carlos / platform Public

moves: the "claim Plan 12" text names the gate that still applies (Q18)

Every comment and standing notice in the moves files that said the park
hooks wait on claim Plan 12 now names what actually still gates them: the
wake-source gate (movesWakeSourceRegistered, Plan 5 Task 9b). The five
standing notices (landing, rollback, recovery, finalization, lane park)
are log lines, not copy-record strings. movesrefusals.go's free-host line
names the claim's free-host proof (claimFreeMoveProof), which Plan 12
landed. movesevidence.go's references are left to Task 2, which re-scopes
those refusals and removes the contract string.

No B8 census unit changed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude 1 week ago 797ed61ab01c77405d710ed223ce8ebef7279ca7 parent 7bb82b6

14 files changed, +72 −52

internal/host/movescut_test.go +1 −1
internal/host/movesfinal.go +9 −6
internal/host/movesfinal_test.go +5 −5
internal/host/movesinstall.go +7 −5
internal/host/movesland.go +8 −6
internal/host/moveslandcommit.go +2 −1
internal/host/movesparks.go +2 −1
internal/host/movespass.go +17 −13
internal/host/movesphase1_harness_test.go +1 −1
internal/host/movesrecover.go +8 −6
internal/host/movesrefusals.go +2 −1
internal/host/movesreport.go +2 −1
internal/host/movesrevert.go +5 −3
internal/host/movesrollback.go +3 −2

diff --git a/internal/host/movescut_test.go b/internal/host/movescut_test.go

index fb10f2292..b28e0877e 100644

--- a/internal/host/movescut_test.go

+++ b/internal/host/movescut_test.go

@@ -141,7 +141,7 @@ func newCutHarness(t *testing.T, opts ...p1Option) *cutHarness {

return nil

}

// The cut guard: the source can recover a failed cut, as every box

- // will once claim Plan 12 lands (armStandIns).

+ // will once the wake-source gate opens (armStandIns).

armStandIns(&h.cfg, h.s, roleSource)

return h

}

diff --git a/internal/host/movesfinal.go b/internal/host/movesfinal.go

index b357e43cc..690b1772a 100644

--- a/internal/host/movesfinal.go

+++ b/internal/host/movesfinal.go

@@ -71,9 +71,11 @@ import (

// Arming. Every hook that exists on main is wired (the guard, park.Local, the

// registry's delete, the versioned store). The claim's park leases, view and

// authorizer come from its MoveParks (armMovesParks, Plan 5 Task 9a), and

-// park.Local's authorizer is claim Plan 12's (M9); armMovesParks sets them

-// only with claim Plan 12, so sourceFinalArmed answers false in production

-// and the pass only logs until it lands. The tests arm it with fakes.

+// park.Local's authorizer is its MoveParks local authorizer (M9);

+// armMovesParks sets them only once the wake-source gate opens

+// (movesWakeSourceRegistered, Plan 5 Task 9b), so sourceFinalArmed answers

+// false in production and the pass only logs until then. The tests arm it

+// with fakes.

// The finalization's op journal steps (moves.Journal, the source's own

// journal of this op, which the cut began).

@@ -167,10 +169,11 @@ func (w *movesWorker) participantRound(ctx context.Context, s release.Store, rec

}

// sourceFinalArmed reports whether this box can run the finalization: every

-// hook it calls is wired, the claim's three park hooks and claim Plan 12's

+// hook it calls is wired, the claim's three park hooks and its MoveParks

// local authorizer (M9) included. Nothing stands in for a missing owner:

// the tests inject their own. In production armMovesParks sets them only

-// with claim Plan 12, so this answers false there until it lands.

+// once the wake-source gate opens (movesWakeSourceRegistered, Plan 5 Task

+// 9b), so this answers false there until then.

func sourceFinalArmed(cfg moveCfg) bool {

return cfg.Box != "" && cfg.DataDir != "" && cfg.Guard.DataDir != "" && cfg.Local.DataDir != "" &&

parkHooksArmed(cfg) && cfg.ParkLocalAuthorize != nil &&

@@ -215,7 +218,7 @@ func (w *movesWorker) finalizeSource(ctx context.Context, s release.Store, rec p

return nil

}

if !sourceFinalArmed(cfg) {

- w.notice(rec.Host+"#final", "moves: %s: the source's finalization of %s waits: this box's finalization is not armed (the claim's park hooks, set from MoveParks once claim Plan 12 lands, are needed)", rec.Host, m.ID)

+ w.notice(rec.Host+"#final", "moves: %s: the source's finalization of %s waits: this box's finalization is not armed (the claim's park hooks are set from MoveParks only once this box's moves wake source is registered, Plan 5 Task 9b)", rec.Host, m.ID)

return nil

}

f := &sourceFinal{w: w, s: s, rec: rec, g: provision.MoveGuard{ID: m.ID, Incarnation: m.Incarnation}}

diff --git a/internal/host/movesfinal_test.go b/internal/host/movesfinal_test.go

index 08014d0bb..006dd3cd7 100644

--- a/internal/host/movesfinal_test.go

+++ b/internal/host/movesfinal_test.go

@@ -752,10 +752,10 @@ func TestSourceParkWaitsUnarmedInProduction(t *testing.T) {

h := newFinalHarness(t)

h.commit(t)

for name, unarm := range map[string]func(*moveCfg){

- "no park leases": func(c *moveCfg) { c.ParkLeases = nil },

- "no park view": func(c *moveCfg) { c.ParkView = nil },

- "no park authorizer": func(c *moveCfg) { c.ParkAuthorize = nil },

- "no claim Plan 12 local authorizer": func(c *moveCfg) { c.ParkLocalAuthorize = nil },

+ "no park leases": func(c *moveCfg) { c.ParkLeases = nil },

+ "no park view": func(c *moveCfg) { c.ParkView = nil },

+ "no park authorizer": func(c *moveCfg) { c.ParkAuthorize = nil },

+ "no claim local authorizer": func(c *moveCfg) { c.ParkLocalAuthorize = nil },

} {

saved := h.cfg

unarm(&h.cfg)

@@ -868,7 +868,7 @@ func sourceTestView(_ context.Context, obs hostclaim.Observed) (park.View, error

GenerationOf: func(r park.Ref) (string, bool) { return landingGenerationOf(location, r.Key) }}, nil

}

-// sourceTestLocalAuthorize is claim Plan 12's local authorizer (M9) for the

+// sourceTestLocalAuthorize is the claim's local authorizer (M9) for the

// source's park-local: sourceTestAuthorize over the claim park.Local read.

func sourceTestLocalAuthorize(ctx context.Context, c *hostclaim.Claim, o hostclaim.Obligation) error {

return sourceTestAuthorize(ctx, hostclaim.Observed{Host: p1Host, Claim: c}, o)

diff --git a/internal/host/movesinstall.go b/internal/host/movesinstall.go

index 320517610..d13f229b0 100644

--- a/internal/host/movesinstall.go

+++ b/internal/host/movesinstall.go

@@ -62,7 +62,8 @@ import (

// that ends configured, after the database is installed and its markers

// written. Every record write goes through a provision transition (the

// record_seq rule). The installer is unarmed in production, as the landing

-// is (Plan 5 Task 9a: until claim Plan 12 lands): only the landing's pass,

+// is (until the wake-source gate opens, movesWakeSourceRegistered, Plan 5

+// Task 9b): only the landing's pass,

// the recovery and the tests call it.

// installStepPreMove is the moves-owned rename of a return's pre-move

@@ -363,8 +364,8 @@ func (ir *installRun) versioned(ctx context.Context) (lease.VersionedStore, erro

// of a dirty return it is the pre-move generations (§7.8, D6). Each chore is

// run once per pass through the park engine. The location's lease is the

// install's own, held from here (a landing's from checking) through

-// published, and each chore runs under it through claim Plan 12's RunHeld

-// (M5). ErrPending is the expected answer: the acknowledgement waits for

+// published, and each chore runs under it through park.Engine.RunHeld over

+// the claim's leases (ParkRunHeld, M5). ErrPending is the expected answer: the acknowledgement waits for

// the horizon, and is C4's runner's. The phase advances once every chore's

// manifest exists and its deletion set is gone (Engine.Parked).

// Per-generation chores are what let the acknowledgement finish after the

@@ -461,8 +462,9 @@ func (ir *installRun) parking(ctx context.Context) (bool, error) {

// The parks run under the build's own lease on the location, which the

// install holds from here (a landing from checking) through published:

// the residue scope's lease set is that lock (M6), so Engine.Run would

- // wait on the install itself. claim Plan 12's RunHeld runs each chore

- // under the held lease instead (M5).

+ // wait on the install itself. park.Engine.RunHeld (ParkRunHeld) runs

+ // each chore under the held lease instead, borrowed through the claim's

+ // AggregateLeases (M5).

held, waiting, err := ir.lease(ctx, holder)

if waiting || err != nil {

return false, err

diff --git a/internal/host/movesland.go b/internal/host/movesland.go

index 6a54e44be..ac60c15f2 100644

--- a/internal/host/movesland.go

+++ b/internal/host/movesland.go

@@ -73,11 +73,13 @@ import (

// Arming (ruling G17; Plan 5 Task 9a). armPhase1 wires the hooks that exist

// on main (the guard, park.Local, the own-location lease, RenderHeld, the

// registry setters, the restore-verification record, the marker writer).

-// ParkLeases, ParkView and ParkAuthorize are the claim's (MoveParks), and

-// ParkRunHeld claim Plan 12's (M5), all set by armMovesParks only once claim

-// Plan 12 lands; nothing stands in for them. landingArmed therefore answers

-// false in production and the pass logs a standing notice instead of

-// landing; the tests arm everything with fakes (movesparkfakes_test.go).

+// ParkLeases, ParkView, ParkAuthorize and ParkLocalAuthorize are the

+// claim's (MoveParks), and ParkRunHeld is park.Engine.RunHeld over the

+// claim's leases (M5), all set by armMovesParks only once the wake-source

+// gate opens (movesWakeSourceRegistered, Plan 5 Task 9b); nothing stands in

+// for them. landingArmed therefore answers false in production and the pass

+// logs a standing notice instead of landing; the tests arm everything with

+// fakes (movesparkfakes_test.go).

// Under

// CARLOS_HOST_CLAIM the landing refuses at checking with a recorded reason

// (ruling G16). The policy its held writes need, hostbox.Policy.Moves, is

@@ -168,7 +170,7 @@ func (w *movesWorker) landingPass(ctx context.Context, s release.Store, rec prov

return err

}

if !landingArmed(cfg) {

- w.notice(rec.Host+"#landing", "moves: %s: the landing of %s waits: this box's landing is not armed (the claim's park hooks, set from MoveParks once claim Plan 12 lands, are needed)", rec.Host, rec.Move.ID)

+ w.notice(rec.Host+"#landing", "moves: %s: the landing of %s waits: this box's landing is not armed (the claim's park hooks are set from MoveParks only once this box's moves wake source is registered, Plan 5 Task 9b)", rec.Host, rec.Move.ID)

return nil

}

l := &landingRun{w: w, s: s, rec: rec, g: provision.MoveGuard{ID: rec.Move.ID, Incarnation: rec.Move.Incarnation}}

diff --git a/internal/host/moveslandcommit.go b/internal/host/moveslandcommit.go

index a8e63313c..ec9a79d9a 100644

--- a/internal/host/moveslandcommit.go

+++ b/internal/host/moveslandcommit.go

@@ -43,7 +43,8 @@ import (

// rest and only clears the record.

// Unarmed in production with the rest of the landing: landingArmed fails

-// there until claim Plan 12 lands (Plan 5 Task 9a), and the open needs

+// there until the wake-source gate opens (movesWakeSourceRegistered, Plan 5

+// Task 9b), and the open needs

// ReleaseHeld.

// probed commits the landing: the record's CAS, then the committed arm.

diff --git a/internal/host/movesparks.go b/internal/host/movesparks.go

index fb2460713..62a96eeef 100644

--- a/internal/host/movesparks.go

+++ b/internal/host/movesparks.go

@@ -47,7 +47,8 @@ import (

// after Plan 5 Task 9 (park arming) and claim Plans 10 and 11. The committed

// arm runs only where the landing is armed (landingArmed), and production

// sets the claim's park leases, view and authorizer (armMovesParks, Plan 5

-// Task 9a) only once claim Plan 12 lands; the commit and the open themselves need the probe wake of

+// Task 9a) only once the wake-source gate opens (movesWakeSourceRegistered,

+// Plan 5 Task 9b); the commit and the open themselves need the probe wake of

// claim Plan 11's launcher; and the source's location park is acknowledged

// by C4's regional runner, whose moves evidence is claim Plan 10's. Until

// then the tests arm everything with fakes.

diff --git a/internal/host/movespass.go b/internal/host/movespass.go

index 0a6608eb1..21ffd0d8a 100644

--- a/internal/host/movespass.go

+++ b/internal/host/movespass.go

@@ -193,7 +193,8 @@ func (w *movesWorker) mirror(ctx context.Context, dstRegion string) (lease.Mirro

// it off eb.Strict stays nil, so every spawn is main's. providers is the

// claim wiring's (newClaimWiring builds it before this): with both switches

// on, the park arms take their engine from its MoveParks (armMovesParks,

-// Plan 5 Task 9a), behind the claim Plan 12 guard. events is the agent's

+// Plan 5 Task 9a), behind the wake-source gate (movesWakeSourceRegistered,

+// Plan 5 Task 9b), which nothing in production opens yet. events is the agent's

// rollout sink, which the move log tells the app's members through (Plan 6

// Task 3).

func armMovesPass(hib activator.Config, dataDir string, reg *registry.Registry, svc *activator.Service, eb *activator.ExecBackend, writes hostwrite.Config, providers ClaimProviders, events activator.EventSink) {

@@ -352,10 +353,11 @@ func armPhase1(cfg *moveCfg, w *movesWorker, hib activator.Config, dataDir strin

}

// The landing (movesland.go). Everything that exists on main is wired

// here; ParkLeases, ParkView and ParkAuthorize come from the claim's

- // MoveParks (armMovesParks, Plan 5 Task 9a, in armMovesPass), with claim

- // Plan 12's RunHeld and local authorizer, and are set only once claim

- // Plan 12 lands, so landingArmed is false in production and the landing

- // pass only logs. The held timers

+ // MoveParks (armMovesParks, Plan 5 Task 9a, in armMovesPass), with

+ // park.Engine.RunHeld and the MoveParks local authorizer, and are set

+ // only once the wake-source gate opens (movesWakeSourceRegistered, Plan 5

+ // Task 9b), so landingArmed is false in production and the landing pass

+ // only logs. The held timers

// write goes through schedule.SelectedTimers with a held-timers Work

// selected from writes (ruling G16, heldTimersReplacer): with

// CARLOS_HOST_CLAIM off that is the registry's own ReplaceTimers, as

@@ -612,8 +614,9 @@ type moveCfg struct {

// (MoveParks, armMovesParks): its leases, view and authorizer over the

// own bucket. Every arm requires all three (parkHooksArmed) and runs its

// own check before the authorizer (movesArmAuthorize); nothing stands

- // in. In production they are set only once claim Plan 12 lands, which

- // leaves every arm unarmed there. OwnLease

+ // in. In production they are set only once the wake-source gate opens

+ // (movesWakeSourceRegistered, Plan 5 Task 9b), which leaves every arm

+ // unarmed there. OwnLease

// takes the location's lease in the own bucket for the build

// (hostbox.RenewingLeases over lease.Acquire). RenderHeld is

// appconfig.RenderHeldBefore for the held row (before journals the

@@ -628,12 +631,13 @@ type moveCfg struct {

ParkLeases park.Leases

ParkView func(context.Context, hostclaim.Observed) (park.View, error)

ParkAuthorize func(context.Context, hostclaim.Observed, hostclaim.Obligation) error

- // ParkRunHeld and ParkLocalAuthorize are claim Plan 12's pieces of the

- // MoveParks capability (movesClaimPlan12, movessources.go): RunHeld runs

- // a chore under a lease the caller holds (M5: the landing's residue park

- // under its own-location lease), AuthorizeLocal is the owner authorizer

- // for this box's park.Local chores (M9). Nil in production until claim

- // Plan 12 lands; armMovesParks sets all five or none.

+ // ParkRunHeld is park.Engine.RunHeld (movesRunHeld): it runs a chore

+ // under a lease the caller holds (M5: the landing's residue park under

+ // its own-location lease), borrowed through the claim's leases

+ // (AcquireHeld). ParkLocalAuthorize is the MoveParks local authorizer,

+ // the owner authorizer for this box's park.Local chores (M9). Nil in

+ // production until the wake-source gate opens; armMovesParks sets all

+ // five or none.

ParkRunHeld func(ctx context.Context, e park.Engine, w park.Work, held park.HeldLease) error

ParkLocalAuthorize func(ctx context.Context, c *hostclaim.Claim, o hostclaim.Obligation) error

OwnLease func(ctx context.Context, bucket, location string) (park.HeldLease, error)

diff --git a/internal/host/movesphase1_harness_test.go b/internal/host/movesphase1_harness_test.go

index a4fc8aeee..b735a96e8 100644

--- a/internal/host/movesphase1_harness_test.go

+++ b/internal/host/movesphase1_harness_test.go

@@ -550,7 +550,7 @@ func (h *phase1Harness) targetCfg() moveCfg {

return moves.MeasuredRate{MiBPerS: 500, At: now, Bytes: 128 << 20}, moves.FilesRate{PerS: 1600, At: now, Files: 512}, nil

}

// The cut guard's T13: the target states it can land and roll back,

- // as every box will once claim Plan 12 lands (armStandIns).

+ // as every box will once the wake-source gate opens (armStandIns).

armStandIns(&c, h.s, roleTarget)

return c

}

diff --git a/internal/host/movesrecover.go b/internal/host/movesrecover.go

index 52fced74a..3f98ce8f3 100644

--- a/internal/host/movesrecover.go

+++ b/internal/host/movesrecover.go

@@ -93,8 +93,9 @@ import (

// Arming (rulings J18, G17; Plan 5 Task 9a). Like the landing and the

// target's half of the rollback, the source's recovery needs the claim's

-// park hooks and claim Plan 12's RunHeld (for the dirty return's residue

-// parks), which armMovesParks sets only once claim Plan 12 lands, so

+// park hooks, RunHeld (for the dirty return's residue parks) and the local

+// authorizer, which armMovesParks sets only once the wake-source gate opens

+// (movesWakeSourceRegistered, Plan 5 Task 9b), so

// recoverySourceArmed answers false in production and the pass logs a

// standing notice. The probe hook is

// the recovery probe adapter (armRecoveryProbe) with CARLOS_HOST_CLAIM on,

@@ -155,9 +156,10 @@ type recoveryProbeRequest struct {

// recoverySourceArmed reports whether this box can run the source's

// recovery: every hook a dirty return's install and the open call is wired,

-// the claim's park hooks and claim Plan 12's RunHeld included (landingArmed).

-// In production armMovesParks sets those only with claim Plan 12, so this

-// answers false there until it lands (J18).

+// the claim's park hooks, RunHeld and local authorizer included

+// (landingArmed). In production armMovesParks sets those only once the

+// wake-source gate opens (movesWakeSourceRegistered, Plan 5 Task 9b), so this

+// answers false there until then (J18).

func recoverySourceArmed(cfg moveCfg) bool {

return landingArmed(cfg) && cfg.DataDir != "" && cfg.HandHold != nil && cfg.ReleaseHeld != nil && cfg.Timers != nil

}

@@ -194,7 +196,7 @@ func (w *movesWorker) recoverSource(ctx context.Context, s release.Store, rec pr

return nil

}

if !recoverySourceArmed(cfg) {

- w.notice(rec.Host+"#recover", "moves: %s: the source's recovery of rollback %s waits: this box's recovery is not armed (the claim's park hooks, set from MoveParks once claim Plan 12 lands, are needed)", rec.Host, m.Rollback.ID)

+ w.notice(rec.Host+"#recover", "moves: %s: the source's recovery of rollback %s waits: this box's recovery is not armed (the claim's park hooks are set from MoveParks only once this box's moves wake source is registered, Plan 5 Task 9b)", rec.Host, m.Rollback.ID)

return nil

}

r := &recoverRun{w: w, s: s, rec: rec, g: provision.MoveGuard{ID: m.ID, Incarnation: m.Incarnation}, rb: m.Rollback.ID}

diff --git a/internal/host/movesrefusals.go b/internal/host/movesrefusals.go

index ba327236d..fcad00f68 100644

--- a/internal/host/movesrefusals.go

+++ b/internal/host/movesrefusals.go

@@ -3,7 +3,8 @@ package host

// Quiet refusals (moves Plan 5 Task 9a; the Task 5 rulings). The claim's

// regional worker asks Task 5's provider about every host at rest, every

// minute, and an ordinary state refuses: a live move, residue the move's

-// close does not vouch for, a free host whose lanes are claim Plan 12's. The

+// close does not vouch for, a free host whose lanes the claim's own

+// free-host proof answers (claimFreeMoveProof). The

// worker reports each refusal, so the agent's log would repeat them every

// minute. movesRefusals keeps them quiet:

diff --git a/internal/host/movesreport.go b/internal/host/movesreport.go

index b38e8a202..a02c2b76a 100644

--- a/internal/host/movesreport.go

+++ b/internal/host/movesreport.go

@@ -281,7 +281,8 @@ func (w *movesWorker) targetReport(ctx context.Context, s release.Store, rec pro

// 2026-10-11): this box can land the move and roll it back, every hook of

// both wired, judged as the report is written. The source refuses to start

// a cut unless the target's latest report states it (cutRun.refuseUnarmed).

-// In production both stay unarmed until claim Plan 12 lands. Its reason is

+// In production both stay unarmed until the wake-source gate opens

+// (movesWakeSourceRegistered, Plan 5 Task 9b). Its reason is

// copy record MV-N440.

func checkArmed(cfg moveCfg) moves.Check {

if landingArmed(cfg) && rollbackTargetArmed(cfg) {

diff --git a/internal/host/movesrevert.go b/internal/host/movesrevert.go

index 91ac4b200..29e39c730 100644

--- a/internal/host/movesrevert.go

+++ b/internal/host/movesrevert.go

@@ -95,7 +95,8 @@ import (

// Task 9 (claim Plan 10's recovery admission), so revertSourceArmed answers

// false and the source only writes the claim half, as Plan 2's arm did; and

// the target's lane park needs the claim's park leases, view and authorizer,

-// which armMovesParks sets only once claim Plan 12 lands (revertLaneArmed). LogEvent is nil in production,

+// which armMovesParks sets only once the wake-source gate opens

+// (movesWakeSourceRegistered, Plan 5 Task 9b; revertLaneArmed). LogEvent is nil in production,

// where an event is a log line.

// revertStepsPerPass bounds the steps one pass runs: evidence to the close is

@@ -161,7 +162,8 @@ func revertSourceArmed(cfg moveCfg) bool {

// park: an engine region (parkRegion, the home's "" included as

// park.HomeRegion; a code that is no placement is not one), the claim's

// park leases, view and authorizer, and this box's own bucket. In

-// production armMovesParks sets the three only with claim Plan 12, so this

+// production armMovesParks sets the three only once the wake-source gate

+// opens (movesWakeSourceRegistered, Plan 5 Task 9b), so this

// answers false there until it lands.

func revertLaneArmed(cfg moveCfg) bool {

return cfg.Box != "" && cfg.parkRegion() != "" && cfg.OwnBucket != "" && parkHooksArmed(cfg) && cfg.Versioned != nil

@@ -881,7 +883,7 @@ func (w *movesWorker) laneParkTarget(ctx context.Context, s release.Store, rec p

notice = rec.Host + "#rv-lane"

}

if !revertLaneArmed(cfg) {

- w.notice(notice, "moves: %s: the park of move %s's lane waits: this box's park engine is not armed (the claim's park hooks, set from MoveParks once claim Plan 12 lands, are needed)", rec.Host, m.ID)

+ w.notice(notice, "moves: %s: the park of move %s's lane waits: this box's park engine is not armed (the claim's park hooks are set from MoveParks only once this box's moves wake source is registered, Plan 5 Task 9b)", rec.Host, m.ID)

return nil

}

host, id := rec.Host, m.ID

diff --git a/internal/host/movesrollback.go b/internal/host/movesrollback.go

index ed7bf3121..d7223b6c2 100644

--- a/internal/host/movesrollback.go

+++ b/internal/host/movesrollback.go

@@ -91,7 +91,8 @@ import (

// Arming (ruling J18; Plan 5 Task 9a). Like the landing, the rollback's

// target half needs the claim's park leases, view and authorizer, which

-// armMovesParks sets only once claim Plan 12 lands, so rollbackTargetArmed

+// armMovesParks sets only once the wake-source gate opens

+// (movesWakeSourceRegistered, Plan 5 Task 9b), so rollbackTargetArmed

// answers false in production and the pass logs a standing notice. The decision is

// not gated (J10). The move's event log (moves.LogEvent, Plan 6) is the

// LogEvent hook: nil in production, where the event is a log line. The

@@ -245,7 +246,7 @@ func (w *movesWorker) rollbackTarget(ctx context.Context, s release.Store, rec p

// nothing held is nothing to release.

releaseOwnLease(w, rec.Host)

if !rollbackTargetArmed(cfg) {

- w.notice(rec.Host+"#rollback", "moves: %s: the target's half of rollback %s waits: this box's rollback is not armed (the claim's park hooks, set from MoveParks once claim Plan 12 lands, are needed)", rec.Host, m.Rollback.ID)

+ w.notice(rec.Host+"#rollback", "moves: %s: the target's half of rollback %s waits: this box's rollback is not armed (the claim's park hooks are set from MoveParks only once this box's moves wake source is registered, Plan 5 Task 9b)", rec.Host, m.Rollback.ID)

return nil

}

r := &rollbackRun{w: w, s: s, rec: rec, g: provision.MoveGuard{ID: m.ID, Incarnation: m.Incarnation}, rb: m.Rollback.ID}