carlos / platform Public

docs: the stage B plan records the .moves lock residual under M-K25 and the two-completed-stops stuck cause under checklist item 19 (task 10 re-review R1)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Paul Campbell pushed by claude 1 week ago 8c13973c4cb11e938b2397f51b4e9bcbc3ed1cf1 parent 6dfb955

1 file changed, +2 −2

docs/superpowers/plans/2026-10-10-region-ha-1b-next-stage-b.md +2 −2

CI cancelled — superseded by a newer push — run details

diff --git a/docs/superpowers/plans/2026-10-10-region-ha-1b-next-stage-b.md b/docs/superpowers/plans/2026-10-10-region-ha-1b-next-stage-b.md

index 977fd3fc9..a0c0ec150 100644

--- a/docs/superpowers/plans/2026-10-10-region-ha-1b-next-stage-b.md

+++ b/docs/superpowers/plans/2026-10-10-region-ha-1b-next-stage-b.md

@@ -330,7 +330,7 @@ Each is modelled as a dependency with a fallback. None is assumed. Rev 2 added C

| **C9** | claim | The claim's `Policy` admits relocating `install`, `held-config` and `held-release` for `op.exec` in `installed`, and in `probing` before P opens, with the hold absent or the op's own. Its `WithRefusals` then also run for them. | `relocationInstallPolicy` on main's WorkSource (ruling 46): the same `Guard`, `Prepare` and `Local` main uses, so the claim's execution, deadline and quarantine checks run on every `With`; the policy itself is region HA's, followed by region HA's `Policy.Relocation` owner. | ruling 46, Task 8c |

| M1 | moves | Close the move record after a converted landing (`released_move`) | Region HA's half is built here (Task 9): `CompleteRelocation` journals `released_move` when `conversion == committed-landing`. Until moves relaxes `closeMove`, a converted host cannot move again: operator path. | Task 9 |

-| **M-K25** | moves | The held-stage relay's two directories (`moves/held-stage`, `moves/held-staged`, keyed by host) classified census-opaque by moves' own census entry, or the relay keyed by op. | **N11**: region HA's `claimDataCensus` entry classifies both directories opaque (ruling 73). | Task 8c |

+| **M-K25** | moves | The held-stage relay's two directories (`moves/held-stage`, `moves/held-staged`, keyed by host) classified census-opaque by moves' own census entry, or the relay keyed by op. | **N11**: region HA's `claimDataCensus` entry classifies both directories opaque (ruling 73). | Task 8c Also `<DataDir>/.moves/held-<host>.lock`, which `withHeldStageLock` leaves and never removes (Task 8c); region HA classifies `.moves` as a `CensusTree` (ce6f8bb6), and a box that once held host X's lock refuses a later from-empty install of X until moves removes or op-keys the lock. |

| M3 | moves | The held-stage relay's relocating branch, with `Stamp` on `HeldStageRequest` | Task 8c writes the request with `Version` = `op.journal.install_release` and today's fields (materializeheld.go:451-458); `Stamp` is added the day the field lands. Until the branch exists the request is refused as stale, the install re-requests on every pass and waits in `installed`. **Activation gate:** the dev-box check must show the relay serving a relocating request. | Task 8c, Task 10 |

| W1 | this plan | The live Litestream witness for lazily opened descriptors (Plan 11 item 4) | If root's observation refuses a hint that misses a descriptor the replicator opened after `Replicate`, the drain fails closed and the operation goes `stuck` at `ReleaseDeadline`; failover is unaffected. Then a claim ask: widen the hint (ruling 29). | Task 10 checklist |

@@ -14810,7 +14810,7 @@ Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>"

16. **C11.** Until it lands each target gets one launchable probe attempt; set `LaterProbeAttempts` only after it does.

17. **O2′ on dev.** A relocation of an app on its own `instance.key` pins with no `InstanceKey`. After O6, a relocation of a platform-key app pins `InstanceKey`, and changing a configured key between pin and install makes the install refuse (`VerifyDelivered`).

18. **Task 10b (gate; R5-3).** Task 10b has landed and its tests pass: `Reconciler.FenceClosed` and `HoldRow` are wired, the source's row goes held at its fence's close with a status the edge does not serve, and the completion or the source's park-local ends the hold. Relocation is not switched on anywhere before this.

-19. **A completion its box cannot finish (ruling 82; runbook; C13).** With claim mode on, every box runs the completion pass, whatever `CARLOS_REGION_HA` says: the agent logs "relocation pass started (completions only: true)" with region HA off, and "relocation completion pass not started" with its reason if it cannot start one. With region HA on the full pass is built on the pass's first, bounded, run and retried every pass until it builds (said once per cause). The completion pass reads this box's registry rows and every host its `relocate/ops/*/{probe-fence,attempts}.json` journals name, so a completion whose row is gone is still visited and its refusal ("has no row on this box") said once. A host whose serving op shows `completed_relocation` without `discharged` refuses every start (moves, deletes, purges, placements, relocations) with "relocation <op> is not yet discharged on <box>" until that box's pass marks it. Usually the next pass does. If the box can never run its pass (it will not boot, or its discharge is refused for good), use the existing loss path; there is no override:

+19. **A completion its box cannot finish (ruling 82; runbook; C13).** With claim mode on, every box runs the completion pass, whatever `CARLOS_REGION_HA` says: the agent logs "relocation pass started (completions only: true)" with region HA off, and "relocation completion pass not started" with its reason if it cannot start one. With region HA on the full pass is built on the pass's first, bounded, run and retried every pass until it builds (said once per cause). The completion pass reads this box's registry rows and every host its `relocate/ops/*/{probe-fence,attempts}.json` journals name, so a completion whose row is gone is still visited and its refusal ("has no row on this box") said once. A host whose serving op shows `completed_relocation` without `discharged` refuses every start (moves, deletes, purges, placements, relocations) with "relocation <op> is not yet discharged on <box>" until that box's pass marks it. Usually the next pass does. If the box can never run its pass (it will not boot, or its discharge is refused for good), use the existing loss path; there is no override: A second known stuck cause (Task 9, ruling 92): a repeated probe stop after a roster change and a failed serving CAS leaves two completed stops of one session, which `writerSessionReceipt` refuses rather than guess; the relocation stays stuck until an operator resolves it through the same route.

- **Terminate the box.** The termination worker writes its fence. A failover relocation from the box then cites that fence, which the barrier exempts (ruling 81), and puts the box on `lost`. After that every start passes.

- **Or have the box declared lost** through the claim's loss declaration (`hostclaim.DeclareLost`), which puts it on `lost`. The console's `declare-lost` action refuses while claim mode is on (apihostclaim.go), so in claim mode this path waits for the claim's scoped writer: claim ask **C13** (ruling 84's residual).

- Never edit the claim by hand to clear the record. That reopens round 7's conflict: the box's participation slot is still the old op's, and the successor's `Prepare` answers `ErrLost`.