Region HA L14 to L18 against the moves spec and the claim (platform-d8, 2026-10-06)

Written while folding region HA spec 1 rev 5.4 §9 (branch design-region-ha-rev5) into moves rev 7.19, with claim rev 6.27 (989ee349) §1.1's rulings in hand. "Claim change" means platform-1e has to do something for the moves text to hold.

Folded into moves rev 7.19 with no conflict

• L15, the target box in the start CAS. Moves' hostclaim.BeginMove (plan 1 Task 3) already takes targetBox and records participants = {source, target} and intent.target. Rev 7.19 §7.1 names choose() as the chooser for a multi-box region. No claim change: the participants list and the single-exec rule are claim §2 as they stand. Moves' door reads the roster and the edges snapshot; it needs the roster's eligibility read (region HA §5.2 eligibleBoxes) exported from wherever region HA builds it, or it falls back to "the lexically-first box publishing the placement" for a one-box region, which is what it does today.
• L16, one install routine. moves.BuildGeneration (plan 2 Task 8) takes a pinned version set and N; relocation can call it with a genselect.SelectPrepared plan or a current listing. No claim change.
• L17, the files manifest per installation. Moves' local phase publishes the installed directory through region HA's files publisher before .files-gen. Claim change (already region HA's L13): the sweep's classifier must treat <location>files/<generation>/ as that generation's and protect the objects the files live set names; without L13, a park-generation chore would archive a live manifest's objects. Moves also needs the publisher's API (region HA plan 1a's) exported: files.Publish(ctx, store, location, generation, dir, envPath) (manifestVersion string, err error) or equivalent; the moves plan names it as a contract, not a fact.

Folded with a claim change required

• L14, the termination fence as M16's evidence. Moves §7.10 now says a fenced target is taken off the move automatically before the record's commit, through the declared-loss path, with fenced_at as the scope's evidence time. On the claim side this needs L2 to L4 as region HA requests them: declareLostTransition today requires QuarantineRevision != 0 and a non-empty Enrollment from an operator-prepared LossRecord (leases branch lost.go:221); a fence with no quarantine revision and no operator must be a legal declaration input (L4 says a terminated box needs no readmission). Moves needs the journal to carry one readable reference to the fence (the loss.<id> entry's intent, or a new fence key) so ReturnToSource (plan 4 Task 2) can accept it as the cited evidence; the key name is the claim's to choose. Until that lands, the moves plan marks the fence path BLOCKED-ON-CLAIM beside --declare-lost.
• A terminated source before the flip. Moves §7.10 says the move aborts and relocation takes the host. The claim's moving op must be releasable by the fence's lost-box path while the move's staging park is still owed (abort's park-staging, owned by the target region): the release of a moving claim with outstanding obligations is today ErrPendingChore (ReleaseMove); region HA's L1 "source-loss conversion to failover from starting or releasing" needs the same for moving. Claim change: a fence may convert moving to relocating with the staging obligation carried over, or the obligation's owner must be allowed to acknowledge under the new op.

Not done, stated as a limit

• L18, two boxes per region in the model. internal/sim/hostlife keeps one box per region plus replacement boxes. The requested extension models relocation, an operation outside the moves spec, over a world whose box.Region bookkeeping assumes one box per region; it is not tractable in this revision within the CPU policy (the gate plus one niced 3000 sweep). Rev 7.19 §14.2.6 states the limit. It belongs to a joint round with the region HA session on its own branch once relocation's protocol is fixed.

Rulings that touch both

• P7, cold-only. Moves rev 7.19 §0.5 and §19.1: every admission cold, no certificate issued. The claim library keeps Mode: "warm" and PredecessorCertified; moves never passes them. No claim change; the claim's own §1.1 already records P7.
• Park kinds (plan review round 2, finding 3; platform-1e's interface check). Moves drops park-superseded and park-staging: staging lanes are park-replica scoped to moves/<host>/<op id>; a source's finalization and a rolled-back target's cleaning are park-replica scoped to the whole location (non-authoritative there, so the engine selects everything); a landing's earlier-stay residue is park-generation per residue generation (the engine's live-set rule lets those acknowledge after the new generation is live). Destination stays the engine's parked/<incarnation>/<host>/<retirement>/; F3 selects by manifest Op. No new claim kind is needed in 6.27. Reason: nothing in the move reads superseded data back (a dirty return seals the target's live installation before cleaning parks; a clean return restores from the source's live replica), M7's seven-day hold is F3's rule over immutable manifests, not a path, and D5's one manifest per retirement event is the engine's own.
• One claim contract moves still needs for parks on a serving box: Engine.Run acquires the location's replica lease (park/remote.go:404). A park-generation chore for a location this box itself serves (the landing's earlier-stay residue acknowledging after the probe; the at-rest sweep on a serving host) can only acknowledge if the regional runner's Leases.Acquire shares the activator's held lease for a location this box serves (an aggregate lease adapter, claim Plan 5 D3's wording). Moves lists it as a BLOCKED-ON-CLAIM contract.