amadan
spec: moves into home (part 2), §2, §7.1, §16 F2
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 file changed,
+24
−7
docs/superpowers/specs/2026-10-02-move-any-app-design.md+24 −7
diff --git a/docs/superpowers/specs/2026-10-02-move-any-app-design.md b/docs/superpowers/specs/2026-10-02-move-any-app-design.md| index 60c7f61c8..02f610aa4 100644 |
| --- a/docs/superpowers/specs/2026-10-02-move-any-app-design.md |
| +++ b/docs/superpowers/specs/2026-10-02-move-any-app-design.md |
| @@ -1,8 +1,22 @@ |
| # Move any app or instance to another region: Phase 1, a safe single-instance move |
| **Date:** 2026-10-06 |
| -**Revision:** 7.23. |
| - |
| +**Revision:** 7.24. |
| + |
| +- **Rev 7.24** lets a move target the home region (moves into home, |
| + part 2; plan `docs/superpowers/plans/2026-10-15-moves-home-region-part2.md`, |
| + amadan #236). Phase 1 moves between two non-fleet placements, into home |
| + only with host claims on (§2). §7.1 refuses a target of home on a |
| + console without host claims, or a home whose box sets a region code of |
| + its own. §16 F2 records home as a target as delivered by that plan. |
| + Paul's rulings of 2026-10-15, decided: **R1**, home targets only under |
| + host claims; **R3**, `--to` takes the home's configured name, with no |
| + `home` keyword, and `carlos move back` stays a follow-on; **R5**, no |
| + protocol version bump (a home box without the new T3 fails T3 and waits, |
| + fail closed; boxes roll before consoles); **R7**, a home target may be |
| + the console's own box (the records and the claim are durable, so a box |
| + lost mid-landing delays recovery and loses nothing). R2(a) and R6 bind |
| + the rehearsal runbook, not this spec. |
| - **Rev 7.23** records Paul's ruling M4 (2026-10-10, moves Plan 5 delta |
| pre-flight after claim Plan 10): **every close is record first, then |
| the claim's release.** Rev 7.22 released the claim to `serving` first |
| @@ -1066,8 +1080,8 @@ key from it. |
| ## 2. Phase 1: what it does and what it refuses |
| Phase 1 moves **one** exec-backed, hibernating `kind:"instance"` record |
| -between two non-home, non-fleet placements or out of home, driven by an |
| -operator. It carries every piece of per-host state, proves the target can |
| +between two non-fleet placements, into home only with host claims on |
| +(Ruling R1, rev 7.24), driven by an operator. It carries every piece of per-host state, proves the target can |
| run it before the source stops, starts it on the target with no public |
| traffic, and opens only after a commit. If the target cannot start it, the |
| instance returns to the source automatically, carrying anything the target |
| @@ -2426,8 +2440,11 @@ is refused (400 or 409, with the sentence), and every box step re-checks: |
| non-hibernating (`internal/console/apiinstancemove.go:53-72`); |
| - a replica (`:187-190`, `provision.go:978-980`), or a home with replicas |
| (new); |
| -- a target of home (`apiinstancemove.go:203-209`; F2), the current region, |
| - or one outside the manifest's `regions` (`apiinstances.go:1797`); |
| +- a target of home on a console without host claims, or a home whose box |
| + sets a region code of its own (`apiinstancemove.go:203-209`; F2, rev |
| + 7.24, Ruling R1), the current region, or one outside the manifest's |
| + `regions` (`apiinstances.go:1797`). A home target is named by the |
| + home's configured name; there is no `home` keyword (Ruling R3); |
| - a source `<host>-sidecar.env`, or any refused registry column (§6.2); |
| - a private store bound to the instance's environment (codex 12; F4); |
| - the claim not `serving`, or any box in either region below the protocol |
| @@ -6336,7 +6353,7 @@ No design here, only what each must satisfy. |
| | spec | scope | must meet | |
| |---|---|---| |
| | **F1 Owner surface** | owner self-serve; person auto-cut (M6); holding route for custom domains | owners only (M13); move-capable service authority explicitly owner-delegated, including the legacy mint path (`apiinstances.go:1554`), with a stated treatment of existing member-minted tokens (codex 11); Tito's router credentials (M18) | |
| -| **F2 Moves into home** | `CARLOS_HOME_PLACEMENT`, home as a target, `carlos move back` | §5's handoff unchanged | |
| +| **F2 Moves into home** | Home as a target is **delivered** by `docs/superpowers/plans/2026-10-15-moves-home-region-part2.md` (rev 7.24, #236). `CARLOS_HOME_PLACEMENT` is superseded by Plan 13's signed fleet home designation, which names home once for every reader; no environment variable is added. `carlos move back` stays a follow-on (Ruling R3) | §5's handoff unchanged | |
| | **F3 Residency cleanup** | delete `superseded/<op id>/`, `move-snapshots/`, `.parked/superseded-*`, receipts after the hold (M7) | no deletion of a live location or its ancestor, selection excluded atomically through the claim (codex 8); the complete residue inventory including noncurrent versions and delete markers (`infra/modules/deployment-buckets/main.tf:27-30`) with scoped version-delete authority and verified removal (codex 9); a warrant binding the exact scope from an immutable console ledger (codex 10) | |
| | **F4 Stores** | private and app stores (M3, M9) | a joint instance and store transaction with binding versions and compensation (codex 12); store record transitions with config (`internal/objstore/walk.go:427`, `:448`), lifecycle operations serialized against the move (codex 17) | |
| | **F5 App moves** | sequencer, pause (M8), sidecar refusal (M10) | durable child move ids before dispatch; an app and store cut barrier covering every consumer and concurrent create (codex 18) | |