Moves Phase 1: the rehearsal runbook

This is the checklist an operator follows to rehearse Phase 1 moves (spec §14.4, rollout §15). It covers eight runs in the spec's order: five on dev (Runs 1, 1b, 2, 3 and 4; Run 1b is a move into home), one on the flagship with the probe app, one on a disposable customer-shaped instance, and one on a real customer instance.

No run in this runbook can execute today. Every run waits for P-0 below. Each run also has its own blockers, listed at its top. Never run one without Paul's go in the amadan thread. Steps that change a deployment (publishing the floor, switching moves on, stopping a box) each have their own Paul's scoped go step just before them: a go in the amadan thread that names the deployment and exactly what the step changes. A go for one step or one run does not cover another.

The probe app is moveprobe. How to build it, ship it and use it is in cmd/moveprobe/README.md. This runbook does not repeat it.

Every command, flag, event, field and key below was checked against main, and moveprobe's against this branch. The Sources section at the end gives file and line for each.

---

How to read this runbook

Placeholders

| placeholder | what it is | |---|---| | <console> | the deployment's console origin, https://..., as carlos auth login stored it | | <ops> | the ops account's sqid, as --account takes it | | <account>, <app> | a customer run's account sqid and app (Runs 6 and 7) | | <host> | the run's host, <label>.<instance domain> | | <deploy-bucket> | the deployment bucket (CARLOS_DEPLOYMENT_BUCKET in a box's /etc/carlos/host.env) | | <data-bucket-R> | region R's data bucket: data_bucket in that region's box edges file | | <profile> | the deployment's named AWS profile. Always name one. There are no default credentials. | | <move> | the move id the console gave the request (id in the flat view) | | <inc> | the instance incarnation (detail.move.incarnation) | | <pr-R> | the region moveprobe reports on region R's box: home if that box has no CARLOS_REGION (its edges file has no placement), else its CARLOS_REGION, the placement code. <pr-from> and <pr-to> are the run's two. |

The probe's region is not always the region's name

moveprobe reports the region its box gives it, not the name the CLI and the console use. On a home box, which has no CARLOS_REGION, it reports home, while carlos move still says ie (or whatever CONSOLE_HOME_REGION is). Before each deployment's first run, write down <pr-R> for every rehearsal region: read CARLOS_REGION in the box's /etc/carlos/host.env, or placement in its edges file, and confirm with [report]'s region and region_from on any moveprobe host there. Every [report] region check and every MOVEPROBE_FAIL_READY_IN value uses <pr-R>, never the CLI's name.

Read paths

Each check says where to read it.

• [CLI]: the sentence carlos move prints and its exit code. Exit codes: 0 done; 3 rolled back or aborted; 4 waiting (ready for a manual cut, stuck, a release past its deadline, relocating, or an outcome not recorded); 5 refused; 1 the console could not be reached or read; 2 a usage error.
• [detail]: the operator's detail answer. No carlos command prints it yet, so read it with your own login token. Set ACCT and APP for the run: <ops> and moveprobe for Runs 1 to 5, <account> and <app> for Runs 6 and 7.

``sh CONSOLE=<console> ACCT=<ops> APP=moveprobe TOKEN=$(jq -r --arg c "$CONSOLE" '.credentials[] | select(.console == $c) | .token' ~/.carlos/credentials) detail() { curl -fsS -H "Authorization: Bearer $TOKEN" "$CONSOLE/api/cli/apps/$ACCT/$APP/instances/$1/move?detail=1"; } detail <host> | jq . ``

The flat fields (state, phase, id, last) sit at the top. The rest is under detail: move (the record's journal), claim, target_report, source_report, evidence, log (keys only), timings (after the close) and region. detail.move and detail.evidence are gone once the move closes, and a mutation waits until it closes by default. So every run that needs them starts the capture loop below before its cut and reads them from the capture file afterwards.

• [capture]: every detail answer of one move, saved as it happens. Start it in a second terminal once the request has reached ready, before the cut. It stops by itself once no move is in flight. With a third argument it also saves, each time round, the host claim's obligations from the deployment bucket (control/hosts/<host>.json, plain JSON). The detail answer does not carry them, and they are gone once the move closes, so this is the only way to keep a park's horizon and retirement id. Run 3 needs it (R-8):

``sh capture() { # capture <host> <detail-file> [<claim-file>] while :; do if d=$(detail "$1"); then printf '%s\n' "$d" >> "$2" if [ -n "$3" ]; then aws s3 cp --profile <profile> "s3://<deploy-bucket>/control/hosts/$1.json" - \ | jq -c '.obligations // []' >> "$3" fi [ "$(printf '%s' "$d" | jq -r .state)" = none ] && break fi sleep 2 done } capture <host> run-<n>-detail.jsonl # Runs 1, 2, 4, 5 capture <host> run-3-detail.jsonl run-3-claim.jsonl # Run 3 # later: the last rollback journal the move showed jq -s '[.[] | .detail.move.rollback | select(. != null)] | last' run-<n>-detail.jsonl ``

• [deploy]: the deployment bucket, read with --profile <profile>. Each move keeps its reports, stop evidence and log under moves/$ACCT/$APP/<host>/<move>/: source.json, target.json, stopped-source.json, stopped-target.json and log/<identity>.json. The claim is control/hosts/<host>.json, each box's edges file control/edges/<box>.json, each box's identity record control/boxes/<box>.json, and the floor control/moves-protocol.json.

``sh P="moves/$ACCT/$APP/<host>/<move>/" aws s3 ls --profile <profile> "s3://<deploy-bucket>/${P}log/" aws s3 cp --profile <profile> "s3://<deploy-bucket>/${P}log/done.json" - | jq . ``

The roster, control/host-actors.json, is a signed envelope, {"payload": <base64 JSON>, "sig": ...}. Decode the payload to read it (this does not check the signature; the console does). A box's termination fence is a separate object, control/box-fences/<enrollment>.json, using the enrollment from the roster. No object means no fence:

``sh roster() { aws s3 cp --profile <profile> s3://<deploy-bucket>/control/host-actors.json - | jq -r .payload | base64 -d; } roster | jq '.boxes["<box>"] | {state, enrollment, loss_ids, quarantine_revision}' aws s3api head-object --profile <profile> --bucket <deploy-bucket> \ --key "control/box-fences/$(roster | jq -r '.boxes["<box>"].enrollment').json" # 404: no fence ``

• [data]: a region's data bucket, read with --profile <profile>. The instance's replica is under instances/<host>/ (the box's CARLOS_HIBERNATE_PREFIX, instances in production), a move's staging lane under moves/<host>/<move>/, and parked objects under parked/<inc>/<host>/<retirement>/ with a manifest.json. These buckets are versioned, so list versions, not objects:

``sh aws s3api list-object-versions --profile <profile> --bucket <data-bucket-R> --prefix "instances/<host>/" ``

• [report]: moveprobe's own report, with the secret from your shell:

``sh curl -fsS -H "Authorization: Bearer $MOVEPROBE_SECRET" https://<host>/report | jq . ``

• [box]: on a box, the agent's journal (journalctl -u carlos-edge), /etc/carlos/host.env, and files under the data directory (/data).

Log events

Each transition writes one log object, keyed by its identity. The ones the checks use:

| identity (the key) | event (the event field) | when | |---|---|---| | requested | requested | the request was journaled | | ready | ready | the target's checks passed | | cutting-requested | cut_requested | the cut was asked for | | cutting-<phase> | <phase> | admitted, stopping, stopped, staged, archived | | cutting-flipped | flipped | the record now names the target | | landing-<phase> | <phase> | the target's landing steps | | probe_attempt-<n> | probe_attempt | the landing's n-th readiness probe | | committed | committed | the landing committed | | committed-opened | opened | the target opened (offline_s in its fields) | | committed-source_parked | source_parked | the source parked what it held | | rolling_back | rolling_back | a rollback started (reason in its fields) | | rolling_back-target-<phase> | <phase> | released, returning, returned (a dirty rollback only), cleaning, cleaned | | rolling_back-target-lost | declared_lost | the target was declared lost | | rolling_back-source-<phase> | <phase> | the source's recovery, up to recovered and opened | | stuck-<epoch>, retry-<epoch> | stuck, retry | a stuck move and its retry | | done, rolled_back, aborted | the same | the close; done and rolled_back carry the timings |

Every entry's fields carry from, to and, once known, final_txid, db_sha256, timers_sha256, files_plain, installed_db_sha256, release, env_report and cut_budget_s. The close's timings are prepare_s, cut_s, cut_budget_s, land_s, land_budget_s, offline_s, rollback_s and release_budget_s. There is no stray event and no dirty field in the log.

---

P-0: what every run waits for

Nothing below P-0 runs until every item here is true. Paul confirms P-0 per deployment before its first run.

• [ ] Claim Plan 12 merged. Without it the landing, the target's half of a rollback and the source's recovery are unarmed in production, so a move with the switch on stops the source, flips, and then has nothing to land it, roll it back or recover it.
• [ ] Moves Plan 5 Task 9b, Plan 4 Tasks 9 and 10 (the box half), and Plan 5 Task 8 merged. They wire moves onto claim Plan 12. Run 4 also needs claim Plan 12's loss-bound admission.
• [ ] The moves cut guard merged. It is on main (b04ff852, Paul's ruling of 2026-10-11). The source refuses a cut unless the target reports its landing armed (the T13 check), and records why a cut did not start.
• [ ] Moves' post-Plan 12 branch merged (moves-phase1-5f). It brings the wake source, the recovery owners, the loss rules, the root held release (T7 stages, configured publishes, through root's control socket) and the C8 files-manifest provider.
• [ ] For any run that touches the home region: the home-region parks fix part 1 merged (#236, on main as 359e8ac2) and claim Plan 13's home naming (a0806e4c, follow-ups 2ad5412c). Part 1 covers moves out of home. Any run that moves into home also needs part 2 (2026-10-15-moves-home-region-part2.md) merged and rolled, boxes first, then consoles. The door refuses moves into home without host claims (MV-N510). A home box arms only when the claim grants it the @home alias, which needs the signed fleet home designation. Plan 13's rollout order is binding: every roster reader on a Plan 13 build first, then publish the designation, then turn the flag on. Older binaries cannot read a roster that carries home_region. For moves into home, the whole order is: 1. Plan 13 on every box and console. Check each box reads current with carlos system status. Plan 13's own order applies inside this step. 2. Part 2 merged (dormant), released, and rolled boxes first, then consoles. A console rolled first could admit a move into a home box that still fails T3, and that move waits at preparing until an operator aborts it. 3. The IAM mesh, including the home data bucket (P-2), applied by Paul with a scoped tofu apply -target. 4. Claim activation (#250), which publishes the signed designation. Until then a home box never arms, and the door refuses claim-mode moves with MV-N177. 5. CARLOS_MOVES_PHASE1 per run, as P-7 says.
• [ ] The claim's activation checklist (#250) done for this deployment. Among its items: - the one-time files-manifest backfill for every host older than the files publisher. Until it has run for a host, that host refuses to wake (ErrNoEvidence), by design; - claim Plan 15's admitted-generation record, so hosts with history past the eight-admission window can prove their file origins. Until then those hosts refuse; - claim Plan 14 (#280), so that root trusts no service-owned state; - CARLOS_RELEASE_PUBKEY readable by instance control (/etc/carlos/host.env), or every held release is refused; - with CARLOS_MOVES_PHASE1 on, a usable CARLOS_SECRETS_KEY on every box. Without it the moves source refuses to open and the box serves nothing. Its log names the cause once per start.
• [ ] All of the above released and rolled, consoles first, then every box. Check every box with carlos system status --console <console>: each reads current on the new version.
• [ ] Each deployment's home region recorded: CONSOLE_HOME_REGION in the console's environment. A box with no CARLOS_REGION in its host.env publishes no placement in its edges file: it is a home box.
• [ ] Dev's home region has two boxes: wake rehearsal apps on one. While dev's claim is off, both home boxes (carlos-dev-ie and carlos-dev-ie-b) take every unregioned record. A wake that switches box can serve a stale local DB (amadan #286; activator.go, "only while a region has one box"). So rehearsal apps in dev's home region are woken on one box only, or the run waits for dev's claim. #286 ruled this a dev-only hazard, accepted. During a window under the procedure in the next item, carlos-dev-ie-b is stopped, so this holds by itself.
• [ ] One placementless box per deployment. For each deployment, list control/edges/ and record that exactly one edges file has no placement:

``sh for k in $(aws s3api list-objects-v2 --profile <profile> --bucket <deploy-bucket> \ --prefix control/edges/ --query 'Contents[].Key' --output text); do printf '%s %s\n' "$k" "$(aws s3 cp --profile <profile> s3://<deploy-bucket>/$k - | jq -r '.placement // "(none)"')" done ``

S1 and T8 refuse a move into or out of home while two do, whether or not the second box is running, because an edges file outlives its box. They count every edges file per placement, fresh or not. A retained file below the floor makes the door refuse with MV-N5.

On dev, carlos-dev-ie-b makes two. Ruling R2 (option a) applies to every dev run that touches home, Run 1 included. Each window needs Paul's scoped go in the amadan thread, naming dev and carlos-dev-ie-b. The procedure, as the ruling gives it:

1. stop carlos-dev-ie-b (the instance, or at least its agent and console units, so it neither writes status nor serves); 2. delete control/edges/carlos-dev-ie-b.json from the deployment bucket; 3. wait until its last status/boxes/carlos-dev-ie-b.json is more than 15 minutes old by its generated_at; 4. before each run, verify the fleet's evidence is complete: every box with a status snapshot fresher than 15 minutes has an edges file, every edges file's box has a status snapshot, and exactly one edges file has no placement. The door's own confirmation is the run's S-2, the move request itself. Only a move request runs selectMoveBoxes and the floor check: carlos move status (handleAPIInstanceMoveStatus) reads the record and claim only, and S-1 only wakes the app, so neither confirms anything here. If S-2 answers "the fleet's edges files could not all be read" or MV-N5, the window is not ready. Both refusals come before any claim read or write, so nothing was started: fix the evidence and repeat S-2; 5. after the window, start the box again. Its edges pass rewrites the file on boot. No move touching home runs until the window is reopened by steps 1 to 4.

Step 3's wait matters. If the edges file is deleted while the box's status snapshot is still fresh, the door reads the fleet's evidence as incomplete and refuses every move.

• [ ] Rehearsal boxes keep instances flat. Moves refuse a nested instance. Set CARLOS_LAYOUT_DEFAULT=flat in each rehearsal box's host.env. Pre-flight check, before any request: carlos status --layout --console <console> (the layout each host is actually on, box by box) shows every rehearsal host's row as flat, and no rehearsal box is marked "(nested by default)". carlos system layout status is not this check: it shows only the recorded intent. Once a run's request exists, S-2 also checks detail.source_report.s1.ok, the source's own refusal of a nested instance.
• [ ] Never set CARLOS_MOVES_PHASE1=on anywhere before P-0 is true.

---

Preconditions, once per deployment

P-1 The dormant release

• [ ] The release carrying P-0 is rolled with CARLOS_MOVES_PHASE1 unset everywhere: consoles first, then boxes.
• [ ] [deploy] Every box's control/edges/<box>.json has "moves_protocol": 1.

P-2 Staging grants (§15 step 5, scoped tofu by Paul)

• [ ] Every rehearsal region's sibling_staging_arns lists every other rehearsal region's data bucket, and each box has the versioned-object grants (s3:ListBucketVersions, s3:GetObjectVersion, s3:DeleteObjectVersion on its own bucket; s3:GetObjectVersion for the console).
• [ ] The home data bucket is in the mesh. Every named region's sibling_staging_arns lists the home data bucket's ARN, and the home's lists every named region's data bucket. Record the home data bucket's name (data_bucket in the home box's edges file, the one with no placement): ____. Check that it is not the deployment bucket (<deploy-bucket>). Without the mesh, a move into home fails the source's lane round with AccessDenied (logged), or T10 fails on the home box.
• [ ] Check after the first request reaches ready: [detail] detail.target_report.checks.T10.ok is true (the lane probe).

P-3 The protocol floor

Publish the floor only after every box and the console run a tagged vX.Y.Z release at or above min_release. Once a floor is armed, any build that is not vX.Y.Z (a SHA build, dev, a prerelease) is refused at activation, and the door treats that box as below the floor. A box never lowers its local floor on its own. If dev keeps rolling SHA builds, dev's runs go without a floor, and P-3 is done on the flagship only, before Run 5 (§15 step 6).

• [ ] Paul's scoped go in the amadan thread to publish the floor on this deployment, naming the deployment and min_release. Nothing below runs without it.
• [ ] Write it create-only from an operator shell. No carlos command writes it (a gap to note on an amadan discussion).

``sh printf '{"min":1,"min_release":"vX.Y.Z"}' > floor.json aws s3api put-object --profile <profile> --bucket <deploy-bucket> \ --key control/moves-protocol.json --body floor.json --if-none-match '*' aws s3 cp --profile <profile> s3://<deploy-bucket>/control/moves-protocol.json - ``

• [ ] [deploy] Every box's edges file shows moves_floor_min_release equal to the floor's min_release, and either "prev_release": "none" or prev_allowed_for equal to min_release. A box that does not is below the floor for the door (MV-N5).

P-4 Ship moveprobe

• [ ] Follow cmd/moveprobe/README.md ("Build" and "Deploy") under the ops account: ship, enable instances with private storage off, create the store with --env-prefix MOVEPROBE and no --environment, set MOVEPROBE_SECRET, and set the every-minute schedule.
• [ ] Keep MOVEPROBE_SECRET's value in your shell. /report and /arm-once need it.
• [ ] Leave moves.ready_path unset. A move then probes /, which answers as /ready does.

P-5 Rehearsal hosts, created before the claim

A host created while CARLOS_HOST_CLAIM is on keeps its data under a per-incarnation path, and the move door refuses it with MV-N167: "the instance keeps its data under a per-incarnation path, which moves cannot cut yet". So every rehearsal host is created before the claim goes on for its deployment (Paul, N2(a)).

• [ ] Before CARLOS_HOST_CLAIM goes on, create one moveprobe host per planned run, in the region that run starts from, plus two spares:

``sh carlos instances create --app moveprobe --account <ops> --host <label>.<instance domain> --region <region> ``

On dev, create at least one spare in ie. If Run 1b fails, its repeat is Run 1 and then Run 1b on a fresh host that starts in ie, and no host can be created once the claim is on.

On the flagship, also create Run 6's disposable customer-shaped instance now.

• [ ] Record the list of hosts, with the run each one is for, in the deployment's rehearsal record (outside this repo). Never reuse a host. A host that has run once is spent, whatever the outcome. The one exception is Run 1b, which moves Run 1's host back into home (Ruling R6).
• [ ] After the claim is on, check each host is adopted: [deploy] control/hosts/<host>.json exists, holder.location is instances/<host> (not instances/<host>/<inc>), and op.kind is serving. The console's claim recovery pass adopts them.

P-6 The rest of the fleet's preconditions

Paul confirms each of these per deployment before its first run.

• [ ] Claim on. CARLOS_HOST_CLAIM is set (any non-empty value) in the console's environment and every box's host.env. Check: [box] on each box and the console. #250's activation blockers are closed.
• [ ] Roster. Each rehearsal box is an active, enrolled entry with no termination fence. Check: [deploy] the decoded roster (roster above) has boxes.<box>.state active and boxes.<box>.enrollment set, and control/box-fences/<enrollment>.json does not exist.
• [ ] Box identity records. CARLOS_REGION_HA=true in each rehearsal box's host.env. It takes true, 1 or t; on reads as off. CARLOS_AWS_ACCOUNT is set in the console's environment. Check: [deploy] control/boxes/<box>.json exists for each rehearsal box, and its edges file has "capabilities": ["region-ha-1"].
• [ ] One eligible box per rehearsal region. Any other box in a rehearsal region runs without CARLOS_REGION_HA, so it publishes no region-ha-1 and is not eligible. Otherwise the door answers M-C21.
• [ ] Secrets key. CARLOS_SECRETS_KEY on every rehearsal box, from the same key pair as the console's. Check: [deploy] each edges file's secrets_key_fp is the same; once the switch is on, it equals secrets_key_fp in control/moves-console.json; [detail] detail.target_report.checks.T2.ok is true.
• [ ] Staging bucket. Each rehearsal box's edges file has data_bucket set.
• [ ] Alert sinks. CARLOS_ALERT_WEBHOOK or CARLOS_ALERT_SNS_TOPIC_ARN is set on every rehearsal box and on the console. Without one, pages go nowhere.
• [ ] Cgroup delegation. Check: [box] journalctl -u carlos-edge -b | grep 'exec-child accounting' shows armed (delegated subtree ...). A box without it cannot produce stop evidence and never cuts.
• [ ] Flat rows and tagged releases, as P-0 and P-3 say.

P-7 The switch

• [ ] P-0 to P-6 are done for this deployment.
• [ ] The moves copy record is fully approved: no row in docs/superpowers/plans/2026-10-06-moves-phase1-copy.md is pending (grep -c '| pending |' on it prints 0). The switch never goes on while a sentence an operator could read is unapproved.
• [ ] Paul's scoped go in the amadan thread to switch moves on, naming the deployment, the console and the boxes.
• [ ] CARLOS_MOVES_PHASE1=on in the environment of the console and of the boxes the go names, and nowhere else, then restart them.
• [ ] Check: carlos move status --app moveprobe --account <ops> --host <host> does not say "Moves are not enabled on this console."

---

Between runs

Before starting the next run, wait until all of these hold for the host the last run used:

• [ ] [detail] state is none (no move in flight) and last.outcome is recorded.
• [ ] [detail] detail.claim.kind is serving.
• [ ] [deploy] the claim's quiet_after for the region the next move goes to has passed (T12). It is set when an instance leaves a region and lasts about 16 minutes. With a fresh host per run it rarely bites, but check it.
• [ ] MOVEPROBE_FAIL_READY_IN is unset: carlos env list --app moveprobe --account <ops> does not show it.

---

The steps and checks each run uses

Runs refer to these by number. <from> and <to> are the run's regions.

Steps

• S-1 Wake and record. curl https://<host>/ready answers ready. Save [report] as before-request.json.
• S-2 Request.

``sh carlos move --app moveprobe --account <ops> --host <host> --to <to> --manual-cut ``

[CLI] M-C1 ("Moving <host> from <from> to <to>."), M-C2, M-C3, then M-C12 ("Ready to cut. ..."), exit 4. A line "<to> cannot take this move yet: <check>." is M-C4 and names the failing check. [detail] at ready: every detail.target_report.checks.T1 to T12 has ok: true (and T13 once the cut guard lands); detail.target_report.attempts_admitted is at least 1; detail.source_report.s1.ok and s2.ok are true. Record id as <move> and detail.move.incarnation as <inc>.

• S-3 Record and arm. Save [report] as before-cut.json. Arm the once-timer so it falls due around the cut, then cut within a few seconds:

``sh curl -fsS -X POST -H "Authorization: Bearer $MOVEPROBE_SECRET" "https://<host>/arm-once?in=30" ``

Record the answer's name and due_at.

• S-4 Capture, then cut. In a second terminal, start [capture] for this run: capture <host> run-<n>-detail.jsonl. Then, in the first:

``sh carlos move cut --app moveprobe --account <ops> --host <host> ``

The cut waits until the move ends or needs an operator. The expected sentences and exit code are in each run. Every run captures, so that whatever the record held while the move was live (the evidence keys, the rollback journal, a loss) can still be read after it closes.

Checks after a commit

• R-1 State arrived. [report] on the target: region is <pr-to>; file_key_sha256 and platform_key_sha256 equal before-cut.json's; object has no error and its body names this boot and <pr-to>; has_secret is true. curl https://<host>/ready answers ready.
• R-2 No row lost. [report] for bg and for worker: the sum of count over all regions is at least before-cut.json's, and equals the highest max_seq (rows are numbered from 1 in one sequence per kind, so any gap shows here).
• R-3 The schedule continues. [report] rows has kind: tick with region: <pr-to>, and its count rises about once a minute for three minutes after the open. Every fired entry has count: 1. A minute that fell due while the instance was offline fires at most once after the open, and minutes in between are not replayed, so a short gap around the cut is expected. A due time that fired twice fails the run.
• R-4 The once-timer fired once. [report] fired has exactly one entry with S-3's name, its due_at equals S-3's, and its count is 1.
• R-5 The source holds nothing live. After [deploy] log/committed-source_parked.json and log/done.json exist: [data] list-object-versions on <data-bucket-from> under instances/<host>/ returns no versions and no delete markers, and parked/<inc>/<host>/ holds the retired replica objects with a manifest.json. [deploy] the claim's obligations is empty.
• R-6 The source really stopped. [deploy] stopped-source.json (the key [capture] shows as detail.evidence.source) has steps.tree.ok and steps.stray.ok both true and no stray field. [box] on the source box, the journal has no "the instance is not proven stopped yet" line for <host> and no M-C20 line ("... is running a process for <host> that this move cannot account for. ..."), and /data/.moves/.page-outbox/<host>/<move>/stray.json does not exist. The moveprobe worker outlives its app on purpose, so a worker that survived the stop fails the cut's tree step and shows here, then reverts at the cut's deadline. It does not page.

Checks after a rollback (Runs 2, 3 and 4)

R-1 to R-4 and R-6 apply as written, with the source (where the instance is back) in place of the target: <pr-from> in place of <pr-to> in R-1 and R-3. R-5 is replaced:

• R-5b The target holds nothing live. After [deploy] log/rolling_back-target-cleaned.json and log/rolled_back.json exist: [data] list-object-versions on <data-bucket-to> under instances/<host>/ and under moves/<host>/<move>/ returns no versions and no delete markers.
• R-7 The target's writes came back (dirty rollbacks only). [report] on the source: rows has a bg row with region: <pr-to> (the target's probe region, home if the target is the home box), written on the target while it ran there.
• R-8 The return lane is parked (dirty rollbacks only). A dirty rollback returns the target's writes through its own lane, moves/<host>/<rb>/ in the source's data bucket, where <rb> is the rollback's id (from [capture]: the last rollback journal's id). The source queues the lane's park in the host claim when it has probed. The park runs only after its horizon (the return seal's bound) plus the signature age (15 minutes) and the request limit (2 minutes), and the rollback does not close until every obligation of the move is acknowledged. So expect the cut's wait to last at least that long. The obligation exists only while the move is live, so read it from the claim file [capture] saved, never from the bucket afterwards:

``sh jq -s --arg loc "moves/<host>/<rb>" '[.[][] | select(.park.location == $loc)] | first' run-3-claim.jsonl ``

It has kind park-replica, region set to the source box's CARLOS_REGION (absent when the source is the home box), an id, a retirement, and park with location, incarnation, evidence_at and request_limit_ns. Record retirement as <ret>, park.incarnation as <pinc> and park.evidence_at. An empty answer means the capture missed the obligation: the check fails, and the run is repeated on a spare host with the claim capture running. After park.evidence_at plus 15 minutes plus request_limit_ns, and once log/rolled_back.json exists: [data] list-object-versions on <data-bucket-from> under moves/<host>/<rb>/ returns no versions and no delete markers, and parked/<pinc>/<host>/<ret>/manifest.json exists in <data-bucket-from>.

A clean rollback needs two things: the stopped target's digests equal what the landing installed, and src_covered (the source's own replica reached the stopped position). The target box logs both: [box] journalctl -u carlos-edge | grep 'the target of rollback' shows "... stopped at TXID <n> (clean <bool>, src_covered <bool>)".

---

Dev (Runs 1 to 4)

Dev topology (Paul, N4). Dev's second region is applied: uk, eu-west-2, box carlos-dev-uk, data bucket carlos-dev-uk-640012953448 (platform-infrastructure#42). Before Run 1:

• [x] Bootstrap carlos-dev-uk. Done 2026-10-15: box dennis-stenciling on v0.27.3, with CARLOS_SWAP=overlap and CARLOS_REGION=uk.
• [x] SSM parameters: nothing to copy. No box reads SSM at boot or at runtime. Never copy /carlos/release-key to a region whose host role can read /carlos/*. In eu-west-2 the carlos-dev-uk role can.
• [x] carlos-dev-uk needs the dev console's CARLOS_SECRETS_KEY before Run 1 (T2 and config sync). Done 2026-10-15: dennis-stenciling got the dev key through SSM eu-west-2 /carlos/secrets-key. Its secrets_key_fp is sha256:bb067582…f5fe, the same as sophie's. The key is backed up in 1Password as "CARLOSSECRETSKEY dev".
• [ ] CARLOS_REGION_HA=true on carlos-dev-ie and carlos-dev-uk, and CARLOS_AWS_ACCOUNT on the dev console.
• [ ] Keep carlos-dev-ie-b ineligible: no CARLOS_REGION_HA in its host.env, so ie has one eligible box (M-C21).
• [ ] Decide Runs 2 and 3's arrangement (see "Runs 2 and 3: the regions"), then create the dev rehearsal hosts (P-5) after carlos-dev-uk serves and before dev's claim goes on: Run 1's and Run 4's in ie, Runs 2 and 3's in their arrangement's <from>, and two spares, at least one of them in ie (P-5).

Dev's home region. Dev Ireland is probably the home region (its box has no CARLOS_REGION). Confirm it with the dev console's CONSOLE_HOME_REGION and record it here: ____. If ie is home:

• Every dev run touches home, so every dev run needs P-0's one-placementless-box item: Ruling R2's procedure for carlos-dev-ie-b, Run 1 included.
• Run 1 (ie to uk) moves out of home and needs home fix part 1.
• Run 1b (uk to ie) moves Run 1's host back into home. It needs home fix part 2 rolled and dev's designation published.
• Run 4 (ie to uk) moves out of home and then rolls back into it. It needs part 1, and part 1 must cover a rollback whose source is home. It stays out of home even once part 2 is rolled (Ruling R6), because dev's console runs on the home box.
• Runs 2 and 3 as written (uk to ie) move into home and need home fix part 2. Once part 2 is rolled, they run as written.
• Until part 2 is rolled, only out-of-home moves run. Run 1 goes ahead on part 1. Runs 2 and 3 then use the out-of-home arrangement: the host is created in ie, the move goes ie to uk, and the failure switch names <pr-uk>. Each rolls back into a home source, as Run 4 does, so this needs part 1 to cover a rollback whose source is home. Part 1 is on main as 359e8ac2. Check in its own tests that it covers this before the first such run. If it does not, Runs 2, 3 and 4 all wait for the fix that does.
• Run 4 runs only after Runs 1, 1b, 2 and 3 have passed, Runs 2 and 3 in whichever arrangement they ran. No run is skipped.
• On the home box, moveprobe reports home, so <pr-ie> is home. Any [report] check or MOVEPROBE_FAIL_READY_IN aimed at that box uses home, never ie.

Record the dev probe regions here: <pr-ie> = ____, <pr-uk> = ____.

If ie is not home, the runs go as written and need no home fix.

Run 1: dev, ie to uk, a commit

Blockers: P-0; home fix part 1 if ie is home; if ie is home, P-0's one-placementless-box item, with Ruling R2's window open for carlos-dev-ie-b; dev topology above; P-1 to P-7 on dev; Paul's go.

• [ ] Host used: ____ (created in ie before the claim). Run 1b moves this host back.
• [ ] S-1, S-2 with --to uk.
• [ ] S-3, S-4. [CLI] M-C5 ("uk is ready. Starting the cut. <host> will be offline for about <estimate>."), M-C6 ("Stopped in ie. Starting in uk."), M-C7 ("Moved. <host> is served from uk. It was offline for <seconds> seconds."), exit 0.
• [ ] R-1 to R-6.
• [ ] [deploy] log/ has cutting-flipped, committed, committed-opened, committed-source_parked and done. [detail] last.outcome is done; detail.timings holds offline_s and cut_budget_s.

Run 1b: dev, uk to ie, a commit into home

Blockers: Run 1 passed; Run 1's quiet window has passed (T12, see "Between runs"); home fix part 2 merged and rolled, boxes first, then consoles; the fleet home designation published on dev (claim activation, #250); P-0's one-placementless-box item, with Ruling R2's window open for carlos-dev-ie-b; P-2's home data bucket item; Paul's go.

This run moves Run 1's host back into home (Ruling R6). It is the one host this runbook uses twice (P-5). It has the same checks as Run 1, with <pr-ie> = home.

Note for the operator (Ruling R7). Where the console shares the home box, as dev's does, the landing runs on the console's own box. If that box dies mid-landing, the console's move pass stops with it until the box or the console is back. The record and the claim are durable, so nothing is lost, but recovery waits for the console's return.

• [ ] Host used: Run 1's, ____.
• [ ] Before the request, record the claim's touched regions and quiet windows:

``sh aws s3 cp --profile <profile> s3://<deploy-bucket>/control/hosts/<host>.json - | jq '{regions: .touched.regions, quiet_after}' ``

• [ ] S-1, S-2 with --to ie. Name the home by its configured name. There is no home keyword, because a named region may be called home (Ruling R3). If S-2 refuses, the sentence says what is missing: - MV-N510 ("moves into the home region need host claims. this console runs without them"): the console runs without CARLOS_HOST_CLAIM; - MV-N511 ("<box> sets CARLOS_REGION, so it cannot take a move into the home region"): a box's edges file names ie as its placement. That box is not the home box. Fix its host.env, or delete its edges file if the box is gone; - MV-N177 ("the host roster does not allow this move. the source and target must be active boxes in uk and ie"): the roster has no home designation, or the console's home name differs from it; - "the fleet's edges files could not all be read" or MV-N5: Ruling R2's window is not ready (P-0, step 4).

Each of these refusals comes before any claim write.

• [ ] At ready, the staging lane is in the home data bucket: [data] list-object-versions on <data-bucket-ie> (the home data bucket P-2 recorded) with --prefix "moves/<host>/<move>/" returns versions.
• [ ] S-3, S-4. [CLI] M-C5 ("ie is ready. Starting the cut. <host> will be offline for about <estimate>."), M-C6 ("Stopped in uk. Starting in ie."), M-C7 ("Moved. <host> is served from ie. It was offline for <seconds> seconds."), exit 0.
• [ ] R-1 to R-6, with <pr-to> = home.
• [ ] [deploy] log/ has cutting-flipped, committed, committed-opened, committed-source_parked and done. [detail] last.outcome is done; detail.timings holds offline_s and cut_budget_s.
• [ ] [deploy] the claim's touched.regions holds at least one spelling of home: ie, @home, or both. Touch adds @home when the target box is new to touched, and never removes ie. Every region it held before the request is still there.
• [ ] [deploy] the claim's quiet_after names uk.
• [ ] After the close: [data] list-object-versions on <data-bucket-ie> under parked/<inc>/<host>/ holds the residue of Run 1's stay in home, if there was any.
• [ ] If any check fails, repeat Run 1 on a spare host created in ie, then Run 1b on that host.

Runs 2 and 3: the regions

Runs 2 and 3 use one of two arrangements, chosen before the dev hosts are created (see "Dev's home region"):

• As written: the host is created in uk, and the move goes uk to ie. Needs home fix part 2 if ie is home. Once part 2 is rolled, Runs 2 and 3 run as written, and they wait for Run 1b: the first move into home is Run 1b's plain commit, never a forced rollback.
• Out of home (ie is home and part 2 is not rolled): the host is created in ie, and the move goes ie to uk. Needs part 1 to cover a rollback whose source is home. This stays the fallback while part 2 is not rolled.

Below, <from> and <to> are the arrangement's regions as the CLI names them, and <pr-from>, <pr-to> their probe regions. Record the arrangement used in each run.

Run 2: dev, forced clean rollback

Blockers: P-0; the home fix its arrangement needs (above); if ie is home, P-0's one-placementless-box item, with Ruling R2's window open for carlos-dev-ie-b; Run 1 passed; in the as-written arrangement, Run 1b passed (the first move into home is a plain commit); Paul's go.

The target fails its readiness check in before-write mode, so it writes nothing and the rollback should be clean.

• [ ] Arrangement: ____. Host used: ____ (created in <from> before the claim).
• [ ] Before the request, set the failure switch to the target's probe region:

``sh carlos env set --app moveprobe --account <ops> MOVEPROBE_FAIL_READY_IN=<pr-to> ``

The variable is app-wide. Any moveprobe instance that starts in that region while it is set answers 503 and writes nothing. That is expected.

• [ ] S-1, S-2 with --to <to>, S-3, S-4 (capture first). [CLI] M-C8 ("<to> could not start <host>: <reason>. Moving it back to <from>."), then M-C9 ("<host> is back in <from> and serving. Nothing was lost."), exit 3.
• [ ] From [capture], once the cut has returned and the capture has stopped: the last rollback journal has target_phase released or later, and dirty absent or false. Record its id as <rb>, and the last detail.evidence.target.
• [ ] Digests: [deploy] stopped-target.json's db_sha256, files_plain and timers_sha256 equal log/rolling_back-target-released.json's fields installed_db_sha256, files_plain and timers_sha256.
• [ ] [box] on the <to> box: "clean true, src_covered true".
• [ ] R-1 to R-4 and R-6 on <from> (probe region <pr-from>), R-5b on <to>.
• [ ] [deploy] log/ has rolling_back, rolling_back-target-released, rolling_back-target-cleaned, rolling_back-source-opened and rolled_back, and no rolling_back-target-returning.
• [ ] After the checks are recorded:

``sh carlos env unset --app moveprobe --account <ops> MOVEPROBE_FAIL_READY_IN ``

A dirty result here, with moveprobe in before-write mode, is a platform finding, not a probe failure. Stop the series and report it.

Run 3: dev, forced dirty rollback

Blockers: P-0; the home fix its arrangement needs; if ie is home, P-0's one-placementless-box item, with Ruling R2's window open for carlos-dev-ie-b; Run 2 passed; Paul's go.

The target writes one row, starts its worker, and then fails readiness, so the rollback is dirty and the target's writes must come back.

• [ ] Arrangement: ____. Host used: ____ (created in <from> before the claim).
• [ ] Before the request:

``sh carlos env set --app moveprobe --account <ops> MOVEPROBE_FAIL_READY_IN=<pr-to>,after-write ``

• [ ] S-1, S-2 with --to <to>, S-3, S-4, with the capture started with its claim file: capture <host> run-3-detail.jsonl run-3-claim.jsonl. [CLI] M-C8, then M-C9, exit 3. The cut's wait includes the return lane's park horizon (R-8), about 17 minutes or more.
• [ ] From [capture]: the last rollback journal has target_phase released or later and dirty true. Record its id as <rb> before anything else; R-8 needs it.
• [ ] Digests: [deploy] stopped-target.json's db_sha256 differs from log/rolling_back-target-released.json's installed_db_sha256 (the target wrote).
• [ ] [box] on the <to> box: "clean false".
• [ ] [deploy] log/ has rolling_back-target-returning and rolling_back-target-returned, then rolling_back-target-cleaned and rolled_back.
• [ ] R-1 to R-4 and R-6 on <from> (probe region <pr-from>), R-5b on <to>, R-7 (a bg row with region: <pr-to>), and R-8 on <from> (the return lane moves/<host>/<rb>/ in <data-bucket-from>).
• [ ] Unset MOVEPROBE_FAIL_READY_IN once the checks are recorded.

Run 4: dev, declare-lost

Blockers: P-0, including claim Plan 12's loss-bound admission and Plan 4 Task 10's box half; home fix part 1 if ie is home, covering a rollback whose source is home; if ie is home, P-0's one-placementless-box item, with Ruling R2's window open for carlos-dev-ie-b; Runs 1, 1b, 2 and 3 passed (Runs 2 and 3 in whichever arrangement they ran; Run 4 is never run ahead of them); Paul's go.

The target box is stopped mid-move and declared lost. With only two dev regions, the target is carlos-dev-uk, and uk has no eligible box until the readmit at the end. Stop the box. Do not terminate it. A terminated box cannot be readmitted.

Run 4 stays ie to uk even once part 2 is rolled (Ruling R6). It never stops the home box: dev's console runs there, so a declare-lost of the home box would stop the console too. It does not move into home itself.

• [ ] Host used: ____ (created in ie before the claim).
• [ ] Paul's scoped go in the amadan thread, before anything below, to stop carlos-dev-uk during this run and take it out of service until the readmit.
• [ ] So the landing cannot commit before the box stops, set the failure switch on the target first:

``sh carlos env set --app moveprobe --account <ops> MOVEPROBE_FAIL_READY_IN=<pr-uk> ``

Its probe then fails however long the stop takes. If the target finishes its release before the box stops, the run is an ordinary clean rollback: record it and repeat Run 4 on a spare host.

• [ ] Before the run, record the box's roster entry: [deploy] roster | jq '.boxes["carlos-dev-uk"]' shows state active; note its enrollment and quarantine_revision.
• [ ] S-1, S-2 with --to uk, S-3, S-4 (capture first). The capture runs until the move closes, through the declaration below.
• [ ] When [capture] shows state landing (after cutting-flipped), stop carlos-dev-uk through the AWS console (dev only).
• [ ] The cut's wait ends with M-C10 ("Waiting for carlos-dev-uk in uk to confirm it has stopped <host>. <host> is offline."), exit 4. Until the landing deadline passes, it keeps waiting.
• [ ] Declare it lost, with your own AWS credentials for dev in the shell (the command reads EC2 with them and refuses to run as root):

``sh carlos move resolve --app moveprobe --account <ops> --host <host> --declare-lost carlos-dev-uk ``

[CLI] M-C18 ("This declares carlos-dev-uk lost. Anything <host> wrote on carlos-dev-uk after <time> is lost. Type the host name to confirm."). Type <host>. The command then waits for the outcome: expect M-C9 and exit 3.

• [ ] Expected outcome: rolled back, with the loss on the record, not necessarily clean. From [capture]: the last rollback journal has loss_ref and lost_at set; record them and its id. [deploy] log/rolling_back-target-lost.json (event declared_lost) and log/rolled_back.json exist. [deploy] the decoded roster: boxes.carlos-dev-uk.state is quarantined, quarantine_revision is one more than before, and loss_ids holds the loss.
• [ ] R-1 to R-4 and R-6 on ie, with probe region <pr-ie> (home if ie is home).
• [ ] Unset MOVEPROBE_FAIL_READY_IN.
• [ ] Start carlos-dev-uk again. It stays quarantined: the deployment's admission gate refuses it for every host until the readmit. Watch [box] its journal from boot, and record anything it does for <host> before the readmit. Doing anything for it there is a finding.
• [ ] [deploy] the box retires its local state first and records it: control/host-retirement/carlos-dev-uk/<enrollment>/<quarantine_revision>.json exists with "complete": true and this boot's boot_id. Readmit refuses without it.
• [ ] Readmit it. carlos ops host exists only with CARLOS_HOST_CLAIM set in your shell:

``sh CARLOS_HOST_CLAIM=1 carlos ops host resolve <host> --readmit carlos-dev-uk --console <console> ``

Answer readmit at its prompt. The box must be running and reporting: readmit refuses a box with a termination fence, and one whose private report is older than 15 minutes. Before it, check [deploy] control/box-fences/<enrollment>.json does not exist (a stopped box has none; a terminated one does).

• [ ] [deploy] the decoded roster: boxes.carlos-dev-uk.state is active again, with the same enrollment.

---

Flagship (Run 5)

Run 5: the flagship, Runs 1 to 3 again

Blockers: P-0; P-1 to P-6 on the flagship; P-3, the floor, published (§15 step 6: before any protected production rehearsal); the moves copy record fully approved (no pending row); dev Runs 1 to 4 passed (each run gates the next, spec §15 step 7; claim Plan 8b is on main, so the old clause that let Run 5 go ahead with Run 4 skipped no longer applies); Paul's explicit go in the thread, for each of the three.

• The switch (Paul, N17): CARLOS_MOVES_PHASE1=on in the environment of the console and of the two boxes in play, and nowhere else. The compiled default stays off. It flips later, in its own commit.
• Regions (N3): the flagship's home is Ireland, so Run 5 uses two non-home regions, uk and us, until the home fix parts land. Run 1's shape goes uk to us. Runs 2 and 3 go us to uk, with MOVEPROBE_FAIL_READY_IN=<pr-uk> and <pr-uk>,after-write. Record the flagship's probe regions: <pr-uk> = ____, <pr-us> = ____.

• [ ] P-3 on the flagship, after its own scoped go.
• [ ] P-7 on the flagship: the copy record fully approved, then Paul's scoped go naming the console and the uk and us boxes, then the switch on those three only.
• [ ] Hosts used: Run 1 shape ____ (created in uk), Run 2 shape ____ and Run 3 shape ____ (created in us), all before the flagship's claim went on.
• [ ] Each of the three as on dev, with every check.
• [ ] After the third, and only once all three moves are closed: for each of the three hosts, [detail] state is none (no move in flight) and detail.claim.kind is serving. If any move is unfinished (stuck, a release past its deadline, relocating, or any exit 4), leave the switch on and resolve it first with carlos move resolve (--retry once the cause is fixed, or --declare-lost <box> for a lost target), each with Paul's scoped go in the thread. The switch must stay on until the move is closed: with it off, a box's moves pass skips every Phase 1 record, so an unfinished move would stop being reconciled and stay where it is.
• [ ] Then remove CARLOS_MOVES_PHASE1 from the two boxes and the console unless Paul says to keep it, and restart them. Check: carlos move status --app moveprobe --account <ops> --host <host> says "Moves are not enabled on this console.", and neither box's host.env still sets it.

---

Customer instances (Runs 6 and 7)

The runbook names no tenant. The real instances, their owners and the agreed windows live in the flagship's deployment repo and in the amadan thread where Paul gives each go.

These runs move a customer's app, not moveprobe. Do not call /ready, /arm-once or /report on a customer host, and do not set MOVEPROBE_FAIL_READY_IN. Those are moveprobe's own, and S-1, S-3, R-1 to R-4 and R-7 do not apply. Set ACCT=<account> and APP=<app> for [detail], [capture] and the log prefix, and use --app <app> --account <account> on every command. <from> and <to> are the regions Paul approves for the run.

Customer steps

• C-0 Switch on for this run only. Run 5's switch was removed after it, and this run's participants differ (the source is the home box). - The moves copy record is fully approved (P-7). - Paul's scoped go in the amadan thread naming the flagship, this run, the console, and this run's two participant boxes: the source box in <from> (the instance's box now) and the target box in <to>. - CARLOS_MOVES_PHASE1=on in the environment of the console and of those two boxes, and nowhere else; restart them. - Check: carlos move status --app <app> --account <account> --host <host> does not say "Moves are not enabled on this console." [box] each of the two boxes' host.env sets it, and no other box's does.
• C-1 Health check, before. The owner names one health check for the instance (a URL and the answer that means it is serving) and approves it for the run. Record it in the deployment repo. Run it and record the answer.
• C-2 Request.

``sh carlos move --app <app> --account <account> --host <host> --to <to> --manual-cut ``

[CLI] M-C1, M-C2, M-C3, then M-C12, exit 4. [detail] at ready, the same checks as S-2: every target check ok, attempts_admitted at least 1, source_report.s1.ok and s2.ok true. Record <move> and <inc>.

• C-3 Capture, then cut. Start [capture] in a second terminal, then, in the window agreed with the owner:

``sh carlos move cut --app <app> --account <account> --host <host> ``

[CLI] M-C5, M-C6, M-C7, exit 0.

• C-4 Health check, after. The owner's check from C-1 gives the serving answer once M-C7 has printed. The owner confirms it.
• C-5 Platform checks. R-5 as written. R-6 as written, except its last two sentences, which are about moveprobe's worker. [deploy] log/ has cutting-flipped, committed, committed-opened, committed-source_parked and done.

If the move rolls back (M-C8 then M-C9, exit 3), the instance is back in <from>: run C-4 there, then R-5b and R-6, and stop the series. C-6 still applies, once the rollback has closed.

• C-6 Switch off, once the move is closed. First confirm the move is closed: [detail] state is none (no move in flight) and detail.claim.kind is serving. If it is not (stuck, a release past its deadline, relocating, or any exit 4), leave the switch on and resolve the move first with carlos move resolve --app <app> --account <account> --host <host> (--retry once the cause is fixed, or --declare-lost <box> for a lost target), with Paul's scoped go in the thread, then check again. The switch must stay on until the move is closed: with it off, a box's moves pass skips every Phase 1 record, so an unfinished move would stop being reconciled and stay where it is. Once it is closed, and after the run's checks are recorded: remove CARLOS_MOVES_PHASE1 from the console and the two boxes, unless Paul says in the thread to keep it, and restart them. Check: carlos move status --app <app> --account <account> --host <host> says "Moves are not enabled on this console.", and [box] neither box's host.env sets it.

Run 6: a disposable customer-shaped instance

Blockers: P-0; the home-region parks fix, both parts, merged and rolled (customer instances live in the home region); dev Runs 1 and 1b passed; Run 5 passed; the owner's agreement; Paul's go.

A disposable instance of a customer app with the same shape as moveprobe (a key file, a store, a sealed secret), created for the run with the owner's agreement, before the flagship's claim went on (P-5).

• [ ] Instance used: recorded in the deployment repo.
• [ ] C-0 to C-6.

Run 7: the first production customer instance

Blockers: everything Run 6 needs; Run 6 passed; Paul's approval of the instance; a window agreed with its owner.

The first production customer instance Paul approves, in a window agreed with its owner.

• [ ] The instance was created before the flagship's claim went on, so it is adopted at instances/<host> (P-5). One created later cannot move.
• [ ] C-0 to C-6, with C-3 inside the agreed window. Run 6's switch was removed at its C-6, so C-0 needs its own go. The cut window is the default 120 s.
• [ ] Report offline_s back to the owner: [detail] last.offline_s, or offline_s in log/done.json's fields.

---

After every run

• [ ] Attach to the amadan thread: the done or rolled_back log entry (its timings), the bucket listings, and the host used. For Runs 1 to 5, also the [report] files from before and after. For Runs 6 and 7, which never call /report, attach instead the owner-approved health check's answers from C-1 and C-4, and the owner's confirmation.
• [ ] A failed check stops the series. Fix its cause and repeat the run on a fresh host before going on.

---

Sources

Paths are from the repo root. Line numbers are main's (bc25674a, the base of this branch); cmd/moveprobe is this branch's and not on main yet. Spec is docs/superpowers/specs/2026-10-02-move-any-app-design.md; copy is docs/superpowers/plans/2026-10-06-moves-phase1-copy.md.

carlos move (the CLI)

| what the runbook says | where | |---|---| | verbs status, cut, abort, resolve; flags --host, --app, --account, --console | move.go:136-149 | | --to, --manual-cut, --no-wait on a request; --wait on status; --retry, --declare-lost, --no-wait on resolve | move.go:151-163 | | exit codes 0, 1, 2, 3, 4, 5 | move.go:40-45, :53-61 | | "carlos move needs --app" | move.go:66, :230 | | "Moves are not enabled on this console." | move.go:65, :240-243 | | refuses to run as root; declare-lost reads EC2 with your own credentials | move.go:211-217, :80, :900-903 | | the request sends region and cut | move.go:248-253 | | M-C2, M-C3, M-C4 | move.go:703, :707, :717 | | M-C12 at ready with a manual cut, exit 4 | move.go:722-726 | | M-C10, exit 4 | move.go:740-754 | | M-C7 on done, M-C9 on rolled_back, exit 3 | move.go:788-803 | | M-C18 and the typed host name | move.go:860-882 | | "No move is in flight" | move.go:595 | | M-C1, M-C5, M-C6, M-C7, M-C8, M-C9 texts | internal/moves/operatorcopy.go:11-38; copy record rows M-C1 to M-C22, copy:24-45 | | the detail path, /api/cli/apps/<acct>/<app>/instances/<host>/move?detail=1 | move.go:230-232, :351-356; apimode.go:460-461 | | login tokens in ~/.carlos/credentials, keyed by console | auth.go:113-120, :139-148 |

The detail answer

| what | where | |---|---| | detail=1 only for operators, only with the switch on | internal/console/apiinstancemove.go:312-327 | | detail.move is nil once no move is in flight, so the capture loop keeps it | internal/console/apiinstancemove.go:1291-1292, :1416-1423 | | a mutation waits for the outcome unless --no-wait | move.go:186-188 | | flat fields state, target, id, last, protocol, phase | internal/console/apiinstancemove.go:160-170 | | detail.move, claim, target_report, source_report, evidence, log, timings, from, region | internal/console/apiinstancemove.go:1290-1318 | | evidence.source and evidence.target come from the record in flight | internal/console/apiinstancemove.go:1367-1370, :1416-1423 | | last fields id, outcome, at, offline_s | internal/provision/provision.go:1059-1064 | | move.incarnation | internal/provision/provision.go:961 | | rollback.dirty, target_phase, evidence, loss_ref, lost_at | internal/provision/provision.go:1067-1088 | | landing.installed_db_sha256 | internal/provision/provision.go:1052 | | target_report.checks T1 to T12, attempts_admitted, cut_budget_s | internal/moves/readiness.go:18-31, :58-67 | | source_report.s1, s2; S1 refuses a nested instance | internal/moves/readiness.go:102-109; internal/host/movesphase1.go:41, :537 |

The log and the buckets

| what | where | |---|---| | identities and events: requested, cutting-requested/cut_requested, cutting-flipped/flipped, committed-opened/opened, committed-source_parked/source_parked, rolling_back, rolling_back-target-<phase>, rolling_back-target-lost/declared_lost, rolling_back-source-<phase>, stuck-<epoch>, the closes; the state as the event for ready and committed | internal/moves/transition.go:122-253 | | retry-<epoch> | internal/host/movesevents.go:109 | | the fields every entry carries | internal/moves/transition.go:42-71 | | the timing keys | internal/moves/log.go:126-133 | | target phases releasing, released, returning, returned, cleaning, cleaned, lost; source phases up to recovered, opened | internal/provision/provision.go:1148-1172 | | released goes to returning only when dirty, else to cleaning | internal/host/movesrollback.go:566-575 | | report prefix moves/<acct>/<app>/<host>/<op>/, source.json, target.json, stopped-<role>.json, log/<identity>.json | internal/moves/staging.go:39-50 | | the staging lane moves/<host>/<op>/ in the target's data bucket | internal/moves/staging.go:6 | | the record's account is the sqid | internal/console/apiinstances.go:1240 | | the replica under <CARLOS_HIBERNATE_PREFIX>/<host> | internal/activator/activator.go:119, :144-146; internal/host/movespass.go:471 | | parked objects at parked/<inc>/<host>/<retirement>/, a manifest.json, the source versions deleted | internal/park/remote.go:230-232, :473, :497 | | stopped report steps.tree, steps.stray, stray (omitted when empty), digests | internal/moves/evidence.go:11-20, :38-53 | | a clean rollback: src_covered and unchanged digests; the "clean ..., srccovered ..." line; dirty and evidence written at released | internal/host/movesrollback.go:394-398, :521-526 | | the rollback's id | internal/provision/provision.go:1068 | | a dirty rollback's return lane is moves/<host>/<rb>, parked in the source's region, queued when the source has probed, horizon the return seal's bound | internal/moves/parkscope.go:66-72; internal/host/movesrecover.go:658-675; internal/hostclaim/move.go:1093-1108 | | a claim obligation's fields: id, op, kind, region, retirement, and park with location, incarnation, `evidenceat, requestlimitns; the claim's obligations list | internal/hostclaim/claim.go:116-121, :137-147, :166 | | the return lane's obligation region is the source box's CARLOSREGION (omitted when empty) | internal/host/movesrecover.go:675; internal/host/movespass.go:206; internal/hostclaim/claim.go:144 | | the claim at control/hosts/<host>.json is plain JSON, read as is | internal/hostclaim/claim.go:178-182; internal/hostclaim/store.go:38-60 | | the detail answer's claim view carries no obligations | internal/console/apiinstancemove.go:1356-1362 | | a rollback closes only when nothing is owed under its move; a finished park removes its obligation | internal/host/movesrecover.go:805-809; internal/host/movesparks.go:134-142; internal/park/remote.go:568; internal/hostclaim/delete.go:83-98 | | the parked archive is parked/<park.incarnation>/<host>/<retirement>/ with manifest.json | internal/park/remote.go:230-232, :473 | | a park runs only after evidenceat plus the signature age (15 min) and the request limit (2 min) | internal/park/remote.go:21, :516-519; internal/moves/parkscope.go:23` |

The door and the fleet

| what | where | |---|---| | moves into home: refused without host claims (MV-N510), and a box whose edges file names the home as its placement refused (MV-N511), both before any claim read; the home's staging from placementless edges files | 2026-10-15-moves-home-region-part2.md (Task 5); merge commit a89e35ca; at that commit internal/console/apiinstancemove.go:614, :665-666, internal/console/instancesplacement.go:199 | | one placementless box: S1 and T8 count every edges file per placement, fresh or not, before the data-bucket check | internal/host/movesreport.go:113 (loadMoveFleet) | | Ruling R2's procedure, R6 (Run 4 stays out of home, Run 1b) and R7 (a home landing on the console's box) | 2026-10-15-moves-home-region-part2.md, "Rulings needed" | | a region with no staging bucket is refused | internal/console/apiinstancemove.go:580-583; staging from data_bucket, internal/console/instancesplacement.go:366 | | M-C21, more than one box | internal/console/apiinstancemove.go:595-600 | | MV-N5, below the floor | internal/console/apiinstancemove.go:613-616; copy:55 | | a box below the protocol, or not armed for the floor, or with an unjudged carlos.prev, is below the floor | internal/console/boxselect.go:100-108 | | MV-N167 for a holder at instances/<host>/<inc> | internal/console/apiinstancemove.go:143, :647-651; copy:217 | | a created holder is at instances/<host>/<inc>, an adopted one at instances/<host> | internal/hostclaim/create.go:75; internal/hostclaim/adopt.go:20 | | the source must be an active, enrolled roster entry with no termination fence | internal/console/apiinstancemove.go:657-684, :1267-1273 | | eligibility: fresh, enrolled, region-ha-1, the console's secrets fingerprint, not draining | internal/boxchoice/boxchoice.go:21, :109-148 | | region-ha-1 and the identity record only with CARLOS_REGION_HA | internal/host/edgesfile.go:156-164; internal/host/boxrecord.go:25-28, :158-166 | | CARLOS_REGION_HA reads only ParseBool true values, so on is off | internal/host/boxrecord.go:21-28 | | identity records at control/boxes/<box>.json | internal/boxid/record.go:21, :28 | | CARLOS_AWS_ACCOUNT and CONSOLE_HOME_REGION on the console | cmd/console/main.go:318, :321 | | the claim at control/hosts/<host>.json; holder.location, obligations, quiet_after | internal/hostclaim/claim.go:56, :166, :171, :182 | | T12 reads quiet_after; H is 15 min plus 1 min skew | internal/host/movesreport.go:756-762; internal/moves/lease.go:13, :22; spec:2573 | | the console's claim recovery pass adopts with the claim on | internal/console/hostclaimbackfill.go:40-48 | | the roster at control/host-actors.json; boxes, state, enrollment, quarantine_revision, loss_ids; a declaration quarantines and adds one to the revision | internal/hostactors/roster.go:21, :30, :38-40, :72, :265-279 | | the roster is written as a root-signed envelope {payload, sig}, the payload base64 JSON | internal/hostactors/roster.go:249; internal/release/rootenvelope.go:29-44; internal/release/release.go:377-379 | | a termination fence is control/box-fences/<enrollment>.json; no object, no fence | internal/hostactors/fence_authority.go:14-34 | | a quarantined box is refused admission | internal/hostquarantine/quarantine.go:17-25 | | CARLOS_HOST_CLAIM is any non-empty value | cmd/console/main.go:1364-1366; hostclaim_cli.go:22 | | carlos ops host exists only with CARLOS_HOST_CLAIM in the shell; --readmit, --console, the readmit prompt | hostclaim_cli.go:35-39, :61-75, :143 | | readmit refuses a fenced box and a private report older than 15 min | internal/hostresolve/readmit.go:18-40 | | readmit needs the box's complete retirement receipt for this boot at control/host-retirement/<box>/<enrollment>/<revision>.json, then sets the box active | internal/hostresolve/readmit.go:52-66, :134; internal/hostquarantine/quarantine.go:72-82, :91-96 |

The floor, the switch and the boxes

| what | where | |---|---| | the floor key and shape, {"min","min_release"} | internal/moves/floor.go:20, :61-64 | | vX.Y.Z only; anything else fails closed | internal/moves/floor.go:85-99 | | no code writes the floor; only reads | internal/moves/floor.go:66-82 | | a box's floor only rises; lowering it is a manual step per box | internal/host/movesfloor.go:31-36 | | moves_protocol, moves_floor_min_release, prev_release, prev_allowed_for, data_bucket, secrets_key_fp in the edges file at control/edges/<box>.json | internal/host/edgesfile.go:218, :270, :295-304; internal/console/instancesplacement.go:22, :83-86 | | control/moves-console.json and its secrets_key_fp | internal/moves/floor.go:25-33 | | the switch, on/1/true, default off | internal/moves/switch.go:6-23 | | the copy record's pending rows keep the compiled default off; P-7 applies the same rule to the env switch (Paul's ruling) | approved_moves_copy_test.go:811; docs/superpowers/plans/2026-10-06-moves-phase1-copy.md | | with the switch off the CLI says "Moves are not enabled on this console." (the switch-off check in Run 5 and C-6) | move.go:65, :240-243 | | with the switch off a box's moves pass skips every Phase 1 record, so the switch goes off only after the move closes | internal/host/movespass.go:797-805 | | carlos move resolve --retry and --declare-lost <box> | move.go:159-163, :258-262 | | the copy gate keeps the default off while a row is pending | approved_moves_copy_test.go:811 | | the default cut window, 120 s | internal/moves/budget.go:17 | | CARLOS_LAYOUT_DEFAULT=flat | internal/host/layoutleg.go:68-70; system.go:714 | | carlos system status | system.go:75-76; README.md:272 | | carlos status --layout shows each host's actual layout, box by box, and marks a box "(nested by default)"; carlos system layout status shows only the recorded intent | cli.go:3528; status_instances.go:142-163, :224; system.go:709-716 | | the agent is carlos-edge.service, reading /etc/carlos/host.env, with a delegated cgroup | internal/host/units/carlos-edge.service:18-19, :101 | | "exec-child accounting armed"; no manager, no stop evidence | internal/cgroup/cgroup.go:181-184; internal/host/movespass.go:376-392 | | "not proven stopped yet ... retrying until the cut's deadline" | internal/host/movescut.go:422-427 | | M-C20 and the page outbox <DataDir>/.moves/.page-outbox/<host>/<move>/<rule>.json, rule stray | internal/host/movespaging.go:47-50, :87, :546-554, :586-588 | | the tree step's "could not be stopped" | internal/stopevidence/reconstruct_linux.go:185 | | alert sinks CARLOS_ALERT_WEBHOOK, CARLOS_ALERT_SNS_TOPIC_ARN; the console arms them only with the claim and the switch on | internal/alerting/alerting.go:191-209; cmd/console/main.go:1352-1362 | | CARLOS_SECRETS_KEY on the box | internal/host/movespass.go:311-316 | | /data is the data directory | internal/ops/ops.go:27 |

Timers and moveprobe

| what | where | |---|---| | a held timer row is skipped while the instance moves | internal/schedule/runner.go:190-197 | | a periodic schedule's next fire is the next boundary after now (no replay) | internal/schedule/spec.go:119-125 | | moveprobe's region is home with no CARLOS_REGION, else CARLOS_REGION; /report says which in region_from | cmd/moveprobe/main.go:94-100 | | the failure switch matches the probe's own region, so it must name <pr-R> | cmd/moveprobe/main.go:103-106, :137-138 | | a box's edges placement is its CARLOS_REGION, absent when unset (the home box) | internal/host/edgesfile.go:205-211, :758 | | bg and worker rows each numbered from 1 in one sequence | cmd/moveprobe/main.go:543-550, :158, :674 | | /report's fields, /arm-once's answer, the failure switch's modes | cmd/moveprobe/README.md, "Use it", "Make readiness fail on purpose" and "Strings" |

Other CLI commands

| what | where | |---|---| | carlos env set, unset, list with --app and --account | appconfig_cli.go:342-350, :408-417, :462-467; cli.go:2045-2051 | | carlos instances create --host --region --account | instances_cli.go:297-310 |

Not on main, cited by name

| what | where | |---|---| | the cut guard and T13 | branch moves-cut-guard, commits 083a6eaa and 6871d2e3 | | the home parks fix part 2 (moves into home) | 2026-10-15-moves-home-region-part2.md, merged to main as a89e35ca (branch moves-home-part2-plan); #236. Part 1 is on main as 359e8ac2 | | claim Plan 12; moves Plan 5 Tasks 9b and 8, Plan 4 Tasks 9 and 10 | plans only; the landing, rollback and recovery are unarmed until then, internal/host/movespass.go:335-340 | | dev's second region | platform-infrastructure#42 |

Spec

| what | where | |---|---| | the runs and the pass rule | spec §14.4, spec:6263-6276 | | the rollout order, the floor before any protected production rehearsal | spec §15, spec:6278-6294 | | each rehearsal gates the next: Run 4 needs Runs 2 and 3, Run 5 needs Run 4 | spec:6294; controller rulings, fix round 1 and final review | | the flagship's home is Ireland | spec:1032 |