claude agent, operated by paul@keymail.devdriven by paul@keymail.devsession 734a1127 · claude-code/2.1.292 · DOCS-T1
LLM
Four things only Paul can decide, in order of importance. 1. Design section 10 Q3: v1 returns automatically only for failures before open; after open a failure is paged and an operator runs the offline move back. This narrows the 2026-10-21 ruling (automatic return). Accept, or ask for alternative (a) or (b) first. 2. Cleanup exclusion (plan 4, Astra review 2 F1): the old region's replica can only be deleted safely if every path that changes a record's region (carlos apps place, the legacy move door, reconciliation) is gated by the cleanup reservation. Options: gate those paths behind the reservation; or amend section 7.6 to let cleanup use versioned deletes of the inventoried version ids (today forbidden); or keep cleanup an operator runbook step for v1. 3. Plan 1 needs an operator cutover step: carlos system lifetimes cutover, run after the old console has stopped, writes control/lifetimes-cutover.json; until then every claims-off door behaves as today. Confirm this is acceptable as a rollout step. 4. Plan 2 deviation: in self-serve mode the legacy move mutations (prepare, cut, cancel with a plain instance token) are not served; the status read stays open. Confirm.
Agent notes
Review artefacts in /home/paulca/.cache/tmp/claude-1001/own/after236/selfserve-plan{1,2,3,4}-review*.md; plan 1 is at rev 9 (review 9 running), plan 2 rev 4 (review 4 running), plan 3 rev 3 (review 3 running), plan 4 rev 2 (reviewed NOT READY; iteration paused on ruling 2).
claude agent, operated by paul@keymail.devoperated by paul@keymail.devsession 734a1127 · claude-code/2.1.292 · DOCS-T1
Update to the cutover ruling (plan 1 rev 11, 98522945). Astra's review 10 showed a 60 s timer alone does not drain work the console already admitted (an instance create waiting on the walk lock, an import upload's detached continuation, a seed sweep pass can all outlive it). The cutover is now an admission gate:
Every unit of claims-off record work on the console (a request, a detached continuation, one worker iteration) is admitted and counted, and keeps the mode it was admitted in for its whole life.
carlos system lifetimes cutover writes the marker; the console closes admission at once (new mutations get 503 "the console is switching on instance lifetimes. try again in a minute"), waits for the admitted count to reach zero, then waits the 60 s storage settle, then activates. The command polls and prints "switching on; N unit(s) of earlier work still finishing" until "on since <time>".
on is latched for the process. A console that starts before it has read the marker answers 503 on every claims-off record door until it has (fail closed both ways: a marker-read failure never restores legacy interpretation).
The operator sequence stays: stop the old console, start the new, run the command, read its output until "on". A long import in flight delays activation rather than being cut off.
What I need from you is unchanged: a yes to this being an operator step in the rollout, or a different shape.
claude agent, operated by paul@keymail.devdriven by paul@keymail.devsession 734a1127 · claude-code/2.1.292 · DOCS-T1
Rulings taken 2026-10-22 (Paul, in session): all four as recommended.
Automatic return only before open: yes. After the target opens the console pages and the return is an operator step (§10 Q3).
Cleanup exclusion: carlos apps place and the legacy move door are gated behind plan 2's per-box reservation table, so every region change holds a reservation and plan 4's cleanup can delete safely. Plan 4 resumes on that basis.
The cutover step: yes to the shape as built in plan 1 Task 0: carlos system lifetimes cutover after the old console stops; every change through the console answers 503 for at least a minute while earlier work drains (deploys and promotions included); reads keep working.
Plan 2's deviation: yes. In self-serve mode the legacy move mutations are not served (a plain instance token gets the family's 404 at prepare, cut and cancel; status stays open).
Also approved: the copy rows of plans 1 to 3 as written (the cutover sentences, the CLI's two output lines, the docs/site/cli.md section, "could not create the instance. try again", the holding page's four sentences and "not served here", plan 2's door sentences). Census PROPOSED rows will be ruled once at the end of the plan 1 build.
amadan