amadan
spec: host lifecycle claim rev 6.30, joint round 18 (R18-1 to R18-3)
A create-only prepared files manifest under operation and installation authority (no session) before the first admission; the session publisher starts after admission from it. Before the flip means before the flip CAS, not the final commit. §11's two-box requirement belongs to region HA's validation milestone.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 file changed,
+30
−7
docs/superpowers/specs/2026-10-02-host-lifecycle-claim-design.md+30 −7
CI passed — run details
diff --git a/docs/superpowers/specs/2026-10-02-host-lifecycle-claim-design.md b/docs/superpowers/specs/2026-10-02-host-lifecycle-claim-design.md| index 41de6c828..9d4092b7a 100644 |
| --- a/docs/superpowers/specs/2026-10-02-host-lifecycle-claim-design.md |
| +++ b/docs/superpowers/specs/2026-10-02-host-lifecycle-claim-design.md |
| @@ -1,6 +1,6 @@ |
| # The host lifecycle claim |
| -Design, 2026-10-06, **rev 6.29**. Joint rounds 6 and 7 judged the claim ready for primitive planning. Rev |
| +Design, 2026-10-06, **rev 6.30**. Joint rounds 6 and 7 judged the claim ready for primitive planning. Rev |
| 6.5 added the R6-4 rule. Rev 6.6 added writer epochs (R7-1, amadan #225). |
| Rev 6.7 answered the moves session's notes on §6.4a. Rev 6.8 rewrote §6.4a |
| around writer sessions, for joint round 8. Rev 6.10 answers joint round 10 |
| @@ -29,7 +29,9 @@ admission declares nothing). Rev 6.26 answers joint round 17's R17-2 (a |
| delete may use the whole-host staging scope). Joint round 17 was CLEAN. Rev 6.27 records Paul's rulings on #236 |
| (§1.1) and marks §5.9, §6.6, §7.3 and §10.1 ruled, as amended there. |
| Rev 6.28 adopts region HA spec 1 rev 5.4's L1 to L20 (amadan #236) at their sections. Rev 6.29 scopes the two-box model to region HA's plan as |
| -an activation gate for `relocating` (moves Phase 1 is one-box). |
| +an activation gate for `relocating` (moves Phase 1 is one-box). Rev 6.30 |
| +answers joint round 18 (R18-1 prepared files manifest, R18-2 the flip, |
| +R18-3 the validation milestone). |
| Rev 6.9 answered |
| joint round 9 |
| (R9-1 to R9-4) and takes **Paul's ruling R6 (2026-10-04): a box never |
| @@ -424,6 +426,22 @@ The publisher participates in fencing, producer shutdown, request deadlines |
| and retirement evidence. A new session creates a new generation-bound |
| publisher. |
| +**The prepared files manifest (R18-1).** Before any session exists, an |
| +installation may publish its **initial** files state under the authority |
| +of its operation and installation, not a session: a move's `local` phase, |
| +a relocation's `installing`, or region HA's prepared-manifest build (spec |
| +1). It writes immutable content objects (create-only) and **one |
| +create-only prepared manifest** under the prepared generation's files |
| +prefix, bound to `{location, generation, op id, installation stamp}`, |
| +naming exact object versions and its sequence `0`. It is written only by |
| +`op.exec` in a phase that permits installation, never replaced, and |
| +retired with its generation. The session-bound publisher starts only |
| +after the first admission, takes the prepared manifest as its baseline |
| +(by exact version) and publishes from sequence `1`. A prepared manifest |
| +with no admitted session is ordinary prepared-generation state: the |
| +admission that opens the generation consumes it, and a generation that is |
| +never opened is retired with it. |
| + |
| Every destructive storage call names **an exact object version**: a |
| `DeleteObject` with `VersionId`, or a `CopyObject` from |
| `key?versionId=`. Never a bare key. Both buckets are versioned |
| @@ -664,7 +682,9 @@ performing phase work. |
| **A move whose source is terminated before its flip (moves 7.19).** A |
| termination fence for the source of a `moving` operation that has not |
| -reached its flip (the instance record's commit has not happened) may |
| +reached its flip (the authoritative instance record has not entered |
| +`landing` through the flip CAS; this is distinct from, and earlier than, |
| +the move's final commit CAS, R18-2) may |
| convert that operation to `relocating` in one CAS: it records the fence |
| (`fence.<box>`), sets `op.exec = "none"`, preserves `holder.stamp` and |
| `holder.generation`, starts `relocating` at `pinning` in the source's |
| @@ -3669,9 +3689,11 @@ paragraph: |
| It runs 30k+ seeds, with mutation checks that drop each guard and confirm |
| the model catches it. |
| -Joint round 18 must extend `internal/sim/hostlife` to **two boxes per |
| -region** (L18). The existing one-box-per-region model and clean joint |
| -rounds do not prove these amendments. Required cases include create |
| +**Region HA's validation milestone** (§1.1's activation gate) must extend |
| +the joint model to **two boxes per region** (L18) before `relocating` and |
| +L9 to L13 are enabled. Joint round 18 reviewed them statically; the |
| +one-box-per-region model, the moves Phase 1 scope and the one-box |
| +pre-flip conversion to `relocating` do not waive this milestone (R18-3). Required cases include create |
| spread, relocation by drain, termination during serving and every |
| relocation phase, nested failover, stale edges files, unenrolled |
| references, a volume without `DeleteOnTermination`, crashes during |
| @@ -3692,7 +3714,8 @@ The adverse-volume case must prove both that execution recovery proceeds |
| and that local chores remain open. Add targeted tests against the real |
| `hostclaim`, `park`, `stopevidence`, `hostfiles` and `hostexec` boundaries; |
| model results do not replace those adapter tests. These are required |
| -evidence for joint round 18, not results established by this revision. |
| +evidence for region HA's validation milestone, not results established by |
| +this revision. |
| ## 12. Finding map |