amadan
spec: host lifecycle claim rev 6.8.2, the moves session's rev 7.9 readings
Warm continuation needs no box match (box decides only the baseline); admission may follow readiness but precedes any upload; lost writes on a lost disk are journalled and alerted.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 file changed,
+17
−3
docs/superpowers/specs/2026-10-02-host-lifecycle-claim-design.md+17 −3
CI passed — run details
diff --git a/docs/superpowers/specs/2026-10-02-host-lifecycle-claim-design.md b/docs/superpowers/specs/2026-10-02-host-lifecycle-claim-design.md| index e793f8db9..0017d21b1 100644 |
| --- a/docs/superpowers/specs/2026-10-02-host-lifecycle-claim-design.md |
| +++ b/docs/superpowers/specs/2026-10-02-host-lifecycle-claim-design.md |
| @@ -1,6 +1,6 @@ |
| # The host lifecycle claim |
| -Design, 2026-10-04, **rev 6.8.1**. Joint rounds 6 and 7 judged the claim ready for primitive planning. Rev |
| +Design, 2026-10-04, **rev 6.8.2**. Joint rounds 6 and 7 judged the claim ready for primitive planning. Rev |
| 6.5 added the R6-4 rule. Rev 6.6 added writer epochs (R7-1, amadan #225). |
| Rev 6.7 answered the moves session's notes on §6.4a. Rev 6.8 rewrites §6.4a |
| around writer sessions, for joint round 8 (R8-1 to R8-4). A small primitive cited by: |
| @@ -905,8 +905,11 @@ per session, and the marker is never deleted or reused. |
| **Warm continuation** is an `AdmitWriter` in **warm** mode. It is legal |
| only if `closed/<holder.session>.json` exists for the observed session, |
| -its `max_txid` equals the generation's remote maximum TXID, and its `box` |
| -is the admitting box or the warm baseline rules below allow otherwise. |
| +and its `max_txid` equals the generation's remote maximum TXID. The |
| +certificate proves every upload of that session completed, so any |
| +`op.exec` box may continue the generation. The admitting box need not |
| +be the certificate's box. Which box it is decides only the baseline (see |
| +below): the local database, or a remote restore. |
| The admitting CAS moves `holder.session` forward, so that marker now |
| names a dead session. A delayed, replayed or re-created marker for any |
| earlier session can never authorize anything again. No marker is ever |
| @@ -922,6 +925,12 @@ lost box, and a writer that continued and then crashed with uploads in |
| flight. That last writer's own session has no certificate, whatever |
| older certificates exist. |
| +**When admission happens.** A box may start the app and pass its |
| +readiness checks before admission, but **no upload of any kind** may be |
| +issued before the admitting CAS has succeeded. A start that fails its |
| +checks admits nothing, and leaves `holder.session` unchanged. This keeps |
| +a crash-looping app from driving a storm of cold admissions. |
| + |
| #### Baselines and provenance (R8-4) |
| A cold `AdmitWriter` journals its predecessor (`predecessor.session`, |
| @@ -938,6 +947,11 @@ activated anywhere. The new writer's baseline is: |
| never writes a lineage file. So no claim read can manufacture evidence |
| of earlier ownership; |
| - **otherwise, a restore from the predecessor generation's remote.** |
| + If a writer's local disk was lost, for example a source during a revert |
| + or rollback, its unreplicated writes are gone. The cold admission then |
| + records `writes_lost: {box, generation, last_known_txid}` in its |
| + journal entry, and raises an alert. Lost writes are always declared, |
| + never silent. |
| The writer then activates the new stamp locally (§6.4), and replicates |
| **only** into `<location>/<new generation>/`. |