amadan
docs: the activation record says what switching CARLOS_REGION_HA off does mid-relocation and names W5's owner; the C11 and read-volume notes (final review minors 8, 11, 12)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 file changed,
+5
−2
docs/superpowers/plans/2026-10-10-region-ha-1b-next-stage-b.md+5 −2
CI cancelled — superseded by a newer push — run details
CI log
=== gate === cd launchctx && go vet ./... && go test ./... -count=1 ok amadan.net/carlos/platform.git/launchctx 0.011s ? amadan.net/carlos/platform.git/launchctx/controlname [no test files] ? amadan.net/carlos/platform.git/launchctx/wireid [no test files] go vet ./... gofmt -l .: clean go test ./... -count=1 -timeout 30m amadan: job cancelled — a newer push superseded it
diff --git a/docs/superpowers/plans/2026-10-10-region-ha-1b-next-stage-b.md b/docs/superpowers/plans/2026-10-10-region-ha-1b-next-stage-b.md| index a0c0ec150..80840f3a2 100644 |
| --- a/docs/superpowers/plans/2026-10-10-region-ha-1b-next-stage-b.md |
| +++ b/docs/superpowers/plans/2026-10-10-region-ha-1b-next-stage-b.md |
| @@ -14776,7 +14776,7 @@ Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>" |
| | **J2** | Moves Plan 5 Task 9's park arming with the files live set | moves session | Open | Task 11's joint round waits for it. | |
| | **Task 11** | The joint round on the two-box model passes, then the branch gate (L18) | region HA (this plan) | Not run; waits on J2 | **Merge and switch-on gate** (item 21). | |
| | **C8 + O1′** | Moves' production `ClaimFilesManifest` provider registered on every box (`RegisterProductionClaimMoveSources`), `Establish` publishing `<host>.env`'s exact bytes and starting each admission with no adoption item | moves session (platform-d8, #236); O1′ from the instance-key plan | Not built on this branch | **Switch-on gate** (item 13): relocation stays unbound (ruling 53). | |
| -| **W5** | Wake state published continuously, outside the release flush (spec A1-7) | region HA follow-up (likely with O1's provider) | Not built | **Switch-on gate** (item 13): failover refuses at install, `stuck`. | |
| +| **W5** | Wake state published continuously, outside the release flush (spec A1-7) | region HA follow-up (the plan after this one; it lands beside O1's provider, moves session, #236) | Not built | **Switch-on gate** (item 13): failover refuses at install, `stuck`. | |
| | **Instance-key plan** | `internal/instancekey` (IK-1, merged at cf22260a) and the rest of the instance-key plan rolled to the region's boxes, with its rollout step 1 pre-roll check run first (every replica's key against its home's, into `CARLOS_REPLICA_HOME_KEYS`) | instance-key plan (`instance-key-build`) | IK-1 merged; the plan's later tasks and roll not done | **Switch-on gate** (item 9). | |
| | **O2′, O3′, O5** | The pinner's key evidence, the install's delivered-key check, the flush's adoption item | region HA (Tasks 8a to 8c) | Built on this branch | Checked on dev (item 17). | |
| | **O6** | Claim launches bind a control socket and mount the adoption verb, with `CARLOS_INSTANCE_KEY_SOURCE` | claim Plan 9 Group D (instance-key plan obligation) | Not built; ships only after O7 | **Explicit refusal** (ruling 55, item 9): platform-key and configured-key apps' relocations refuse (`stuck`). | |
| @@ -14817,6 +14817,8 @@ Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>" |
| 20. **C12 (gate).** C12 is confirmed on #236: `StartGuard`'s completion barrier (N13) is the claim's. If it is refused, N13 is reverted and the guard the claim names takes the one-line call; relocation is not switched on before one of the two is on main. |
| 21. **Task 11 and J2 (gate).** Task 11's joint round has passed on the two-box model, after moves' J2 (Plan 5 Task 9's park arming with the files live set), and the branch gate has run. Relocation does not merge or switch on before. |
| +**Switching `CARLOS_REGION_HA` off while a relocation is in flight** (final review minor 8; runbook). The agent and root's instance-control each read the flag at their own start, so switching it off is a restart of both with it unset, and this is what that box then does. The relocation owner source is not registered and the full pass is not built: the box runs the completion-only pass (ruling 82), steps no relocation it takes part in, converts no landing and starts nothing, and root's relocating attempt reader is not installed, so every relocating wake on the box is refused. An in-flight operation is not abandoned by the claim, only by this box: a worker on any box still running the full pass keeps driving it, deployment-wide, and its deadlines decide it. A target that was `installing`, `installed` or `probing` here stops participating and reaches `stuck` (installed, ruling 60) or `probe_failed` (ProbeDeadline) for an operator; a probe that had passed here and is not stopped by this box goes `stuck` at ReleaseDeadline with its session left running until an operator stops it (ruling 67); a source `releasing` here never runs its release, so the op waits for its deadline, and an obligation it had already queued stays. Completions still finish here (ruling 82), and the first serving wake of a completed relocation still hands over from the probe's receipt (N6, wired whenever claim mode is on). So: before switching the flag off on a box, wait for every relocation naming that box to reach `serving` (or resolve the ones that cannot), or expect them to go `stuck` or `probe_failed` for an operator; never switch it off to cancel a relocation, which has no cancel. |
| + |
| --- |
| ### Task 10b: The source's row held at its fence's close (R5-3), mandatory before activation |
| @@ -14853,11 +14855,12 @@ Unchanged from the 1b-next plan's Task 11 (L13558-13586), with the model at `ori |
| |---|---| |
| | Drains (`reason: drain`, `rebalance`) | C1 | |
| | Switching relocation on anywhere | Every switch-on gate in Task 10 step 9's activation record (rev 5.4): C10 and C12 confirmed on #236, C8 with O1 and W5, M3, W3, W4 with C14, the instance-key plan rolled, Task 10b landed (R5-3), the two-box run on dev (checklist item 12), Task 11 after J2 | |
| -| More than one probe attempt per target | C11 | |
| +| More than one probe attempt per target | C11. Its follow-up also moves `relocationAdmit`'s install-manifest read and ProbeWake's non-probe errors before the count (final review minor 11; Task 8d's R1 and R2): today an attempt spent on transient I/O after `BeginProbeAttempt` is an attempt, so three attempts are not three probes | |
| | A shorter denial for an excluded target | C6 | |
| | The install's three actions under the claim's own Policy | C9 | |
| | Moves' relay directories classified by moves | M-K25 (N11 until then) | |
| | The zero-downtime completion through `relocating/serving` | Task 11's round; a follow-up plan | |
| +| A region-scoped claim listing for the full pass | A plan note (final review minor 12): with region HA on, every box lists and reads every claim under `control/hosts/` every 30 s, deployment-wide, as designed for replay; when the deployment outgrows that, the pass lists its region's hosts, which needs a region-keyed index the claim does not have today | |
| | The L21 instance key's platform side | its own plan, rastrillo #66 | |
| | Automatic discharge of a fenced box's chores | roster entries with `enrolled_at` | |
| | Starting relocations: `carlos ops host relocate`, the console's view, spec 3's placer, with `Worker.Start`'s app admission and census | Paul's copy review; spec 3 (ruling 72) | |