| 1 | # Review brief: region HA spec 1 rev 5, round 1 |
| 2 | |
| 3 | You are an independent second reader. Review |
| 4 | `docs/superpowers/specs/2026-10-04-region-ha-box-placement-design.md` at |
| 5 | the commit named in the prompt, in the repository at the working |
| 6 | directory (Go; carlos platform). |
| 7 | |
| 8 | ## What changed and why |
| 9 | |
| 10 | Rev 4.2 (your rounds 1 to 6, `CODEX-FINDINGS-REGION-HA-{1..6}.md`) was |
| 11 | written against host lifecycle claim rev 6.3. The claim has since reached |
| 12 | rev 6.25+ and part of its library is on main. Rev 5 restates spec 1 |
| 13 | against the claim as it is now, and records Paul's rulings H10 to H16 |
| 14 | (2026-10-06). Plan 1a of rev 4.2 is built and merged (internal/boxid, |
| 15 | internal/hostfiles, internal/termfence, internal/console/boxchoice.go, |
| 16 | edges-file fields, home-map stamps); §18 and §19 say what of it stays. |
| 17 | |
| 18 | ## Fixed: do not re-argue |
| 19 | |
| 20 | Rulings H1 to H16 in §0, and the claim's own ruled text (R6 in |
| 21 | particular: no warm reuse of a local database). Report only mechanisms |
| 22 | that fail to honour them, are unsafe, or are missing. |
| 23 | |
| 24 | ## Sources to check against |
| 25 | |
| 26 | - Claim spec: `git show origin/design-replica-ownership:docs/superpowers/specs/2026-10-02-host-lifecycle-claim-design.md` |
| 27 | (§2, §4, §5.1, §5.9 PROPOSED, §6.4, §6.4a, §6.6 PROPOSED, §7, §8, §10.1 PROPOSED). |
| 28 | - Claim code on main: internal/hostclaim, internal/hostguard, |
| 29 | internal/stopevidence, internal/park, internal/genselect. |
| 30 | - Moves spec: /home/paulca/amadan.net/carlos/platform-moves-design/docs/superpowers/specs/2026-10-02-move-any-app-design.md |
| 31 | (latest committed rev on that worktree's branch). |
| 32 | - Plan 1a's code on main, for §18 and §19's claims about it. |
| 33 | |
| 34 | ## Focus |
| 35 | |
| 36 | 1. **Relocation (§5.8) against §6.4a.** Is every step consistent with the |
| 37 | claim's writer sessions, prepared generations (opened at most once), |
| 38 | AdmitWriter, KeepStamp, PublishGeneration and genselect? Can any |
| 39 | sequence of crashes, a paused worker, two workers, a terminated |
| 40 | participant, or a failing probe leave two writers, a reinstall after |
| 41 | `installed`, lost acknowledged data beyond H3's window, or a host |
| 42 | stuck with no recovery owner? |
| 43 | 2. **The termination fence (§5.9) after H15.** The volume record, the |
| 44 | 2-hour bound, the IAM guard (Modify, Attach, Detach), the event and |
| 45 | describe reads. Any way to fence a box whose data could survive, or |
| 46 | a live box. |
| 47 | 3. **§5.10's two-sided reservation check (H14).** Can a relocation start |
| 48 | and an executable update both proceed? |
| 49 | 4. **The L-table (§9).** Does each request cite the right claim or moves |
| 50 | text, and is anything missing that a multi-box region needs from the |
| 51 | claim as it now stands? Is anything requested that the claim already |
| 52 | provides? |
| 53 | 5. **Enrollment (H11, H16) and the roster.** Does the evidence chain from |
| 54 | the AWS-signed identity to the roster entry to the fence hold? |
| 55 | 6. **Code citations.** Verify file:line references against the tree. |
| 56 | |
| 57 | ## Output |
| 58 | |
| 59 | Findings ranked P1 (unsafe or blocks a plan), P2 (wrong or missing), P3 |
| 60 | (clarity). Each: section, the problem, a concrete failing sequence, and |
| 61 | a suggested fix. End with a verdict: ready for plan, or not ready. |
| 62 | |
amadan