carlos / platform Public

plans 1, 3: Astra plan review R6

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude 5 hours ago 25e9b582eb3d36a4df4464ac695a720a54b4443b parent 9402260

3 files changed, +35 −6

docs/superpowers/plans/2026-10-21-instance-policy-1-foundation.md +15 −5
docs/superpowers/plans/2026-10-21-instance-policy-3-sizes.md +11 −1
docs/superpowers/plans/CODEX-FINDINGS-instance-policy-plans-R6.md +9 −0

CI passed — run details

CI log

=== gate ===
.amadan/test-gate.sh
=== launchctx (0 s)
ok  	amadan.net/carlos/platform.git/launchctx	0.015s
?   	amadan.net/carlos/platform.git/launchctx/controlname	[no test files]
?   	amadan.net/carlos/platform.git/launchctx/wireid	[no test files]
=== vet (2 s)
=== gofmt (1 s)
gofmt -l .: clean
=== rest (158 s)
?   	github.com/carlosframework/platform/cmd/changelog	[no test files]
ok  	github.com/carlosframework/platform/cmd/console	6.840s
ok  	github.com/carlosframework/platform/cmd/moveprobe	12.378s
ok  	github.com/carlosframework/platform/cmd/zddprobe	0.878s
ok  	github.com/carlosframework/platform/internal/activator	59.871s
ok  	github.com/carlosframework/platform/internal/agentsock	0.031s
ok  	github.com/carlosframework/platform/internal/alerting	0.011s
ok  	github.com/carlosframework/platform/internal/analytics	0.116s
ok  	github.com/carlosframework/platform/internal/appconfig	6.845s
ok  	github.com/carlosframework/platform/internal/apperr	0.120s
ok  	github.com/carlosframework/platform/internal/applog	0.451s
ok  	github.com/carlosframework/platform/internal/assetcache	0.369s
ok  	github.com/carlosframework/platform/internal/awsinv	0.012s
ok  	github.com/carlosframework/platform/internal/boxchoice	0.013s
ok  	github.com/carlosframework/platform/internal/boxid	1.660s
?   	github.com/carlosframework/platform/internal/boxid/boxidtest	[no test files]
?   	github.com/carlosframework/platform/internal/boxid/internal/signtest	[no test files]
ok  	github.com/carlosframework/platform/internal/boxvolumes	0.037s
ok  	github.com/carlosframework/platform/internal/caps	0.100s
ok  	github.com/carlosframework/platform/internal/certwarm	0.005s
ok  	github.com/carlosframework/platform/internal/cgroup	1.321s
ok  	github.com/carlosframework/platform/internal/changelog	1.338s
ok  	github.com/carlosframework/platform/internal/claimactivation	2.330s
ok  	github.com/carlosframework/platform/internal/clamd	0.055s
?   	github.com/carlosframework/platform/internal/cliflag	[no test files]
?   	github.com/carlosframework/platform/internal/controlname	[no test files]
?   	github.com/carlosframework/platform/internal/controlsock	[no test files]
ok  	github.com/carlosframework/platform/internal/dbdoor	8.129s
ok  	github.com/carlosframework/platform/internal/dbdoor/dbdoortest	0.016s
ok  	github.com/carlosframework/platform/internal/dbquery	0.006s
ok  	github.com/carlosframework/platform/internal/dbreads	2.904s
?   	github.com/carlosframework/platform/internal/dbreads/dbreadstest	[no test files]
ok  	github.com/carlosframework/platform/internal/dbverify	0.005s
ok  	github.com/carlosframework/platform/internal/dnsrec	0.010s
ok  	github.com/carlosframework/platform/internal/docsite	0.008s
ok  	github.com/carlosframework/platform/internal/domains	5.691s
ok  	github.com/carlosframework/platform/internal/doorkey	0.010s
ok  	github.com/carlosframework/platform/internal/economics	0.004s
ok  	github.com/carlosframework/platform/internal/edge	50.661s
?   	github.com/carlosframework/platform/internal/edgeproof	[no test files]
ok  	github.com/carlosframework/platform/internal/edgesfile	0.015s
ok  	github.com/carlosframework/platform/internal/fleetapi	0.526s
ok  	github.com/carlosframework/platform/internal/gate	2.108s
ok  	github.com/carlosframework/platform/internal/genselect	0.020s
ok  	github.com/carlosframework/platform/internal/geo	0.084s
ok  	github.com/carlosframework/platform/internal/geoip	0.137s
ok  	github.com/carlosframework/platform/internal/historyreadback	0.886s
ok  	github.com/carlosframework/platform/internal/host	152.426s
ok  	github.com/carlosframework/platform/internal/hostactors	10.457s
ok  	github.com/carlosframework/platform/internal/hostactors/awsmembership	0.006s
ok  	github.com/carlosframework/platform/internal/hostbox	5.427s
ok  	github.com/carlosframework/platform/internal/hostclaim	2.714s
ok  	github.com/carlosframework/platform/internal/hostenv	0.010s
ok  	github.com/carlosframework/platform/internal/hostevidence	0.018s
ok  	github.com/carlosframework/platform/internal/hostexec	11.423s
ok  	github.com/carlosframework/platform/internal/hostfence	0.122s
ok  	github.com/carlosframework/platform/internal/hostfiles	12.335s
ok  	github.com/carlosframework/platform/internal/hostfloor	0.062s
ok  	github.com/carlosframework/platform/internal/hostguard	1.099s
ok  	github.com/carlosframework/platform/internal/hostops	5.438s
?   	github.com/carlosframework/platform/internal/hostops/fencerelease	[no test files]
ok  	github.com/carlosframework/platform/internal/hostops/internal/fencerelease	0.006s
ok  	github.com/carlosframework/platform/internal/hostquarantine	0.004s
ok  	github.com/carlosframework/platform/internal/hostrelocate	2.349s
ok  	github.com/carlosframework/platform/internal/hostresolve	0.529s
ok  	github.com/carlosframework/platform/internal/hostwrite	0.011s
ok  	github.com/carlosframework/platform/internal/infraview	0.004s
ok  	github.com/carlosframework/platform/internal/instancectl	5.324s
ok  	github.com/carlosframework/platform/internal/instanceexec	3.842s
ok  	github.com/carlosframework/platform/internal/instancefs	0.049s
ok  	github.com/carlosframework/platform/internal/instancekey	0.004s
ok  	github.com/carlosframework/platform/internal/instanceupdates	0.015s
ok  	github.com/carlosframework/platform/internal/layout	3.488s
ok  	github.com/carlosframework/platform/internal/lbhealth	0.047s
ok  	github.com/carlosframework/platform/internal/lease	10.302s
ok  	github.com/carlosframework/platform/internal/lease/leasetest	1.389s
ok  	github.com/carlosframework/platform/internal/ledger	0.086s
ok  	github.com/carlosframework/platform/internal/mail	0.951s
ok  	github.com/carlosframework/platform/internal/maintenance	0.101s
ok  	github.com/carlosframework/platform/internal/maintenanceexec	6.586s
ok  	github.com/carlosframework/platform/internal/maintenanceguard	0.119s
ok  	github.com/carlosframework/platform/internal/metrics	0.012s
ok  	github.com/carlosframework/platform/internal/moves	29.850s
ok  	github.com/carlosframework/platform/internal/moves/archive	2.124s
ok  	github.com/carlosframework/platform/internal/objstore	0.734s
ok  	github.com/carlosframework/platform/internal/ops	0.310s
ok  	github.com/carlosframework/platform/internal/park	0.786s
ok  	github.com/carlosframework/platform/internal/plans	0.011s
ok  	github.com/carlosframework/platform/internal/privatefile	0.003s
ok  	github.com/carlosframework/platform/internal/provision	24.451s
ok  	github.com/carlosframework/platform/internal/publicrelease	0.010s
?   	github.com/carlosframework/platform/internal/regionname	[no test files]
ok  	github.com/carlosframework/platform/internal/registry	8.255s
ok  	github.com/carlosframework/platform/internal/relay	7.318s
ok  	github.com/carlosframework/platform/internal/release	35.588s
ok  	github.com/carlosframework/platform/internal/rollout	5.718s
ok  	github.com/carlosframework/platform/internal/rolloutwords	0.006s
ok  	github.com/carlosframework/platform/internal/rootaws	0.020s
ok  	github.com/carlosframework/platform/internal/rootparticipation	0.077s
ok  	github.com/carlosframework/platform/internal/rootstate	0.033s
ok  	github.com/carlosframework/platform/internal/runs	1.168s
ok  	github.com/carlosframework/platform/internal/s3compat	0.005s
ok  	github.com/carlosframework/platform/internal/safefile	0.004s
ok  	github.com/carlosframework/platform/internal/schedule	3.881s
ok  	github.com/carlosframework/platform/internal/seeds	0.017s
ok  	github.com/carlosframework/platform/internal/sim/engines	6.620s
ok  	github.com/carlosframework/platform/internal/sim/hostlife	25.468s
ok  	github.com/carlosframework/platform/internal/sim/litestreamfacts	3.692s
ok  	github.com/carlosframework/platform/internal/status	0.186s
ok  	github.com/carlosframework/platform/internal/steering	0.008s
ok  	github.com/carlosframework/platform/internal/stopevidence	0.427s
ok  	github.com/carlosframework/platform/internal/svcrole	0.004s
ok  	github.com/carlosframework/platform/internal/telemetry	0.004s
ok  	github.com/carlosframework/platform/internal/termfence	0.086s
ok  	github.com/carlosframework/platform/internal/tunnelclient	0.071s
ok  	github.com/carlosframework/platform/internal/unixdial	0.002s
ok  	github.com/carlosframework/platform/internal/updatewords	0.004s
ok  	github.com/carlosframework/platform/internal/usage	0.005s
ok  	github.com/carlosframework/platform/internal/version	0.001s
ok  	github.com/carlosframework/platform/internal/vet	1.909s
=== internal_console@0 (93 s)
ok  	github.com/carlosframework/platform/internal/console	88.685s
=== internal_console@1 (48 s)
ok  	github.com/carlosframework/platform/internal/console	43.890s
=== internal_console@2 (52 s)
ok  	github.com/carlosframework/platform/internal/console	48.377s
=== internal_console@3 (54 s)
ok  	github.com/carlosframework/platform/internal/console	50.286s
=== internal_console@4 (52 s)
ok  	github.com/carlosframework/platform/internal/console	47.321s
=== internal_console@5 (47 s)
ok  	github.com/carlosframework/platform/internal/console	42.260s
=== internal_console@6 (53 s)
ok  	github.com/carlosframework/platform/internal/console	47.726s
=== internal_console@7 (55 s)
ok  	github.com/carlosframework/platform/internal/console	50.023s
=== root@0 (116 s)
ok  	github.com/carlosframework/platform	112.804s
=== root@1 (108 s)
ok  	github.com/carlosframework/platform	105.203s
=== root@2 (87 s)
ok  	github.com/carlosframework/platform	83.386s
=== cross ===
--- shard 0 of 5 ---
cross-compiling darwin/arm64
--- shard 1 of 5 ---
cross-compiling darwin/amd64
--- shard 2 of 5 ---
cross-compiling linux/arm64
linux/arm64 carlos binary: 50725026 bytes (ceiling 52000000)
--- shard 3 of 5 ---
cross-compiling windows/amd64
--- shard 4 of 5 ---
cross-compiling windows/arm64
=== minio-contract ===
minio contract: arm64, minio RELEASE.2025-09-07T16-13-09Z, mc RELEASE.2025-08-13T08-35-41Z
  minio: cached, digest verified
  mc: cached, digest verified
  minio healthy on 127.0.0.1:20999
Added `local` successfully.
Bucket created successfully `local/contract-bucket`.
Bucket created successfully `local/denied-bucket`.
Created policy `contract-only` successfully.
Added user `scopeduser` successfully.
Attached Policies: [contract-only]
To User: scopeduser
  buckets and scoped user ready
=== RUN   TestDeliveredContractMinio
=== RUN   TestDeliveredContractMinio/put
=== RUN   TestDeliveredContractMinio/get_round-trips_the_body
=== RUN   TestDeliveredContractMinio/list_shows_the_key
=== RUN   TestDeliveredContractMinio/head_and_list_agree_on_the_version
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_its_own_object
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/not_by_PutObjectTagging
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/and_not_by_x-amz-tagging_on_upload
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CreateMultipartUpload
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CopyObject_with_a_REPLACE_tagging_directive
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/but_multipart_itself_is_allowed
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_copy_itself_is_allowed
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/a_POST-policy_forged_tag_with_a_matching_version_is_still_not_a_verdict
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_an_ordinary_tagged-with-something-else_upload_is_allowed
=== RUN   TestDeliveredContractMinio/delete_removes_it
=== RUN   TestDeliveredContractMinio/cross-bucket_denial
--- PASS: TestDeliveredContractMinio (0.02s)
    --- PASS: TestDeliveredContractMinio/put (0.00s)
    --- PASS: TestDeliveredContractMinio/get_round-trips_the_body (0.00s)
    --- PASS: TestDeliveredContractMinio/list_shows_the_key (0.00s)
    --- PASS: TestDeliveredContractMinio/head_and_list_agree_on_the_version (0.00s)
    --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/not_by_PutObjectTagging (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/and_not_by_x-amz-tagging_on_upload (0.00s)
    --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route (0.01s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CreateMultipartUpload (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CopyObject_with_a_REPLACE_tagging_directive (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/but_multipart_itself_is_allowed (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_copy_itself_is_allowed (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/a_POST-policy_forged_tag_with_a_matching_version_is_still_not_a_verdict (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_an_ordinary_tagged-with-something-else_upload_is_allowed (0.00s)
    --- PASS: TestDeliveredContractMinio/delete_removes_it (0.00s)
    --- PASS: TestDeliveredContractMinio/cross-bucket_denial (0.00s)
PASS
ok  	github.com/carlosframework/platform/internal/objstore	0.023s
=== RUN   TestT4StorageProbeMinio
2026/10/25 00:42:42 moves: T4: STORE: list: operation error S3: ListObjectsV2, https response error StatusCode: 403, RequestID: 18E19F031349C0F2, HostID: 7c420053e0fbcd7f41653fdd92ffa2802c903d05303b1aa15adc2e8bb65d183f, api error SignatureDoesNotMatch: The request signature we calculated does not match the signature you provided. Check your key and signing method.
--- PASS: TestT4StorageProbeMinio (0.00s)
PASS
ok  	github.com/carlosframework/platform/internal/host	0.021s
=== RUN   TestS3StoreMinioContract
=== RUN   TestS3StoreMinioContract/conditional_get_and_etag_listing
=== RUN   TestS3StoreMinioContract/bump_through_every_mutation_path
--- PASS: TestS3StoreMinioContract (0.02s)
    --- PASS: TestS3StoreMinioContract/conditional_get_and_etag_listing (0.01s)
    --- PASS: TestS3StoreMinioContract/bump_through_every_mutation_path (0.01s)
PASS
ok  	github.com/carlosframework/platform/internal/release	0.029s
Bucket created successfully `local/dbf-deploy`.
Bucket created successfully `local/dbf-data-ie`.
Bucket created successfully `local/dbf-data-uk`.
local/dbf-deploy versioning is enabled
Created policy `dbf-console` successfully.
Created policy `dbf-ukbox` successfully.
Added user `dbfconsole` successfully.
Added user `dbfukbox` successfully.
Attached Policies: [dbf-console]
To User: dbfconsole
Attached Policies: [dbf-ukbox]
To User: dbfukbox
=== RUN   TestDBForwardMinio
2026/10/25 00:42:44 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000000 txid.db=0000000000000001
2026/10/25 00:42:44 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000001 maxTXID=0000000000000001 size=720
2026/10/25 00:42:44 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000001
2026/10/25 00:42:44 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000002
2026/10/25 00:42:44 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000002 maxTXID=0000000000000002 size=370
2026/10/25 00:42:44 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000002 txid.db=0000000000000002
2026/10/25 00:42:44 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000002 txid.db=0000000000000003
2026/10/25 00:42:44 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000003 maxTXID=0000000000000003 size=454
2026/10/25 00:42:44 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000003 txid.db=0000000000000003
2026/10/25 00:42:44 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000000 txid.db=0000000000000001
2026/10/25 00:42:44 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000001 maxTXID=0000000000000001 size=720
2026/10/25 00:42:44 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000001
2026/10/25 00:42:44 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/25 00:42:44 console: could not notify member@example.com of a CLI token issue: keymail: lookup member@example.com: keymail: GET /api/federation/lookup?addr=member%40example.com&from=console%40127.0.0.1%3A41325: could not determine target mailbox
    agent.go:135: dbreads: dbr_yc3km4w7ofvo7ajtgll7lgcjgy: planned 3 files (1544 bytes) and restored to 3 in 9ms
    agent.go:135: dbreads: dbr_yc3km4w7ofvo7ajtgll7lgcjgy: output 5 bytes in 1 confirmed chunks in 1ms
2026/10/25 00:42:45 console: db read dbr_yc3km4w7ofvo7ajtgll7lgcjgy: relayed 1 chunks (102 bytes) in 1.003s, ended done
    agent.go:135: dbreads: dbr_pqcxuhc5oxic36zn2bmxkqx2si: planned 1 files (720 bytes) and restored to 1 in 7ms
    agent.go:135: dbreads: dbr_pqcxuhc5oxic36zn2bmxkqx2si: output 5 bytes in 1 confirmed chunks in 1ms
2026/10/25 00:42:46 console: db read dbr_pqcxuhc5oxic36zn2bmxkqx2si: relayed 1 chunks (102 bytes) in 1.003s, ended done
    agent.go:135: dbreads: dbr_tsjdsq4vbev6a2fvxt4526h3oa: planned 3 files (1544 bytes) and held through 3 in 8ms
    agent.go:135: dbreads: dbr_tsjdsq4vbev6a2fvxt4526h3oa: output 1544 bytes in 1 confirmed chunks in 1ms
2026/10/25 00:42:47 console: db read dbr_tsjdsq4vbev6a2fvxt4526h3oa: relayed 1 chunks (1641 bytes) in 1.003s, ended done
=== RUN   TestDBForwardMinio/by_disconnect
=== NAME  TestDBForwardMinio
    agent.go:135: dbreads: dbr_dfb5wpp6huush5r34xqnnecpka: planned 3 files (1544 bytes) and restored to 3 in 9ms
2026/10/25 00:42:47 console: db read dbr_dfb5wpp6huush5r34xqnnecpka: relayed 0 chunks (0 bytes) in 22ms, ended client gone
    agent.go:135: dbreads: dbr_dfb5wpp6huush5r34xqnnecpka: output 5 bytes in 1 confirmed chunks in 102ms
=== RUN   TestDBForwardMinio/by_timeout
=== NAME  TestDBForwardMinio
    agent.go:135: dbreads: dbr_xediaieef7suuy5phlpwy3jwdy: planned 3 files (1544 bytes) and restored to 3 in 9ms
2026/10/25 00:43:07 console: db read dbr_xediaieef7suuy5phlpwy3jwdy: relayed 0 chunks (0 bytes) in 19.157s, ended no-result
    agent.go:135: dbreads: dbr_xediaieef7suuy5phlpwy3jwdy: output 5 bytes in 1 confirmed chunks in 19.133s
--- PASS: TestDBForwardMinio (22.60s)
    --- PASS: TestDBForwardMinio/by_disconnect (0.23s)
    --- PASS: TestDBForwardMinio/by_timeout (19.27s)
PASS
ok  	github.com/carlosframework/platform/internal/console	22.619s
minio contract: PASS

diff --git a/docs/superpowers/plans/2026-10-21-instance-policy-1-foundation.md b/docs/superpowers/plans/2026-10-21-instance-policy-1-foundation.md

index 3a4e77b63..a17bef0d3 100644

--- a/docs/superpowers/plans/2026-10-21-instance-policy-1-foundation.md

+++ b/docs/superpowers/plans/2026-10-21-instance-policy-1-foundation.md

@@ -1108,8 +1108,8 @@ func TestALapsedWriterCannotOverwriteTheNextWritersRevoke(t *testing.T) {

**Interfaces:**

- Consumes: Task 8 (`policyWriter`, `policyAttempt`), Task 9 (`policyLock`), `release.AppPolicyKey`, `apppolicy.Delete`, `s.appMutation`, `claimEnrollmentContext` (`claim_app_admission.go:189`) and `mutationAppID`'s enrollment branch (212-220).

-- Produces: `claimPolicyClearFailed` and `claimPolicyWriterRefused` (`claimOutcome`s); `type policyWriterRefused struct{ ref *doorRefusal }` (an `error`, so `createClaimAppRow` keeps its signature); `func (s *Server) clearAppPolicy(ctx context.Context, acct *Account, app string) error`: first a GET of `release.AppPolicyKey(acct.Sqid, app)`; **absent → return nil with no delete request** (Astra plan R5-1: deployments built from `infra/modules/region-host` deny `s3:DeleteObject` across the deployment bucket, `main.tf:669`, and `S3Store.deleteRaw` sends the request even for an absent key, `store.go:1236`, so an unconditional delete would break every create there); present → `s.appMutation(ctx, acct, app, "app-policy-clear", func(ctx) error { return apppolicy.Delete(ctx, s.cfg.Releases, acct.Sqid, app) })`, wrapped in `errAppPolicyClear` on failure (an access-denied delete included); `createClaimAppRow` keeps its signature.

-- Rules: purge deletes the policy before the marker, **best-effort on access denied** (a `s3:DeleteObject` Deny logs `release: purge %s/%s: policy object not deleted (%v); creating this name again will be refused until it is removed` and the purge continues; the create gate below is what stops inheritance), and otherwise as before (a purge that dies on any other error is retried by the next pass; covers the console's "Delete now" at `ownership.go:514` and the auto-purge at `domains/reconcile.go:271`). **Create never succeeds while a policy object at the key cannot be deleted, in every mode** (spec §3: "before the name is usable"; Astra plan R3-3). `createClaimAppRow` calls `clearAppPolicy` **before the row is inserted**, inside the exclusion below: with `HostClaim` off, right before the insert; with `HostClaim` on, after `EnrollNewApp` and `claimEnrollmentContext`, with the enrollment context, whose identity `mutationAppID` already answers before the row exists, so the boundary admits the app-scoped delete (Task 6), and before `withAutoAppSQL("sql.CreateApp")`. **The clear runs inside policy publication's exclusion** (Astra plan R4-1): a create that passed `claimAppWith`'s `HasAppIn` check may have paused while another create took the name and an operator granted its policy, so clearing on that stale check would delete the winner's policy. `createClaimAppRow`, in every mode and first thing, takes `s.policyLock(acct.Sqid, app)` and holds it until it returns (through the clear and the row insert), then `hold, ref := s.policyWriter(ctx)` (lazy acquisition, as a door write does; sole without a bucket); a refusal returns `policyWriterRefused{ref}`, before any enrollment, delete or insert. Then (under claims, after `EnrollNewApp` and `claimEnrollmentContext`) it rechecks `s.store.HasAppIn(acct.ID, app)`: a row → `false, nil` (`claimTaken`, nothing deleted); a lookup error → returned as the insert's error is. Then `actx, cancel, ref := s.policyAttempt(ctx, hold)` (the enrollment context under claims), and `clearAppPolicy(actx, ...)`; a refusal, or `actx` ending, counts as a failed clear. The insert follows under the same lock, with the request's (or enrollment) context. A failed clear (a store error, the boundary refusing, or the holding lost) inserts no row and returns `errAppPolicyClear`; `claimAppWith` maps it to `claimPolicyClearFailed`, and `policyWriterRefused` (via `errors.As`) to `claimPolicyWriterRefused`, returning the refusal's message as its second value (documented on `claimAppWith`: for that outcome the second value is the message, not a placement). The CLI create door and `/new-temporary` answer `claimPolicyWriterRefused` with 503 and that message (Task 8's `policyLeaseHeldMsg`, naming the holder, or `policyLeaseUnavailableMsg` / `policyLeaseMissingMsg`), the browser door flashes it; one console per bucket is the norm (ruling 10), so this is the second-console case only. The PUT door (Task 9 step 7) and the re-sign take the same lock, so a policy for this name can only be written once a row exists, and the recheck sees that row. An enrollment left with no row is the state an insert failure after `EnrollNewApp` leaves today, so a retry takes that existing path. The doors answer `claimPolicyClearFailed` as retryable: the CLI create door and `/new-temporary` 503 `appCreatePolicyClearMsg`, the browser door the flash `appCreatePolicyClearFlash`. A retry of the create re-runs the clear. Applies to the owner's adopt-existing case too. Task 9 step 7's `AppID` rule stays, for an object an older console's create left (spec §3 "Older consoles"); nothing here reads `app_id` on a box.

+- Produces: `claimPolicyClearFailed` and `claimPolicyWriterRefused` (`claimOutcome`s); `type policyWriterRefused struct{ ref *doorRefusal }` (an `error`, so `createClaimAppRow` keeps its signature); `func (s *Server) clearAppPolicy(ctx context.Context, acct *Account, app string) error`: first a GET of `apppolicy.Key(acct.Sqid, app)` (through `apppolicy`, so Task 6's source test, which allows `release.AppPolicyKey` in three files only, stays as it is, Astra plan R6-3); **absent → return nil with no delete request** (Astra plan R5-1: deployments built from `infra/modules/region-host` deny `s3:DeleteObject` across the deployment bucket, `main.tf:669`, and `S3Store.deleteRaw` sends the request even for an absent key, `store.go:1236`, so an unconditional delete would break every create there); present → `s.appMutation(ctx, acct, app, "app-policy-clear", func(ctx) error { return apppolicy.Delete(ctx, s.cfg.Releases, acct.Sqid, app) })`, wrapped in `errAppPolicyClear` on failure (an access-denied delete included); `createClaimAppRow` keeps its signature.

+- Rules: purge deletes the policy before the marker **only when the key is present** (a GET first; confirmed absence sends no delete, so a purge of an app that never had a policy is unaffected by the `s3:DeleteObject` Deny). A present policy whose delete fails, access denied included, fails the purge with the marker kept, so the next pass retries it once permissions allow (spec §3, Astra plan R6-2); the error is logged as `release: purge %s/%s: policy object %s not deleted (%v); the purge retries until it can be removed` (a purge that dies on any other error is retried by the next pass the same way; covers the console's "Delete now" at `ownership.go:514` and the auto-purge at `domains/reconcile.go:271`). **Create never succeeds while a policy object at the key cannot be deleted, in every mode** (spec §3: "before the name is usable"; Astra plan R3-3). `createClaimAppRow` calls `clearAppPolicy` **before the row is inserted**, inside the exclusion below: with `HostClaim` off, right before the insert; with `HostClaim` on, after `EnrollNewApp` and `claimEnrollmentContext`, with the enrollment context, whose identity `mutationAppID` already answers before the row exists, so the boundary admits the app-scoped delete (Task 6), and before `withAutoAppSQL("sql.CreateApp")`. **The clear runs inside policy publication's exclusion** (Astra plan R4-1): a create that passed `claimAppWith`'s `HasAppIn` check may have paused while another create took the name and an operator granted its policy, so clearing on that stale check would delete the winner's policy. `createClaimAppRow`, in every mode and first thing, takes `s.policyLock(acct.Sqid, app)` and holds it until it returns (through the clear and the row insert), then `hold, ref := s.policyWriter(ctx)` (lazy acquisition, as a door write does; sole without a bucket); a refusal returns `policyWriterRefused{ref}`, before any enrollment, delete or insert. Then (under claims, after `EnrollNewApp` and `claimEnrollmentContext`) it rechecks `s.store.HasAppIn(acct.ID, app)`: a row → `false, nil` (`claimTaken`, nothing deleted); a lookup error → returned as the insert's error is. Then `actx, cancel, ref := s.policyAttempt(ctx, hold)` (the enrollment context under claims), and `clearAppPolicy(actx, ...)`; a refusal, or `actx` ending, counts as a failed clear. The insert follows under the same lock, with the request's (or enrollment) context. A failed clear (a store error, the boundary refusing, or the holding lost) inserts no row and returns `errAppPolicyClear`; `claimAppWith` maps it to `claimPolicyClearFailed`, and `policyWriterRefused` (via `errors.As`) to `claimPolicyWriterRefused`, returning the refusal's message as its second value (documented on `claimAppWith`: for that outcome the second value is the message, not a placement). The CLI create door and `/new-temporary` answer `claimPolicyWriterRefused` with 503 and that message (Task 8's `policyLeaseHeldMsg`, naming the holder, or `policyLeaseUnavailableMsg` / `policyLeaseMissingMsg`), the browser door flashes it; one console per bucket is the norm (ruling 10), so this is the second-console case only. The PUT door (Task 9 step 7) and the re-sign take the same lock, so a policy for this name can only be written once a row exists, and the recheck sees that row. An enrollment left with no row is the state an insert failure after `EnrollNewApp` leaves today, so a retry takes that existing path. The doors answer `claimPolicyClearFailed` as retryable: the CLI create door and `/new-temporary` 503 `appCreatePolicyClearMsg`, the browser door the flash `appCreatePolicyClearFlash`. A retry of the create re-runs the clear. Applies to the owner's adopt-existing case too. Task 9 step 7's `AppID` rule stays, for an object an older console's create left (spec §3 "Older consoles"); nothing here reads `app_id` on a box.

Copy (Task 15): `appCreatePolicyClearMsg` = `an earlier app's settings under this name could not be cleared, so nothing was created. Try again, or ask an operator to delete %s from the deployment bucket`; `appCreatePolicyClearFlash` = `Could not clear an earlier app's settings under this name, so nothing was created. Please try again.`

@@ -1126,9 +1126,12 @@ func TestCreateRefusedWhenAPredecessorPolicyCannotBeDeleted(t *testing.T) {

// the message names the key), no app row, the object still there

}

// trash_test.go

-func TestPurgeContinuesWhenThePolicyDeleteIsDenied(t *testing.T) {

- // access-denied Delete for the policy key only: PurgeApp completes, the marker is removed,

- // the policy object remains, and the log line names it

+func TestPurgeKeepsTheMarkerWhenThePolicyDeleteIsDenied(t *testing.T) {

+ // access-denied Delete for the policy key only: PurgeApp errors, the marker is kept, the policy remains;

+ // permissions restored: a second PurgeApp deletes the policy, then the marker

+func TestPurgeOfAnAppWithNoPolicySendsNoPolicyDelete(t *testing.T) {

+ // no object at the key, a store whose Delete of that key always fails: PurgeApp completes

}

// trash_test.go, beside TestPurgeAppSweepsTheAppsLedgers

func TestPurgeAppSweepsThePolicyBeforeTheMarker(t *testing.T) {

@@ -1383,3 +1386,10 @@ All three findings' citations were checked against the code and hold: `server.go

| Finding | Change |

|---|---|

| R5-1 create blocked by the region-host `s3:DeleteObject` Deny | Task 11: `clearAppPolicy` GETs first and sends no delete for an absent key; a present key that cannot be deleted refuses the create, naming it; purge treats a denied policy delete as logged best-effort. Tests: `TestCreateWithNoPolicySendsNoDelete`, `TestCreateRefusedWhenAPredecessorPolicyCannotBeDeleted`, `TestPurgeContinuesWhenThePolicyDeleteIsDenied`. The Deny itself is an infra matter (it also caused the lease-release outage) left to its own thread. |

+## Review dispositions (Astra plan R6)

+| Finding | Change |

+|---|---|

+| R6-2 best-effort purge delete loses the retry | Task 11: purge GETs first; absent sends no delete; a present policy that cannot be deleted fails the purge and keeps the marker, so it retries. Tests `TestPurgeKeepsTheMarkerWhenThePolicyDeleteIsDenied`, `TestPurgeOfAnAppWithNoPolicySendsNoPolicyDelete` (replaces R5's best-effort test). |

+| R6-3 the create helper broke Task 6's source test | Task 11: the helper reads through `apppolicy.Key`. |

diff --git a/docs/superpowers/plans/2026-10-21-instance-policy-3-sizes.md b/docs/superpowers/plans/2026-10-21-instance-policy-3-sizes.md

index 6aaa02f99..76e5688b9 100644

--- a/docs/superpowers/plans/2026-10-21-instance-policy-3-sizes.md

+++ b/docs/superpowers/plans/2026-10-21-instance-policy-3-sizes.md

@@ -350,7 +350,7 @@ under a.mu:

if settled { clear e.ops.sizeUnsettled; if e.gen.N == g.N { e.gen.Tier = Limit{rb.UnitMemoryMax, or rb.SliceMemoryMax when unit == 0} } } // R2-1: from read-back, never from the request

else { e.ops.sizeUnsettled = true }

e.sizeSeen, e.route.Size = fresh.Size, fresh.Size; clear dirty

- errors.Is(err, ErrSizeRefused) or errSizeNotLive: clear dirty and record sizeSeen (nothing written; the change waits for the next start); sizeUnsettled UNCHANGED: a refusal proves nothing about the limits already on the host

+ errors.Is(err, ErrSizeRefused) or errSizeNotLive: clear dirty and record sizeSeen AND set e.route.Size = fresh.Size (nothing written; the change waits for the next start, and the next start, including an overlap swap's successor at swap.go:482, must size from it, Astra plan R6-1); e.gen.Tier and sizeUnsettled UNCHANGED: a refusal proves nothing about the limits already on the host

any other error: e.ops.sizeUnsettled = true (slice may be written; no swap starts until a write settles it)

clear resizing; close(resizeDone)

```

@@ -374,6 +374,10 @@ func TestLiveGrowthWithGenerationsOffUsesTheRunTemplate(t *testing.T)

func TestLiveChangeWaitsForTheSwapToRestore(t *testing.T)

// swap held mid-overlap (genGate); NoteSize; sweep: no size event; release the swap;

// next sweep: exactly one size event, after the restore event.

+func TestARefusedLiveResizeStillReachesTheNextSwap(t *testing.T) {

+ // flat instance, route Size standard; operator sets xlarge; ReadSize -> errSizeNotLive

+ // then an overlap swap: the successor starts at 2 GiB (raise incumbent + 2 GiB), not 512 MiB

func TestSwapRefusedWhileResizingOrUnsettled(t *testing.T)

// fake ResizeLive returns a 502-style error -> SizeState.Unsettled; Swap -> errSwapBusy (abandoned);

// next sweep with no operator change: readsize and size are sent again; a read-back with slice == unit

@@ -678,3 +682,9 @@ Spec coverage: §5.5's refusal now covers every box an app can be placed on, not

| Ruling 9 | No change: sizes under claims already wait for the next start. |

| Ruling 11, spec §3a | Global Constraints state the budget; Task 8's `TestSizesAddNoBoxStoreRequests` pins that `mem_total_mib` adds no request. |

| Census (#369) | Task 13 uses the approval flow; the new root units are decision rows written by hand and ruled on #280. |

+## Review dispositions (Astra plan R6)

+| Finding | Change |

+|---|---|

+| R6-1 a refused live resize never reaches a flat overlap swap | Task 6: the refusal arm updates `e.route.Size` too, leaving the captured tier and `unsettled` alone. Test `TestARefusedLiveResizeStillReachesTheNextSwap`. |

diff --git a/docs/superpowers/plans/CODEX-FINDINGS-instance-policy-plans-R6.md b/docs/superpowers/plans/CODEX-FINDINGS-instance-policy-plans-R6.md

new file mode 100644

index 000000000..875d3f5e4

--- /dev/null

+++ b/docs/superpowers/plans/CODEX-FINDINGS-instance-policy-plans-R6.md

@@ -0,0 +1,9 @@

+R5-1 — RESOLVED: creation skips deletion for an absent policy and still refuses when an existing policy cannot be cleared.

+1. **P1 — Plan 3, Tasks 4 and 6: deferred size changes never reach flat overlap swaps.** The refusal arm at [Sizes:353](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/instance-egress-sizes-328-329/docs/superpowers/plans/2026-10-21-instance-policy-3-sizes.md:353) advances `sizeSeen` but leaves `e.route.Size` unchanged. For a flat instance changed from standard to xlarge, `ReadSize` returns `errSizeNotLive`; subsequent passes skip the already-seen value. An overlap swap then takes the stale route at [swap.go:482](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/instance-egress-sizes-328-329/internal/activator/swap.go:482) and computes its successor’s tier from it. New generations continue starting at standard. **Smallest fix:** update the cached desired `e.route.Size` on the refusal path too, preserving the captured tier and unsettled flag. Test a refused live resize followed by a flat overlap swap.

+2. **P2 — Plan 1, Task 11: best-effort policy deletion removes the purge’s retry mechanism.** [Foundation:1112](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/instance-egress-sizes-328-329/docs/superpowers/plans/2026-10-21-instance-policy-1-foundation.md:1112) continues after access denied, leaving the policy while removing the tombstone. This contradicts [spec:179](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/instance-egress-sizes-328-329/docs/superpowers/specs/2026-10-21-instance-sizes-and-egress-design.md:179), which requires deletion before the marker so failed cleanup retries. Once the marker is gone, automatic purge cannot retry even after permissions recover; the create-time refusal prevents inheritance but does not complete cleanup. **Smallest fix:** skip deletion only on confirmed absence; otherwise propagate deletion failures and retain the marker.

+3. **P2 — Plan 1, Tasks 6 and 11: the new cleanup helper violates the prescribed source test.** [Foundation:1111](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/instance-egress-sizes-328-329/docs/superpowers/plans/2026-10-21-instance-policy-1-foundation.md:1111) calls `release.AppPolicyKey` from `internal/console/server.go`, but [Foundation:532](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/instance-egress-sizes-328-329/docs/superpowers/plans/2026-10-21-instance-policy-1-foundation.md:532) allows that call only in three other files. Implementing both instructions fails `TestPolicyWritersAreTheDoorThePurgeAndCreate`. **Smallest fix:** use `apppolicy.Key` for the helper’s read, or explicitly permit this read-only call site.

+REJECT

\ No newline at end of file