| 1 | # Region HA L14 to L18 against the moves spec and the claim (platform-d8, 2026-10-06) |
| 2 | |
| 3 | Written while folding region HA spec 1 rev 5.4 §9 (branch |
| 4 | `design-region-ha-rev5`) into moves rev 7.19, with claim rev 6.27 |
| 5 | (989ee349) §1.1's rulings in hand. "Claim change" means platform-1e has |
| 6 | to do something for the moves text to hold. |
| 7 | |
| 8 | ## Folded into moves rev 7.19 with no conflict |
| 9 | |
| 10 | - **L15, the target box in the start CAS.** Moves' `hostclaim.BeginMove` |
| 11 | (plan 1 Task 3) already takes `targetBox` and records |
| 12 | `participants = {source, target}` and `intent.target`. Rev 7.19 §7.1 |
| 13 | names `choose()` as the chooser for a multi-box region. No claim |
| 14 | change: the participants list and the single-exec rule are claim §2 |
| 15 | as they stand. Moves' door reads the roster and the edges snapshot; |
| 16 | it needs the roster's eligibility read (region HA §5.2 |
| 17 | `eligibleBoxes`) exported from wherever region HA builds it, or it |
| 18 | falls back to "the lexically-first box publishing the placement" for |
| 19 | a one-box region, which is what it does today. |
| 20 | - **L16, one install routine.** `moves.BuildGeneration` (plan 2 Task 8) |
| 21 | takes a pinned version set and `N`; relocation can call it with a |
| 22 | `genselect.SelectPrepared` plan or a current listing. No claim change. |
| 23 | - **L17, the files manifest per installation.** Moves' `local` phase |
| 24 | publishes the installed directory through region HA's files publisher |
| 25 | before `.files-gen`. **Claim change (already region HA's L13):** the |
| 26 | sweep's classifier must treat `<location>files/<generation>/` as that |
| 27 | generation's and protect the objects the files live set names; without |
| 28 | L13, a `park-generation` chore would archive a live manifest's objects. |
| 29 | Moves also needs the publisher's API (region HA plan 1a's) exported: |
| 30 | `files.Publish(ctx, store, location, generation, dir, envPath) (manifestVersion string, err error)` or equivalent; the moves plan names |
| 31 | it as a contract, not a fact. |
| 32 | |
| 33 | ## Folded with a claim change required |
| 34 | |
| 35 | - **L14, the termination fence as M16's evidence.** Moves §7.10 now |
| 36 | says a fenced target is taken off the move automatically before the |
| 37 | record's commit, through the declared-loss path, with `fenced_at` as |
| 38 | the scope's evidence time. On the claim side this needs L2 to L4 as |
| 39 | region HA requests them: `declareLostTransition` today requires |
| 40 | `QuarantineRevision != 0` and a non-empty `Enrollment` from an |
| 41 | operator-prepared `LossRecord` (leases branch `lost.go:221`); a fence |
| 42 | with no quarantine revision and no operator must be a legal |
| 43 | declaration input (L4 says a terminated box needs no readmission). |
| 44 | Moves needs the journal to carry **one readable reference** to the |
| 45 | fence (the `loss.<id>` entry's intent, or a new `fence` key) so |
| 46 | `ReturnToSource` (plan 4 Task 2) can accept it as the cited evidence; |
| 47 | the key name is the claim's to choose. Until that lands, the moves |
| 48 | plan marks the fence path BLOCKED-ON-CLAIM beside `--declare-lost`. |
| 49 | - **A terminated source before the flip.** Moves §7.10 says the move |
| 50 | aborts and relocation takes the host. The claim's `moving` op must be |
| 51 | releasable by the fence's lost-box path while the move's staging park |
| 52 | is still owed (abort's `park-staging`, owned by the target region): |
| 53 | the release of a `moving` claim with outstanding obligations is today |
| 54 | `ErrPendingChore` (`ReleaseMove`); region HA's L1 "source-loss |
| 55 | conversion to failover from `starting` or `releasing`" needs the same |
| 56 | for `moving`. Claim change: a fence may convert `moving` to |
| 57 | `relocating` with the staging obligation carried over, or the |
| 58 | obligation's owner must be allowed to acknowledge under the new op. |
| 59 | |
| 60 | ## Not done, stated as a limit |
| 61 | |
| 62 | - **L18, two boxes per region in the model.** `internal/sim/hostlife` |
| 63 | keeps one box per region plus replacement boxes. The requested |
| 64 | extension models relocation, an operation outside the moves spec, |
| 65 | over a world whose `box.Region` bookkeeping assumes one box per |
| 66 | region; it is not tractable in this revision within the CPU policy |
| 67 | (the gate plus one niced 3000 sweep). Rev 7.19 §14.2.6 states the |
| 68 | limit. It belongs to a joint round with the region HA session on its |
| 69 | own branch once relocation's protocol is fixed. |
| 70 | |
| 71 | ## Rulings that touch both |
| 72 | |
| 73 | - **P7, cold-only.** Moves rev 7.19 §0.5 and §19.1: every admission |
| 74 | cold, no certificate issued. The claim library keeps `Mode: "warm"` |
| 75 | and `PredecessorCertified`; moves never passes them. No claim change; |
| 76 | the claim's own §1.1 already records P7. |
| 77 | - **Park kinds (plan review round 2, finding 3; platform-1e's interface |
| 78 | check).** Moves drops `park-superseded` and `park-staging`: staging |
| 79 | lanes are `park-replica` scoped to `moves/<host>/<op id>`; a source's |
| 80 | finalization and a rolled-back target's cleaning are `park-replica` |
| 81 | scoped to the whole location (non-authoritative there, so the engine |
| 82 | selects everything); a landing's earlier-stay residue is |
| 83 | `park-generation` per residue generation (the engine's live-set rule |
| 84 | lets those acknowledge after the new generation is live). Destination |
| 85 | stays the engine's `parked/<incarnation>/<host>/<retirement>/`; F3 |
| 86 | selects by manifest `Op`. **No new claim kind is needed in 6.27.** |
| 87 | Reason: nothing in the move reads superseded data back (a dirty return |
| 88 | seals the target's live installation before `cleaning` parks; a clean |
| 89 | return restores from the source's live replica), M7's seven-day hold |
| 90 | is F3's rule over immutable manifests, not a path, and D5's one |
| 91 | manifest per retirement event is the engine's own. |
| 92 | - **One claim contract moves still needs for parks on a serving box:** |
| 93 | `Engine.Run` acquires the location's replica lease (`park/remote.go:404`). |
| 94 | A `park-generation` chore for a location this box itself serves (the |
| 95 | landing's earlier-stay residue acknowledging after the probe; the |
| 96 | at-rest sweep on a serving host) can only acknowledge if the regional |
| 97 | runner's `Leases.Acquire` shares the activator's held lease for a |
| 98 | location this box serves (an aggregate lease adapter, claim Plan 5 |
| 99 | D3's wording). Moves lists it as a BLOCKED-ON-CLAIM contract. |
| 100 | |
amadan