
Paul Campbell
-
26f6cdbc1
Astra L18 joint round, round 4: unedited — finding 1 closed; two new P2s (relocation probe drops Staged after the main merge; model's dirty return ignores target admission)
Paul Campbell
-
5fbe1824c
Astra L18 joint round, round 4 brief: confirm finding 1 closed after main merge
Paul Campbell
-
8ad2c5709
Merge remote-tracking branch 'origin/main' into region-ha-1b-next-build
Paul Campbell
-
ebeda6cf0
Astra L18 joint round, round 3: unedited — finding 1 (moves) is the only open item
Paul Campbell
-
0d5a1f46d
Astra brief: L18 joint round, round 3
Paul Campbell
-
6a4eadde6
region ha: the probe stop stops the writers, flushes the database and files and records positions through the release's own steps before root's stop (ruling 87).
Paul Campbell
-
6daf41a77
Astra L18 joint round, round 2: unedited
Paul Campbell
-
b9092a0c7
Astra brief: L18 joint round, round 2
Paul Campbell
-
ca2823781
region ha: a delete or purge that verifies the completion box's termination fence passes it to the completion barrier as its exempt box (ruling 86).
Paul Campbell
-
b1aacf794
region ha: the catch-up hold's tests pin its CheckHeld refusal and its decision made again under the lock (L18 finding 3 review M1, M2).
Paul Campbell
-
a092ddc23
region ha: a source whose reconcile is delayed past the completion holds its row for the completed op until its park-local retires it (L18 finding 3).
Paul Campbell
-
987014eff
Astra L18 joint round (stage B Task 11): unedited — does not pass
Paul Campbell
-
596fa8b14
Astra brief: L18 joint round (stage B Task 11)
Paul Campbell
-
2f73d9419
docs: the relocation barrier's approved move-door sentence takes MV-N450, after moves' unused MV-N444 to MV-N449
Paul Campbell
-
4b66efbfe
region HA: stage B reads main's home region (park.HomeRegion) through main's helpers wherever it meets it
Paul Campbell
-
db97dd7fe
Merge origin/main into region-ha-1b-next-build (home region, moves held lock, zdd readiness)
Paul Campbell
-
6c45e0165
docs: the moves copy record carries MV-N444, Paul's approved sentence for the relocation completion barrier at the move door
Paul Campbell
-
d383d06db
console: the move door says the instance's last relocation is still finishing when the completion barrier refuses, and keeps its region sentence for every other pending chore (Paul's copy review)
Paul Campbell
-
48ad35479
provision: the record-write census re-reviews hostfiles' Publisher.Commit after its path-cap refusal (400a3302); class unchanged
Paul Campbell
-
2d33985fb
docs: the stage B activation record marks Task 10b built and adds #279, the tenant-directory unit checks and the path-cap cost as gates
Paul Campbell
-
b3dc5db7c
Astra tenant-directory fix 5 confirming review: unedited — approved for dormant merge
Paul Campbell
-
cfad7aac7
Astra brief: tenant-directory fix 5 confirming
Paul Campbell
-
318519f50
hostfiles: Open refuses a manifest inherited with a path past the cap, terminally, and Run stops with one line on a commit no retry can fix.
Paul Campbell
-
3662903b2
Astra tenant-directory fix 4 confirming review: unedited
Paul Campbell
-
333f13f08
Astra brief: tenant-directory fix 4 confirming
Paul Campbell
-
400a33029
hostfiles: one 4095-byte path cap, with no depth cap, is enforced by every writer (Stage, StageSkipped, StageDelete, Commit, the watcher) as by the readers; the watcher skips an over-cap path and logs it once.
Paul Campbell
-
3682ec7b2
Astra tenant-directory confirming review: unedited
Paul Campbell
-
b76adde03
Astra brief: tenant-directory fix 3 confirming
Paul Campbell
-
f91235729
hostfiles: restore never blocks on a swapped-in FIFO, absence on tenant ground is decided beneath one held directory descriptor, and walks and manifests are capped at PATH_MAX and 256 components.
Paul Campbell
-
7a4b908ff
Astra tenant-directory security review: unedited
Paul Campbell
-
63765a538
Astra brief: tenant-directory security review
Paul Campbell
-
3194d6741
host: relocation install writes, restores and publishes the tenant's instance directory only beneath directories opened through instancefs, with hostfiles' RestoreRoot and SyncDirAt as the one implementation behind Restore and SyncDir.
Paul Campbell
-
dca370c20
host: the release flush, the install's key check and Present read the tenant's instance directory only through instancefs, so a symlink, FIFO or oversized file there is refused and absence counts only when the directory itself opened.
Paul Campbell
-
cfb4314df
moves copy gate: the scan reads stage B's five relocation files that import internal/moves
Paul Campbell
-
2f0439fdb
host: a relocation mints its route with the app's update policy, as main's mint does
Paul Campbell
-
c429c6d53
Merge origin/main into region-ha-1b-next-build (instance-key final, moves phase 1, census)
Paul Campbell
-
cb62db09b
hostbox: the hold-only check's inventory test pins the row's own incarnation and the route entry's materialization
Paul Campbell
-
d150fdd86
hostbox: tests pin the source hold's last three guards: a row another op holds between the read and the write is refused, and the hold-only check refuses an incomplete inventory or one without exactly one route entry
Paul Campbell
-
0eec5d788
host: with region HA on, the source's row is held for its relocation once this box's admission fence for the host closes, checked against the source's own installation, and only the source's park-local ends that hold (R5-3)
Paul Campbell
-
1a1aebaa2
Astra Task 10b plan round 2: unedited — ready to build
Paul Campbell
-
2c9d95d9f
Astra brief: Task 10b round 2
Paul Campbell
-
e236acd5e
docs: stage B plan rev 5.4.1 answers Astra's Task 10b round 1: the source's hold-only reconcile checks its own installation at its row's stamp, so a first pass after installing still holds the row
Paul Campbell
-
1d6e75a5f
Astra Task 10b plan round 1: unedited
Paul Campbell
-
5791475f1
Astra brief: stage B Task 10b plan
Paul Campbell
-
ef847864d
docs: stage B plan rev 5.4 writes Task 10b in full: with region HA on, the source's row is held for its relocation once this box's admission fence for the host closes, and its park-local ends the hold (R5-3)
Paul Campbell
-
08df87e4e
Astra confirming review of the stage B fix wave: unedited — ready to merge dormant
Paul Campbell
-
420931828
Astra confirming brief: stage B final fix wave
Paul Campbell
-
c9b51c472
docs: the activation record says what switching CARLOS_REGION_HA off does mid-relocation and names W5's owner; the C11 and read-volume notes (final review minors 8, 11, 12)
Paul Campbell
-
9a9da0277
host: an unreadable install journal refuses rather than reads as no receipt; VerifyLocal reads P's manifest as the install does; one environment for the pass; the serial, floor-seam, op-id and attempt-count notes (final review minors 1, 3, 4, 5, 6, 7, 10, 11)
Paul Campbell
-
7f80f875d
provision: the record-write census inventory reviews region HA's eight sites: the build's authority store and relocationRecord classified, five changed digests re-reviewed (final review I4)
Paul Campbell
-
cd740ca8b
host: a repair across a configuration change replaces the claim's install receipt in one CAS before admission, so EnsureLocal, VerifyReceipt and the post-admission check compare one digest (final review A3)
Paul Campbell
-
ecef64d4d
hostrelocate: a passed probe whose record never reached the claim is recovered from the box's attempt journal, keyed by the admitted session, before preflight or any attempt (final review A2)
Paul Campbell
-
c53e60b4d
hostfiles: Present accepts what Restore writes for overlapping live entries, through the one sequence rule both share (final review A1)
Paul Campbell
-
99a00923c
Astra final review of the stage B build: unedited
Paul Campbell
-
a9650a52d
Astra final review brief: stage B build
Paul Campbell
-
8c13973c4
docs: the stage B plan records the .moves lock residual under M-K25 and the two-completed-stops stuck cause under checklist item 19 (task 10 re-review R1)
Paul Campbell
-
6dfb955df
docs: stage B Task 10's activation record names every switch-on gate with its owner and status, C12, C13, C14, Task 11 after J2, O1 with W5 and the instance-key work among them
Paul Campbell
-
e08ea5ba3
host: the completion pass reads its registry rows and the hosts its own op journals name, so a completion whose row is gone is still said; it reads each claim once and asks which box it is only for a pending completion; an ErrChanged after its serving-here check is said once; alerts are one per host, step and cause and forget what clears; the startup full build runs in the first bounded pass and the launch reads nothing the loop owns; the sweep reads claims before its exclusive lock and checks again under it; edgesfile: no edges file at all is not complete evidence while a box reports fresh
Paul Campbell
-
4a2cbfb38
host: the relocation pass says a claim it cannot read rather than pass it over, a full pass that could not be built at startup is tried again every pass behind the completion-only runtime rather than read as no relocation on the box, and the agent says why it starts no completion pass in claim mode; hostrelocate: a converted landing's wait with no readable fence observation is refused with the chooser's answer rather than left unbounded
Paul Campbell
-
210ce9d5e
host: with the claim and region HA on and moves' files provider bound, every box replays its region's relocations one pass per host and converts a fenced committed landing, and with claim mode alone it finishes only the completions serving on itself, through main's own discharge, before its first serving wake hands over from the probe's receipt; the journal sweep never runs beside a journal write; edgesfile: the live placement read the console and the pass share
Paul Campbell
-
8f2301201
host: the hold release refuses a row held by another op before anything is released, discharges again rather than inferring it from a released hold, and answers ErrChanged for a claim that does not serve on this box; N6 is wired whenever claim mode is on; and of the eleven mutations run this round (the review's four survivors, I1, M2, M4, N6's two wiring cases and N6's two fallbacks), all eleven fail a test, one of them only once Plan 11's routing was pinned through N6, where 3a146834 had claimed every guard without the review's four.
Paul Campbell
-
3a146834e
host: a probe-fence marker that is present is never replaced and the hold release refuses without it, an unreadable completion record ends C10's cleanup and refuses N6 rather than routing to main's stop, two completed stops of one session are no receipt, and every relocation completion guard has a test that fails without it
Paul Campbell
-
60ce1f28d
host: the passed probe is stopped with root's receipt under an owned fence, its participation is discharged by that receipt before the hold is released and the completion is marked (C10), and the first serving wake hands over from it (N6)
Paul Campbell
-
e72b9d66b
host: root opens the relocation attempt journal beneath the data root, a later attempt is never empty, a mismatched or unreadable release is a claim defect found before an attempt is counted, and every relocation guard has a test that fails without it
Paul Campbell
-
66a44eb12
host: a relocation probe reads no release from an unreadable one, opens P empty only on the pin's word with the authority agreeing, and takes a later attempt's empty listing as empty only over an empty P; root's reader needs a bound reserved start
Paul Campbell
-
f28a805dc
host: the relocation owner set: wake inputs over main's prepared publication, an op-keyed attempt journal that root reads with region HA on, the admission hooks and the probe attempt
Paul Campbell
-
ce6f8bb6d
host: the relocation install publishes the held release under main's held-stage lock and writes its receipt only after the reading under that lock proves it, checks every precondition before any write, and tests pin each write group's work and VerifyLocal's stamp and hold checks
Paul Campbell
-
1ea69696b
hostrelocate: the pinner refuses a files manifest without the env file or the wake state before any build, by the install's own rule
Paul Campbell
-
73bab739e
host: the relocation install reads no env file and no wake state from a manifest that lacks them unless the pin evidences a host that never published files, and refuses before any write otherwise
Paul Campbell
-
91ed7c244
host: a relocation target mints its held row through the typed census and installs files, env and wake state under main's WorkSource, then the held config and the pinned release
Paul Campbell
-
63ded7b50
host: the relocation build checks its authority before it takes the replica lease, ReadPin refuses a files digest without its retained copy, and tests pin every install, build and verify check that survived deletion
Paul Campbell
-
a8dbe3421
hostrelocate: a configured key's adoption record again needs the env item present and readable, and adoptedKey names the residual that a source with no env file refuses because platform items have no tombstone
Paul Campbell
-
bd4d9355b
hostrelocate: a configured key's adoption record is accepted beside the env item with no key of its own or the release flush's deletion entry for it, and an env item never published still refuses
Paul Campbell
-
43288063b
host: a relocation target activates its guard at the install stamp from an empty box and builds P under the replica lease, rechecking its authority before every write; the pin needs positive evidence of the instance key, and a pin's empty database, its files digest and a configured key's env are never inferred from absence
Paul Campbell
-
734e8424d
host: an empty listing gives a release position 0 only for writer session 0, without a second replicator position reader
Paul Campbell
-
95a1ed845
host: relocation refuses what it cannot read: an unreadable completed relocation holds the barrier and the sweep, an empty listing needs session 0 and the replicator's own zero position, and a malformed adoption record fails the flush
Paul Campbell
-
85e58f61e
host: relocation reads main's participation owner and releases in Plan 11's order; hostclaim: a relocation completes only after its passed probe is stopped with root's receipt, and no operation starts from it before its target discharges it; activator: owned fences
Paul Campbell
-
cf22260a4
Merge instance-key-build@e8487c3a (IK-1: internal/instancekey) into region-ha-1b-next-build for stage B
Paul Campbell
-
194a219a7
Astra stage B plan round 9: unedited — ready to build
Paul Campbell
-
3233d5832
Astra stage B round 9 brief (confirming rev 5.3)
Paul Campbell
-
a8744902a
docs: region HA stage B plan rev 5.3, Astra round 8
Paul Campbell
amadan