amadan
docs: instance moves — P0 waits for P7 where an app router dials sockets itself
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 file changed,
+16
−6
docs/superpowers/specs/2026-09-24-instance-moves-for-every-app-design.md+16 −6
diff --git a/docs/superpowers/specs/2026-09-24-instance-moves-for-every-app-design.md b/docs/superpowers/specs/2026-09-24-instance-moves-for-every-app-design.md| index 589b1233b..10c5b419d 100644 |
| --- a/docs/superpowers/specs/2026-09-24-instance-moves-for-every-app-design.md |
| +++ b/docs/superpowers/specs/2026-09-24-instance-moves-for-every-app-design.md |
| @@ -565,7 +565,7 @@ mirror) as early as it can safely be. |
| | slice | what | depends on | unblocks | |
| |---|---|---|---| |
| -| **P0** | Run `carlos system layout migrate` on carlos-tito-ie (operator act, built) and fix G12 with a test | nothing new | P6, and any adoption | |
| +| **P0** | Run `carlos system layout migrate` on carlos-tito-ie (operator act, built) and fix G12 with a test | **P7 first on any deployment whose app router dials instance sockets itself** (below) | P6, and any adoption | |
| | **P1** | `ServeHook`, the manifest `moves.hooks` declaration, `freezing` state, freeze/thaw calls with the tick's token; hook-path refusal at the edge | P0 for G12 | row 1's failure mode, for every app | |
| | **P2** | Holding route: `moving` edges role, 503 instead of 404 | — | a cut nobody sees as an error | |
| | **P3** | Home region publishes a staging lane; moves to and from home | infra: add `ie` to each sibling's `sibling_staging_arns` | rollback | |
| @@ -575,11 +575,21 @@ mirror) as early as it can safely be. |
| | **P7** | Edge-local door for app routers | P0 (isolated layout is why the sockets stop being reachable) | apps with their own router, Tito's root domain | |
| | **P8** | Per-placement store backend; private store and prefix stores follow | P4, P5 | uploads residency | |
| -**For elatromme → us, the minimum is P0, P6, P1, P3, and P7 or its polling |
| -alternative** (§8), plus Tito's own slices in the linked record. P2 is small, |
| -and a customer's first move should not show buyers a 404, so it belongs in |
| -that set too. P8 is the only way uploads move, and whether the first move |
| -waits for it is a product call (§14). |
| +**P0 has an ordering trap on Tito's box.** Tito's router does not read an |
| +instance's socket from the platform. It guesses `/run/carlos/<host>.sock` |
| +(titogo `internal/carlos/fleet_http.go:934`, `signup_http.go:660`), and |
| +the isolated layout moves the socket to `/run/carlos/instances/<iid>/app.sock` |
| +(isolated-exec design §3.1). Migrating the layout first would cut Tito's |
| +root domain off from every platform instance on the box. So on carlos-tito-ie |
| +the order is P7, then Tito's router switches to the door, then P0. Any other |
| +app that dials instance sockets by a path it computed has the same trap, |
| +which is one more argument for P7. |
| + |
| +**For elatromme → us, the minimum is P7, P0, P6, P1, P3 and P2** (P7 or its |
| +polling alternative, §8), plus Tito's own slices in the linked record. P2 |
| +is on that list because a customer's first move should not show buyers a |
| +404. P8 is the only way uploads move, and whether the first move waits for |
| +it is a product call for Tito, not a platform one. |
| ## 14. Open questions |