carlos / platform Public

Region HA spec 1 rev 5.4 and plan 1b: claim readers and evidence, dormant

Spec 1 restated against the host lifecycle claim (rev 6.25+), with Paul's
rulings H10-H19 (2026-10-06): automatic failover on a verified terminated
read alone; host-actors.json as the one roster; choose() for the executor;
no warm reuse of local copies (R6); a box-side reservation check;
automatic enrollment on evidence; a cross-region confirmer for emptied
regions; box-started relocations accept a console's last good report;
disk evidence only for discharging a dead box's cleanup chores. §9 asks
the claim and moves specs for L1-L20 (#236).

Plan 1b builds the parts that need none of L1-L20, all dormant behind
CARLOS_REGION_HA (strconv.ParseBool true, in /etc/carlos/host.env):
- boxid: the AWS-signed identity record is enrollment evidence
  (Verifier.Enroll, both binding directions, legacy tofu id).
- console: eligible boxes from the roster's proven cloud; the P5-D2 hash
  as the final tie-break; WarmCopyTrusted removed.
- agent: publishes its identity record once, under its label.
- termfence: the fence binds to the roster entry and a worker in the
  box's own region; terminated alone (H19).
- boxvolumes: running-time volume records and a fail-safe Discharge.
- edges file: a relocatable host is home only on its claim's executor,
  stamped with holder.stamp; bounded, deadline-limited claim reads.
- system update: root defers an update while the box takes part in a
  claim operation (update-begun marker, .hostexec scan).
- infra: control/boxes, box-volumes, box-enrollment and box-fences are
  create-only and never deleted; tofu test.

Relocation, reconcile row cases, create wiring and fence writes wait for
the claim; the plan lists each against its L-number.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Squashed from design-region-ha-rev5 into main.