| 1 | # Review brief: region HA spec 1 rev 5.1, round 2 |
| 2 | |
| 3 | You are an independent second reader. Review |
| 4 | `docs/superpowers/specs/2026-10-04-region-ha-box-placement-design.md` at |
| 5 | the commit named in the prompt, in the repository at the working |
| 6 | directory (Go; carlos platform). |
| 7 | |
| 8 | ## What changed and why |
| 9 | |
| 10 | Rev 5.1 answers your rev 5 round 1 findings |
| 11 | (`CODEX-FINDINGS-REGION-HA-REV5-1.md`, B1-1 to B1-9). §20 is the |
| 12 | disposition table. The mechanisms changed: |
| 13 | |
| 14 | - **§5.8 probe attempts (B1-1):** only the first attempt opens the |
| 15 | prepared generation `P`; later attempts restore from their |
| 16 | predecessor through `genselect.Select`; coverage is decided per |
| 17 | admission, `released` only on `P`'s opening with a predecessor |
| 18 | matching the journaled release (L9). |
| 19 | - **§5.8 local install (B1-2):** the remote build (built once) is split |
| 20 | from a per-box local install, recorded as a receipt bound to |
| 21 | `op.exec`, its enrollment and `holder.stamp`, which `probing` |
| 22 | requires; a replacement at `installed` makes its own. |
| 23 | - **§5.8 source loss (B1-6):** a source-loss CAS converts a drain to a |
| 24 | failover from `starting` or `releasing`. |
| 25 | - **§5.9 and §6, disk evidence (B1-3, B1-4):** holds written before any |
| 26 | exempt volume change, removed volumes suspending disk evidence, |
| 27 | releases with operator attestation; the SCP also protects the |
| 28 | `carlos:role` tag; one hold-gated volume-change role; a root-signed |
| 29 | guard attestation, without which there is no automatic fence. |
| 30 | - **§5.10 (B1-5):** root refuses an executable update on any controller |
| 31 | record in any state, `lost` included, or any unreadable one, until |
| 32 | claim D6's clearing with cleanup complete. |
| 33 | - **§5.9, L5 (B1-7):** console enrollments gain a `compute` binding; a |
| 34 | console on a fenced box leaves the census. |
| 35 | - **§7, §11, L19 (B1-8):** no automatic recovery claimed for a one-box |
| 36 | region; the empty-region confirmer is an open question for Paul. |
| 37 | - **Citations (B1-9)** refreshed. |
| 38 | |
| 39 | Paul ruled both questions those fixes raised, on 2026-10-06, and they |
| 40 | are now fixed text: **H17** (an enrolled box in another region, with |
| 41 | read-only cross-region Auto Scaling and EC2 describe rights and no other |
| 42 | cross-region use, confirms the first box of a region with no enrolled |
| 43 | box; §5.1, §6, L19) and **H18** (for box-started relocations only, the |
| 44 | census accepts a console's newest report however old if it met the floor |
| 45 | and the console's box has the D1 update guard armed; §5.9, L20). §11 is |
| 46 | empty. Review how H17 and H18 are specified, not whether they should be. |
| 47 | |
| 48 | ## Fixed: do not re-argue |
| 49 | |
| 50 | Rulings H1 to H18 in §0, and the claim's own ruled text (R6 in |
| 51 | particular: no warm reuse of a local database). Report only mechanisms |
| 52 | that fail to honour them, are unsafe, or are missing. |
| 53 | |
| 54 | ## Sources to check against |
| 55 | |
| 56 | - Claim spec: `git show origin/design-replica-ownership:docs/superpowers/specs/2026-10-02-host-lifecycle-claim-design.md` |
| 57 | (§2, §4, §5.1, §5.9 PROPOSED, §6.4, §6.4a, §6.6 PROPOSED, §7, §8, §10.1 PROPOSED). |
| 58 | - Claim code on main: internal/hostclaim, internal/hostguard, |
| 59 | internal/stopevidence, internal/park, internal/genselect. |
| 60 | - Moves spec: /home/paulca/amadan.net/carlos/platform-moves-design/docs/superpowers/specs/2026-10-02-move-any-app-design.md |
| 61 | (latest committed rev on that worktree's branch). |
| 62 | - Plan 1a's code on main, for §18 and §19's claims about it. |
| 63 | ## Focus |
| 64 | |
| 65 | 1. **First, a disposition table for B1-1 to B1-9:** resolved, partly |
| 66 | resolved (say what remains) or not resolved, each with the section |
| 67 | that answers it. |
| 68 | 2. **Then only new findings**, especially in the mechanisms listed |
| 69 | above and their neighbours: the probe-attempt chain and |
| 70 | `PublishGeneration`'s parks; the local install receipt across |
| 71 | replacements and crashes; the source-loss CAS against claim D5 and |
| 72 | D6; holds, releases and removed volumes against the 2-hour bound and |
| 73 | the fence; the SCP's tag statements against Auto Scaling launches; |
| 74 | the cross-region confirmation (H17) and its IAM; the stale-console |
| 75 | census rule (H18) against D1 and D7; |
| 76 | root's refusal against D6's clearing; the console `compute` binding |
| 77 | against D7. Do not re-report a round 1 finding unless its fix is |
| 78 | incomplete. |
| 79 | |
| 80 | ## Output |
| 81 | |
| 82 | The disposition table, then new findings ranked P1 (unsafe or blocks a |
| 83 | plan), P2 (wrong or missing), P3 (clarity). Each: section, the problem, |
| 84 | a concrete failing sequence, and a suggested fix. End with a verdict: |
| 85 | ready for plan, or not ready. |
| 86 | |
amadan