amadan
spec: region HA spec 1, Paul's rulings H7-H9 close the open questions
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 file changed,
+6
−11
docs/superpowers/specs/2026-10-04-region-ha-box-placement-design.md+6 −11
CI failed — run details
diff --git a/docs/superpowers/specs/2026-10-04-region-ha-box-placement-design.md b/docs/superpowers/specs/2026-10-04-region-ha-box-placement-design.md| index 4ddb77d47..3b1aa8c9d 100644 |
| --- a/docs/superpowers/specs/2026-10-04-region-ha-box-placement-design.md |
| +++ b/docs/superpowers/specs/2026-10-04-region-ha-box-placement-design.md |
| @@ -48,6 +48,9 @@ has. |
| | H4 | **Placement policy: capacity plus soft spread.** Among eligible boxes, choose the one with the most headroom. Prefer a box that runs no other instance of the same app, but never refuse placement for that reason. If no box is eligible, the instance waits as `unplaced` and an operator is alerted. (Spec 2.) | |
| | H5 | **Each region's minimum is configurable: 1 by default, 2 where HA is sold.** Scale-out is automatic on low headroom. Scale-in is automatic too, but only after the box has been drained into the region's other boxes. (Spec 4.) | |
| | H6 | **File durability follows the paid plan.** Continuous sync on the top plan, periodic snapshots on the bottom one. The platform exposes this as a per-app setting (§5.6) and Carloku maps its plans to it. Platform-managed files (`instance.key`, `report.token`, `<host>.env`) sync continuously on every plan. | |
| +| H7 | **Ticks are at-least-once.** A delivery that ran on a dead box but whose bookkeeping did not reach S3 may run again. Documented; apps that need exactly-once guard it themselves. | |
| +| H8 | **`files_durability` defaults to `snapshot`** for apps with no setting. | |
| +| H9 | **The reconcile sweep is 10 minutes** (§5.3). | |
| Standing rulings this spec keeps: |
| @@ -386,7 +389,7 @@ produce one, so HA5 needs them in S3 already. |
| `files_snapshot_interval`, default 15 minutes. |
| Carloku maps its plans to this (H6). Apps with no setting get |
| -`snapshot` (open question 2). |
| +`snapshot` (H8). |
| **Always continuous, whatever the setting:** `instance.key`, |
| `report.token`, `<host>.env`, `<host>-sidecar.env`, and the host's wake |
| @@ -463,8 +466,7 @@ succeeded. On install the new box imports the timer rows with |
| when the new executor imports it: the converger catches up from the |
| imported `next_at`, not from `Next(now)`. |
| - A delivery that ran on the dead box but whose bookkeeping did not reach |
| - S3 runs again. Ticks are documented as **at-least-once** (open |
| - question 1). |
| + S3 runs again. Ticks are documented as **at-least-once** (H7). |
| ### 5.8 Relocation |
| @@ -804,14 +806,7 @@ those specs finalise a one-box-per-region assumption. |
| ## 11. Open questions |
| -1. **Timers at-least-once (§5.7).** Is documenting ticks as |
| - at-least-once acceptable, or does a delivery need an idempotency key |
| - carried in the timer state? |
| -2. **`files_durability` default.** `snapshot` for apps with no setting, |
| - so existing apps pay nothing new until Carloku maps plans. Agreed? |
| -3. **The reconcile sweep (§5.3)** re-reads every kept host's claim every |
| - 10 minutes. A stray row is harmless (the activator refuses to spawn) |
| - but misroutes requests for up to that long. Shorter costs more GETs. |
| +None. Rev 4.2's three were ruled as H7, H8 and H9 (2026-10-04). |
| ## 12. Out of scope, for the later specs |