amadan
docs: rehearsal runbook final fixes (approval gates, probe regions, customer switch, run order, evidence)
- I1: a "Paul's scoped go" step sits before each deployment change: the floor publish (P-3), the switch (P-7, after the copy record is fully approved), and Run 4's box stop. - I4: <pr-R>, the region moveprobe reports (home on a box with no CARLOS_REGION, else its placement code), is defined and used in R-1, R-3, R-7, the failure switch, and Runs 2 to 5; R-8's obligation region is the source box's CARLOS_REGION. - I5: customer runs get C-0 (copy approved, scoped go, switch on the console and the run's two participant boxes, verified) and C-6 (switch off, verified); Run 5's cleanup is verified too. - I6: Run 4 needs Runs 1 to 3; Runs 2 and 3 use the out-of-home arrangement when home fix part 2 has not landed. - Minor: Runs 6 and 7 attach the owner-approved health check's answers, not [report]. Sources rows added for each new fact.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 file changed,
+152
−51
docs/superpowers/plans/2026-10-06-moves-phase1-rehearsal.md+152 −51
diff --git a/docs/superpowers/plans/2026-10-06-moves-phase1-rehearsal.md b/docs/superpowers/plans/2026-10-06-moves-phase1-rehearsal.md| index bd43d8a5b..089ee4906 100644 |
| --- a/docs/superpowers/plans/2026-10-06-moves-phase1-rehearsal.md |
| +++ b/docs/superpowers/plans/2026-10-06-moves-phase1-rehearsal.md |
| @@ -7,7 +7,11 @@ instance, and one on a real customer instance. |
| **No run in this runbook can execute today.** Every run waits for P-0 |
| below. Each run also has its own blockers, listed at its top. Never run one |
| -without Paul's go in the amadan thread. |
| +without Paul's go in the amadan thread. Steps that change a deployment |
| +(publishing the floor, switching moves on, stopping a box) each have their |
| +own **Paul's scoped go** step just before them: a go in the amadan thread |
| +that names the deployment and exactly what the step changes. A go for one |
| +step or one run does not cover another. |
| The probe app is `moveprobe`. How to build it, ship it and use it is in |
| [`cmd/moveprobe/README.md`](../../../cmd/moveprobe/README.md). This runbook |
| @@ -34,6 +38,19 @@ The Sources section at the end gives file and line for each. |
| | `<profile>` | the deployment's named AWS profile. Always name one. There are no default credentials. | |
| | `<move>` | the move id the console gave the request (`id` in the flat view) | |
| | `<inc>` | the instance incarnation (`detail.move.incarnation`) | |
| +| `<pr-R>` | the region moveprobe reports on region R's box: `home` if that box has no `CARLOS_REGION` (its edges file has no `placement`), else its `CARLOS_REGION`, the placement code. `<pr-from>` and `<pr-to>` are the run's two. | |
| + |
| +### The probe's region is not always the region's name |
| + |
| +moveprobe reports the region its box gives it, not the name the CLI and |
| +the console use. On a home box, which has no `CARLOS_REGION`, it reports |
| +`home`, while `carlos move` still says `ie` (or whatever |
| +`CONSOLE_HOME_REGION` is). Before each deployment's first run, write down |
| +`<pr-R>` for every rehearsal region: read `CARLOS_REGION` in the box's |
| +`/etc/carlos/host.env`, or `placement` in its edges file, and confirm with |
| +[report]'s `region` and `region_from` on any moveprobe host there. Every |
| +[report] region check and every `MOVEPROBE_FAIL_READY_IN` value uses |
| +`<pr-R>`, never the CLI's name. |
| ### Read paths |
| @@ -243,6 +260,9 @@ lowers its local floor on its own. If dev keeps rolling SHA builds, dev's |
| runs go without a floor, and P-3 is done on the flagship only, before |
| Run 5 (§15 step 6). |
| +- [ ] **Paul's scoped go** in the amadan thread to publish the floor on |
| + this deployment, naming the deployment and `min_release`. Nothing below |
| + runs without it. |
| - [ ] Write it create-only from an operator shell. No `carlos` command |
| writes it (a gap to note on an amadan discussion). |
| @@ -330,8 +350,15 @@ Paul confirms each of these per deployment before its first run. |
| ### P-7 The switch |
| -- [ ] Only after P-0 to P-6: `CARLOS_MOVES_PHASE1=on` in the environment |
| - of the console and of each box in play, then restart them. |
| +- [ ] P-0 to P-6 are done for this deployment. |
| +- [ ] **The moves copy record is fully approved**: no row in |
| + `docs/superpowers/plans/2026-10-06-moves-phase1-copy.md` is `pending` |
| + (`grep -c '| pending |'` on it prints 0). The switch never goes on |
| + while a sentence an operator could read is unapproved. |
| +- [ ] **Paul's scoped go** in the amadan thread to switch moves on, naming |
| + the deployment, the console and the boxes. |
| +- [ ] `CARLOS_MOVES_PHASE1=on` in the environment of the console and of |
| + the boxes the go names, and nowhere else, then restart them. |
| - [ ] Check: `carlos move status --app moveprobe --account <ops> --host |
| <host>` does not say "Moves are not enabled on this console." |
| @@ -399,16 +426,16 @@ Runs refer to these by number. `<from>` and `<to>` are the run's regions. |
| ### Checks after a commit |
| -- **R-1 State arrived.** [report] on the target: `region` is `<to>`; |
| +- **R-1 State arrived.** [report] on the target: `region` is `<pr-to>`; |
| `file_key_sha256` and `platform_key_sha256` equal `before-cut.json`'s; |
| - `object` has no `error` and its `body` names this boot and `<to>`; |
| + `object` has no `error` and its `body` names this boot and `<pr-to>`; |
| `has_secret` is `true`. `curl https://<host>/ready` answers `ready`. |
| - **R-2 No row lost.** [report] for `bg` and for `worker`: the sum of |
| `count` over all regions is at least `before-cut.json`'s, and equals the |
| highest `max_seq` (rows are numbered from 1 in one sequence per kind, so |
| any gap shows here). |
| - **R-3 The schedule continues.** [report] `rows` has `kind: tick` with |
| - `region: <to>`, and its `count` rises about once a minute for three |
| + `region: <pr-to>`, and its `count` rises about once a minute for three |
| minutes after the open. Every `fired` entry has `count: 1`. A minute |
| that fell due while the instance was offline fires at most once after |
| the open, and minutes in between are not replayed, so a short gap |
| @@ -433,8 +460,9 @@ Runs refer to these by number. `<from>` and `<to>` are the run's regions. |
| ### Checks after a rollback (Runs 2, 3 and 4) |
| -R-1 to R-4 and R-6 apply as written, with `<from>` (the source, where the |
| -instance is back) in place of `<to>`. R-5 is replaced: |
| +R-1 to R-4 and R-6 apply as written, with the source (where the |
| +instance is back) in place of the target: `<pr-from>` in place of |
| +`<pr-to>` in R-1 and R-3. R-5 is replaced: |
| - **R-5b The target holds nothing live.** After [deploy] |
| `log/rolling_back-target-cleaned.json` and `log/rolled_back.json` exist: |
| @@ -442,8 +470,9 @@ instance is back) in place of `<to>`. R-5 is replaced: |
| `instances/<host>/` and under `moves/<host>/<move>/` returns no versions |
| and no delete markers. |
| - **R-7 The target's writes came back** (dirty rollbacks only). [report] |
| - on the source: `rows` has a `bg` row with `region: <to>`, written on the |
| - target while it ran there. |
| + on the source: `rows` has a `bg` row with `region: <pr-to>` (the |
| + target's probe region, `home` if the target is the home box), written |
| + on the target while it ran there. |
| - **R-8 The return lane is parked** (dirty rollbacks only). A dirty |
| rollback returns the target's writes through its own lane, |
| `moves/<host>/<rb>/` in the **source's** data bucket, where `<rb>` is |
| @@ -460,7 +489,8 @@ instance is back) in place of `<to>`. R-5 is replaced: |
| jq -s --arg loc "moves/<host>/<rb>" '[.[][] | select(.park.location == $loc)] | first' run-3-claim.jsonl |
| ``` |
| - It has `kind` `park-replica`, `region` `<from>`, an `id`, a |
| + It has `kind` `park-replica`, `region` set to the source box's |
| + `CARLOS_REGION` (absent when the source is the home box), an `id`, a |
| `retirement`, and `park` with `location`, `incarnation`, `evidence_at` |
| and `request_limit_ns`. Record `retirement` as `<ret>`, |
| `park.incarnation` as `<pinc>` and `park.evidence_at`. An empty answer |
| @@ -493,8 +523,11 @@ reached the stopped position). The target box logs both: |
| `CARLOS_AWS_ACCOUNT` on the dev console. |
| - [ ] Keep `carlos-dev-ie-b` ineligible: no `CARLOS_REGION_HA` in its |
| `host.env`, so `ie` has one eligible box (M-C21). |
| -- [ ] Create the dev rehearsal hosts (P-5) after `carlos-dev-uk` serves and |
| - before dev's claim goes on. |
| +- [ ] Decide Runs 2 and 3's arrangement (see "Runs 2 and 3: the |
| + regions"), then create the dev rehearsal hosts (P-5) after |
| + `carlos-dev-uk` serves and before dev's claim goes on: Run 1's and Run |
| + 4's in `ie`, Runs 2 and 3's in their arrangement's `<from>`, and two |
| + spares. |
| **Dev's home region.** Dev Ireland is probably the home region (its box |
| has no `CARLOS_REGION`). Confirm it with the dev console's |
| @@ -506,13 +539,20 @@ has no `CARLOS_REGION`). Confirm it with the dev console's |
| - Runs 2 and 3 as written (`uk` to `ie`) move into home and need **home |
| fix part 2**. The door refuses them until then. |
| - **Until part 2 lands, only out-of-home moves run.** Run 1 goes ahead on |
| - part 1. Runs 2 and 3 wait. If Paul wants them sooner, they can run out |
| - of home (`ie` to `uk`, with the failure switch on `uk`), which rolls back |
| - into a home source, as Run 4 does. Use that order, and run Run 4, only |
| - if part 1's own tests show it covers a rollback whose source is home. |
| - Part 1 is not built yet, so this is open. |
| -- On the home box, moveprobe sees its region as `home`, not `ie`. Any |
| - `MOVEPROBE_FAIL_READY_IN` aimed at that box names `home`. |
| + part 1. Runs 2 and 3 then use the **out-of-home arrangement**: the host |
| + is created in `ie`, the move goes `ie` to `uk`, and the failure switch |
| + names `<pr-uk>`. Each rolls back into a home source, as Run 4 does, so |
| + this needs part 1 to cover a rollback whose source is home. Check that |
| + in part 1's own tests first. Part 1 is not built yet, so this is open. |
| + If part 1 does not cover it, Runs 2, 3 and 4 all wait for the fix that |
| + does. |
| +- Run 4 runs only after Runs 2 and 3 have passed, in whichever |
| + arrangement they ran. No run is skipped. |
| +- On the home box, moveprobe reports `home`, so `<pr-ie>` is `home`. Any |
| + [report] check or `MOVEPROBE_FAIL_READY_IN` aimed at that box uses |
| + `home`, never `ie`. |
| + |
| +Record the dev probe regions here: `<pr-ie>` = `____`, `<pr-uk>` = `____`. |
| If `ie` is not home, the runs go as written and need no home fix. |
| @@ -533,27 +573,44 @@ to P-7 on dev; Paul's go. |
| `last.outcome` is `done`; `detail.timings` holds `offline_s` and |
| `cut_budget_s`. |
| +### Runs 2 and 3: the regions |
| + |
| +Runs 2 and 3 use one of two arrangements, chosen before the dev hosts are |
| +created (see "Dev's home region"): |
| + |
| +- **As written**: the host is created in `uk`, and the move goes `uk` to |
| + `ie`. Needs home fix part 2 if `ie` is home. |
| +- **Out of home** (`ie` is home and part 2 has not landed): the host is |
| + created in `ie`, and the move goes `ie` to `uk`. Needs part 1 to cover a |
| + rollback whose source is home. |
| + |
| +Below, `<from>` and `<to>` are the arrangement's regions as the CLI names |
| +them, and `<pr-from>`, `<pr-to>` their probe regions. Record the |
| +arrangement used in each run. |
| + |
| ### Run 2: dev, forced clean rollback |
| -**Blockers:** P-0; home fix **part 2** if `ie` is home (see above); Run 1 |
| +**Blockers:** P-0; the home fix its arrangement needs (above); Run 1 |
| passed; Paul's go. |
| The target fails its readiness check in before-write mode, so it writes |
| nothing and the rollback should be clean. |
| -- [ ] Host used: `____` (created in `uk` before the claim). |
| -- [ ] Before the request, set the switch for the target's region (`ie`, or |
| - `home` if `ie` is home): |
| +- [ ] Arrangement: `____`. Host used: `____` (created in `<from>` before |
| + the claim). |
| +- [ ] Before the request, set the failure switch to the target's probe |
| + region: |
| ```sh |
| - carlos env set --app moveprobe --account <ops> MOVEPROBE_FAIL_READY_IN=ie |
| + carlos env set --app moveprobe --account <ops> MOVEPROBE_FAIL_READY_IN=<pr-to> |
| ``` |
| The variable is app-wide. Any moveprobe instance that starts in that |
| region while it is set answers 503 and writes nothing. That is expected. |
| -- [ ] S-1, S-2 with `--to ie`, S-3, S-4 (capture first). [CLI] M-C8 ("ie |
| - could not start <host>: <reason>. Moving it back to uk."), then M-C9 |
| - ("<host> is back in uk and serving. Nothing was lost."), exit 3. |
| +- [ ] S-1, S-2 with `--to <to>`, S-3, S-4 (capture first). [CLI] M-C8 |
| + ("<to> could not start <host>: <reason>. Moving it back to <from>."), |
| + then M-C9 ("<host> is back in <from> and serving. Nothing was lost."), |
| + exit 3. |
| - [ ] From [capture], once the cut has returned and the capture has |
| stopped: the last rollback journal has `target_phase` `released` or |
| later, and `dirty` absent or `false`. Record its `id` as `<rb>`, and the |
| @@ -561,8 +618,9 @@ nothing and the rollback should be clean. |
| - [ ] Digests: [deploy] `stopped-target.json`'s `db_sha256`, `files_plain` |
| and `timers_sha256` equal `log/rolling_back-target-released.json`'s |
| fields `installed_db_sha256`, `files_plain` and `timers_sha256`. |
| -- [ ] [box] on the `ie` box: "clean true, src_covered true". |
| -- [ ] R-1 to R-4 and R-6 on `uk`, R-5b on `ie`. |
| +- [ ] [box] on the `<to>` box: "clean true, src_covered true". |
| +- [ ] R-1 to R-4 and R-6 on `<from>` (probe region `<pr-from>`), R-5b on |
| + `<to>`. |
| - [ ] [deploy] `log/` has `rolling_back`, `rolling_back-target-released`, |
| `rolling_back-target-cleaned`, `rolling_back-source-opened` and |
| `rolled_back`, and no `rolling_back-target-returning`. |
| @@ -577,20 +635,21 @@ finding, not a probe failure. Stop the series and report it. |
| ### Run 3: dev, forced dirty rollback |
| -**Blockers:** P-0; home fix **part 2** if `ie` is home; Run 2 passed; |
| +**Blockers:** P-0; the home fix its arrangement needs; Run 2 passed; |
| Paul's go. |
| The target writes one row, starts its worker, and then fails readiness, so |
| the rollback is dirty and the target's writes must come back. |
| -- [ ] Host used: `____` (created in `uk` before the claim). |
| +- [ ] Arrangement: `____`. Host used: `____` (created in `<from>` before |
| + the claim). |
| - [ ] Before the request: |
| ```sh |
| - carlos env set --app moveprobe --account <ops> MOVEPROBE_FAIL_READY_IN=ie,after-write |
| + carlos env set --app moveprobe --account <ops> MOVEPROBE_FAIL_READY_IN=<pr-to>,after-write |
| ``` |
| -- [ ] S-1, S-2 with `--to ie`, S-3, S-4, with the capture started with |
| +- [ ] S-1, S-2 with `--to <to>`, S-3, S-4, with the capture started with |
| its claim file: `capture <host> run-3-detail.jsonl run-3-claim.jsonl`. |
| [CLI] M-C8, then M-C9, exit 3. The cut's wait includes the return |
| lane's park horizon (R-8), about 17 minutes or more. |
| @@ -600,20 +659,22 @@ the rollback is dirty and the target's writes must come back. |
| - [ ] Digests: [deploy] `stopped-target.json`'s `db_sha256` differs from |
| `log/rolling_back-target-released.json`'s `installed_db_sha256` (the |
| target wrote). |
| -- [ ] [box] on the `ie` box: "clean false". |
| +- [ ] [box] on the `<to>` box: "clean false". |
| - [ ] [deploy] `log/` has `rolling_back-target-returning` and |
| `rolling_back-target-returned`, then `rolling_back-target-cleaned` and |
| `rolled_back`. |
| -- [ ] R-1 to R-4 and R-6 on `uk`, R-5b on `ie`, R-7, and R-8 on `uk` |
| - (the return lane `moves/<host>/<rb>/` in `<data-bucket-uk>`). |
| +- [ ] R-1 to R-4 and R-6 on `<from>` (probe region `<pr-from>`), R-5b on |
| + `<to>`, R-7 (a `bg` row with `region: <pr-to>`), and R-8 on `<from>` |
| + (the return lane `moves/<host>/<rb>/` in `<data-bucket-from>`). |
| - [ ] Unset `MOVEPROBE_FAIL_READY_IN` once the checks are recorded. |
| ### Run 4: dev, declare-lost |
| **Blockers:** P-0, including claim Plan 12's loss-bound admission and Plan |
| -4 Task 10's box half; home fix part 1 if `ie` is home; Run 1 passed (Runs 2 |
| -and 3 too, if part 2 has landed); Paul's go, and his agreement to take |
| -`carlos-dev-uk` out of service for the run. |
| +4 Task 10's box half; home fix part 1 if `ie` is home, covering a |
| +rollback whose source is home; **Runs 1, 2 and 3 passed** (Runs 2 and 3 |
| +in whichever arrangement they ran; Run 4 is never run ahead of them); |
| +Paul's go. |
| The target box is stopped mid-move and declared lost. With only two dev |
| regions, the target is `carlos-dev-uk`, and `uk` has no eligible box until |
| @@ -621,11 +682,14 @@ the readmit at the end. **Stop the box. Do not terminate it.** A terminated |
| box cannot be readmitted. |
| - [ ] Host used: `____` (created in `ie` before the claim). |
| +- [ ] **Paul's scoped go** in the amadan thread, before anything below, |
| + to stop `carlos-dev-uk` during this run and take it out of service |
| + until the readmit. |
| - [ ] So the landing cannot commit before the box stops, set the failure |
| switch on the target first: |
| ```sh |
| - carlos env set --app moveprobe --account <ops> MOVEPROBE_FAIL_READY_IN=uk |
| + carlos env set --app moveprobe --account <ops> MOVEPROBE_FAIL_READY_IN=<pr-uk> |
| ``` |
| Its probe then fails however long the stop takes. If the target finishes |
| @@ -659,7 +723,8 @@ box cannot be readmitted. |
| `log/rolled_back.json` exist. [deploy] the decoded roster: |
| `boxes.carlos-dev-uk.state` is `quarantined`, `quarantine_revision` is |
| one more than before, and `loss_ids` holds the loss. |
| -- [ ] R-1 to R-4 and R-6 on `ie`. |
| +- [ ] R-1 to R-4 and R-6 on `ie`, with probe region `<pr-ie>` (`home` if |
| + `ie` is home). |
| - [ ] Unset `MOVEPROBE_FAIL_READY_IN`. |
| - [ ] Start `carlos-dev-uk` again. It stays quarantined: the deployment's |
| admission gate refuses it for every host until the readmit. Watch [box] |
| @@ -703,14 +768,22 @@ applies); Paul's explicit go in the thread, for each of the three. |
| - **Regions** (N3): the flagship's home is Ireland, so Run 5 uses two |
| non-home regions, `uk` and `us`, until the home fix parts land. Run 1's |
| shape goes `uk` to `us`. Runs 2 and 3 go `us` to `uk`, with |
| - `MOVEPROBE_FAIL_READY_IN=uk` and `uk,after-write`. |
| + `MOVEPROBE_FAIL_READY_IN=<pr-uk>` and `<pr-uk>,after-write`. Record the |
| + flagship's probe regions: `<pr-uk>` = `____`, `<pr-us>` = `____`. |
| +- [ ] P-3 on the flagship, after its own scoped go. |
| +- [ ] P-7 on the flagship: the copy record fully approved, then Paul's |
| + scoped go naming the console and the `uk` and `us` boxes, then the |
| + switch on those three only. |
| - [ ] Hosts used: Run 1 shape `____` (created in `uk`), Run 2 shape `____` |
| and Run 3 shape `____` (created in `us`), all before the flagship's |
| claim went on. |
| - [ ] Each of the three as on dev, with every check. |
| - [ ] After the third, remove `CARLOS_MOVES_PHASE1` from the two boxes and |
| - the console unless Paul says to keep it. |
| + the console unless Paul says to keep it, and restart them. Check: |
| + `carlos move status --app moveprobe --account <ops> --host <host>` says |
| + "Moves are not enabled on this console.", and neither box's `host.env` |
| + still sets it. |
| --- |
| @@ -730,6 +803,18 @@ approves for the run. |
| ### Customer steps |
| +- **C-0 Switch on for this run only.** Run 5's switch was removed after |
| + it, and this run's participants differ (the source is the home box). |
| + - The moves copy record is fully approved (P-7). |
| + - **Paul's scoped go** in the amadan thread naming the flagship, this |
| + run, the console, and this run's two participant boxes: the source |
| + box in `<from>` (the instance's box now) and the target box in |
| + `<to>`. |
| + - `CARLOS_MOVES_PHASE1=on` in the environment of the console and of |
| + those two boxes, and nowhere else; restart them. |
| + - Check: `carlos move status --app <app> --account <account> --host |
| + <host>` does not say "Moves are not enabled on this console." [box] |
| + each of the two boxes' `host.env` sets it, and no other box's does. |
| - **C-1 Health check, before.** The owner names one health check for the |
| instance (a URL and the answer that means it is serving) and approves |
| it for the run. Record it in the deployment repo. Run it and record the |
| @@ -759,7 +844,15 @@ approves for the run. |
| `committed-source_parked` and `done`. |
| If the move rolls back (M-C8 then M-C9, exit 3), the instance is back in |
| -`<from>`: run C-4 there, then R-5b and R-6, and stop the series. |
| +`<from>`: run C-4 there, then R-5b and R-6, and stop the series. C-6 |
| +still applies. |
| + |
| +- **C-6 Switch off.** Once the run's checks are recorded, whatever its |
| + outcome: remove `CARLOS_MOVES_PHASE1` from the console and the two |
| + boxes, unless Paul says in the thread to keep it, and restart them. |
| + Check: `carlos move status --app <app> --account <account> --host |
| + <host>` says "Moves are not enabled on this console.", and [box] neither |
| + box's `host.env` sets it. |
| ### Run 6: a disposable customer-shaped instance |
| @@ -773,7 +866,7 @@ A disposable instance of a customer app with the same shape as moveprobe |
| owner's agreement, before the flagship's claim went on (P-5). |
| - [ ] Instance used: recorded in the deployment repo. |
| -- [ ] C-1 to C-5. |
| +- [ ] C-0 to C-6. |
| ### Run 7: the first production customer instance |
| @@ -785,7 +878,8 @@ with its owner. |
| - [ ] The instance was created before the flagship's claim went on, so it |
| is adopted at `instances/<host>` (P-5). One created later cannot move. |
| -- [ ] C-1 to C-5, with C-3 inside the agreed window. The cut window is the |
| +- [ ] C-0 to C-6, with C-3 inside the agreed window. Run 6's switch was |
| + removed at its C-6, so C-0 needs its own go. The cut window is the |
| default 120 s. |
| - [ ] Report `offline_s` back to the owner: [detail] `last.offline_s`, or |
| `offline_s` in `log/done.json`'s fields. |
| @@ -795,8 +889,10 @@ with its owner. |
| ## After every run |
| - [ ] Attach to the amadan thread: the `done` or `rolled_back` log entry |
| - (its timings), the [report] files from before and after, the bucket |
| - listings, and the host used. |
| + (its timings), the bucket listings, and the host used. For Runs 1 to 5, |
| + also the [report] files from before and after. For Runs 6 and 7, which |
| + never call `/report`, attach instead the owner-approved health check's |
| + answers from C-1 and C-4, and the owner's confirmation. |
| - [ ] A failed check stops the series. Fix its cause and repeat the run on |
| a fresh host before going on. |
| @@ -867,6 +963,7 @@ copy is `docs/superpowers/plans/2026-10-06-moves-phase1-copy.md`. |
| | the rollback's `id` | `internal/provision/provision.go:1068` | |
| | a dirty rollback's return lane is `moves/<host>/<rb>`, parked in the source's region, queued when the source has probed, horizon the return seal's bound | `internal/moves/parkscope.go:66-72`; `internal/host/movesrecover.go:658-675`; `internal/hostclaim/move.go:1093-1108` | |
| | a claim obligation's fields: `id`, `op`, `kind`, `region`, `retirement`, and `park` with `location`, `incarnation`, `evidence_at`, `request_limit_ns`; the claim's `obligations` list | `internal/hostclaim/claim.go:116-121`, `:137-147`, `:166` | |
| +| the return lane's obligation `region` is the source box's `CARLOS_REGION` (omitted when empty) | `internal/host/movesrecover.go:675`; `internal/host/movespass.go:206`; `internal/hostclaim/claim.go:144` | |
| | the claim at `control/hosts/<host>.json` is plain JSON, read as is | `internal/hostclaim/claim.go:178-182`; `internal/hostclaim/store.go:38-60` | |
| | the detail answer's claim view carries no obligations | `internal/console/apiinstancemove.go:1356-1362` | |
| | a rollback closes only when nothing is owed under its move; a finished park removes its obligation | `internal/host/movesrecover.go:805-809`; `internal/host/movesparks.go:134-142`; `internal/park/remote.go:568`; `internal/hostclaim/delete.go:83-98` | |
| @@ -913,6 +1010,8 @@ copy is `docs/superpowers/plans/2026-10-06-moves-phase1-copy.md`. |
| | `moves_protocol`, `moves_floor_min_release`, `prev_release`, `prev_allowed_for`, `data_bucket`, `secrets_key_fp` in the edges file at `control/edges/<box>.json` | `internal/host/edgesfile.go:218`, `:270`, `:295-304`; `internal/console/instancesplacement.go:22`, `:83-86` | |
| | `control/moves-console.json` and its `secrets_key_fp` | `internal/moves/floor.go:25-33` | |
| | the switch, `on`/`1`/`true`, default off | `internal/moves/switch.go:6-23` | |
| +| the copy record's `pending` rows keep the compiled default off; P-7 applies the same rule to the env switch (Paul's ruling) | `approved_moves_copy_test.go:811`; `docs/superpowers/plans/2026-10-06-moves-phase1-copy.md` | |
| +| with the switch off the CLI says "Moves are not enabled on this console." (the switch-off check in Run 5 and C-6) | `move.go:65`, `:240-243` | |
| | the copy gate keeps the default off while a row is pending | `approved_moves_copy_test.go:811` | |
| | the default cut window, 120 s | `internal/moves/budget.go:17` | |
| | `CARLOS_LAYOUT_DEFAULT=flat` | `internal/host/layoutleg.go:68-70`; `system.go:714` | |
| @@ -933,7 +1032,9 @@ copy is `docs/superpowers/plans/2026-10-06-moves-phase1-copy.md`. |
| |---|---| |
| | a held timer row is skipped while the instance moves | `internal/schedule/runner.go:190-197` | |
| | a periodic schedule's next fire is the next boundary after now (no replay) | `internal/schedule/spec.go:119-125` | |
| -| moveprobe's region is `home` with no `CARLOS_REGION` | `cmd/moveprobe/main.go:94-100` | |
| +| moveprobe's region is `home` with no `CARLOS_REGION`, else `CARLOS_REGION`; `/report` says which in `region_from` | `cmd/moveprobe/main.go:94-100` | |
| +| the failure switch matches the probe's own region, so it must name `<pr-R>` | `cmd/moveprobe/main.go:103-106`, `:137-138` | |
| +| a box's edges `placement` is its `CARLOS_REGION`, absent when unset (the home box) | `internal/host/edgesfile.go:205-211`, `:758` | |
| | `bg` and `worker` rows each numbered from 1 in one sequence | `cmd/moveprobe/main.go:543-550`, `:158`, `:674` | |
| | `/report`'s fields, `/arm-once`'s answer, the failure switch's modes | `cmd/moveprobe/README.md`, "Use it", "Make readiness fail on purpose" and "Strings" | |
| @@ -959,5 +1060,5 @@ copy is `docs/superpowers/plans/2026-10-06-moves-phase1-copy.md`. |
| |---|---| |
| | the runs and the pass rule | spec §14.4, spec:6263-6276 | |
| | the rollout order, the floor before any protected production rehearsal | spec §15, spec:6278-6294 | |
| -| each rehearsal gates the next, so Run 5 needs Run 4 | spec:6294; controller ruling, fix round 1 | |
| +| each rehearsal gates the next: Run 4 needs Runs 2 and 3, Run 5 needs Run 4 | spec:6294; controller rulings, fix round 1 and final review | |
| | the flagship's home is Ireland | spec:1032 | |