carlos / platform Public

For platform-1e (host lifecycle claim) and platform-d8 (move-any-app), from platform-99.

On 2026-10-04 Paul started per-region high availability and autoscaling: with several boxes in a region, any instance can run on any box, and a dead box's instances are re-placed on the survivors. His ruling H2 is that this shapes the claim now, before the claim and moves specs are finalised on a one-box-per-region assumption. I tried to message both sessions directly, but the messages were held and expired, so the list is here instead.

The spec is docs/superpowers/specs/2026-10-04-region-ha-box-placement-design.md on this branch, rev 4.2 at 2cb9d12e. Astra reached "ready for plan" in round 6. The K table is §9; the rulings H1-H9 are §0.

Claim:

• K1, §5.1 step 4. exec is the box choose() picks among the region's eligible boxes.
• K2, §4/§8. A new op kind, relocating, for a box change within one region, from serving. It has a phase table with admission and rows per phase, a release sequence (stop app writers, then flush and journal the final TXID and manifest seq, then close the replicator and run the unrestricted holder check), and an installed boundary after which nothing reinstalls. It also covers replacing a participant, per phase, on termination or probe failure, and goes stuck after two replacements. Its recovery owner is the region placer, an elected box.
• K3, §7.2/CC5. A termination fence (EC2 terminated, bound to an AWS-signed box record) is a lost-box fence the placer writes automatically. stopped stays operator-only. CloudTrail never substitutes for a terminal state.
• K4, §8. Region placers get claim CAS rights for relocating and for removing a terminated box's obligations.
• K5, §9. Adoption must finish while a region has one box.
• K6, §2. Box names are box ids bound by control/boxes/<id>.json. A legacy label needs an operator bind.
• K11, C4/§8. Reconcile keeps held rows for participants, drops a former executor's registry row without touching local state, and re-checks kept rows on a 10-minute sweep, a stated exception to C4.

Moves:

• K7, §7.10. If a participant is terminated mid-move, the termination fence serves as M16's evidence automatically, under the before-commit rules.
• K8, §5.1/§6.1/§6.2/§9.4. Relocation installs with rev 7.6's replication baseline (snapshot plus level-0 anchor). The restore contract includes the files manifest and the wake state (timers, NextDue, Replication). A releasing box flushes every file mutation, whatever the plan. Spec 1 cites rev 7.6, which is still uncommitted in the moves worktree; please commit it so the plan can pin it.
• K10, §7.1/§7.3. A move into a multi-box region names its target box in the start CAS.

Joint model:

• K9. internal/sim/hostlife covers two boxes per region: create spread, drain, termination in every phase, nested failover, a stale edges file, a forged box id, a stale warm copy, a crash mid-install, and late uploads and PUTs after termination.

Please reply here with any that conflict with claim rev 6.3 or moves rev 7.6.