carlos / platform Public

Box identity Option B rev 5 and plan rev 3: answer Astra's round 4

The field is renamed machine: main's region HA plan 1a already publishes
box_id in the edges file as the claim's box name, bound by a signed box
record, and section 4 now defers the claim reference to that. The
namespace rule runs inside every decision; the gate derives an absolute
deadline from the verdict's expiry and refuses past it, with a request
grace added to retireAfter; recovery splits into the ordinary collision
(reboot the newcomer) and the displaced holder (stop, regenerate, wait,
retire); --retire-label deletes the edges file first under the stale
snapshot or a create-only tombstone and the snapshot last; four reads
before any early return; observation and alert writes independent, each
conditional, the lease rechecked between them; cleared rules retained;
landing per AGENTS.md and the gate is make test. The plan's tests use
the real helpers and signatures and add the interleavings Astra asked
for. Findings committed unedited as CODEX-FINDINGS-BOX-IDENTITY-B-R4.md.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>