| 1 | # Review brief: region HA spec 1 rev 5.2, round 3 |
| 2 | |
| 3 | You are an independent second reader. Review |
| 4 | `docs/superpowers/specs/2026-10-04-region-ha-box-placement-design.md` at |
| 5 | the commit named in the prompt, in the repository at the working |
| 6 | directory (Go; carlos platform). |
| 7 | |
| 8 | ## What changed and why |
| 9 | |
| 10 | Rev 5.2 answers your rev 5 round 2 findings |
| 11 | (`CODEX-FINDINGS-REGION-HA-REV5-2.md`, B2-1 to B2-6) and the round 1 |
| 12 | items you marked partly resolved (B1-2, B1-3, B1-4, B1-8). §21 is the |
| 13 | disposition table. The mechanisms changed: |
| 14 | |
| 15 | - **§6 volume guard (B2-1):** the SCP also denies |
| 16 | `CreateReplaceRootVolumeTask`, `CreateSnapshot(s)` and `CreateImage` |
| 17 | on platform boxes and their volumes; the `carlos:role` tag is |
| 18 | protected on volumes as well as instances; a replaced root volume |
| 19 | shows as removed. |
| 20 | - **§6 service-linked roles (B2-3):** the attestation reads every |
| 21 | service-linked role's managed policy at its default version and maps |
| 22 | each disk or tag action to an initiating API the SCP denies (for Auto |
| 23 | Scaling: refresh, group create and update, warm pools, attach), and is |
| 24 | invalidated by a policy version change. |
| 25 | - **§5.9 hold release (B2-2):** the hold names its instance and the |
| 26 | change role's exemption is limited to it; release revokes the role's |
| 27 | earlier sessions, waits for in-flight disk tasks and the |
| 28 | signature-age bound, then needs a validating record after that |
| 29 | barrier. |
| 30 | - **§5.6, §5.8 files pin (B2-4):** the files manifest is pinned from the |
| 31 | newest admitted generation, independently of the database baseline; |
| 32 | a files live set protects it. |
| 33 | - **§5.8 local install receipt (B2-5):** bound to |
| 34 | `op.journal.install_stamp`; never remade after the first admission. |
| 35 | - **§5.1 H17 emptiness (B2-6):** the cross-region confirmer requires a |
| 36 | positive `terminated` read for every remaining enrollment in the |
| 37 | region, in the same pass; it is not a fence. |
| 38 | |
| 39 | Paul's rulings H17 and H18 (2026-10-06) are fixed text, and §11 is |
| 40 | empty. |
| 41 | |
| 42 | ## Fixed: do not re-argue |
| 43 | |
| 44 | Rulings H1 to H18 in §0, and the claim's own ruled text (R6 in |
| 45 | particular: no warm reuse of a local database). Report only mechanisms |
| 46 | that fail to honour them, are unsafe, or are missing. |
| 47 | |
| 48 | ## Sources to check against |
| 49 | |
| 50 | - Claim spec: `git show origin/design-replica-ownership:docs/superpowers/specs/2026-10-02-host-lifecycle-claim-design.md` |
| 51 | (§2, §4, §5.1, §5.9 PROPOSED, §6.4, §6.4a, §6.6 PROPOSED, §7, §8, §10.1 PROPOSED). |
| 52 | - Claim code on main: internal/hostclaim, internal/hostguard, |
| 53 | internal/stopevidence, internal/park, internal/genselect. |
| 54 | - Moves spec: /home/paulca/amadan.net/carlos/platform-moves-design/docs/superpowers/specs/2026-10-02-move-any-app-design.md |
| 55 | (latest committed rev on that worktree's branch). |
| 56 | - Plan 1a's code on main, for §18 and §19's claims about it. |
| 57 | ## Focus |
| 58 | |
| 59 | 1. **First, a disposition table** for B2-1 to B2-6 and for B1-2, B1-3, |
| 60 | B1-4 and B1-8: resolved, partly resolved (say what remains) or not |
| 61 | resolved, each with the section that answers it. |
| 62 | 2. **Then only new findings.** Do not re-raise anything resolved in any |
| 63 | earlier round (rounds 1 to 6 of rev 4.x, and rev 5 rounds 1 and 2) |
| 64 | unless this revision broke it; if it did, say which change broke it. |
| 65 | Look hardest at the mechanisms listed above and their neighbours: the |
| 66 | hold, revoke and release order against the fence and the 2-hour |
| 67 | bound; the attestation's service-role table against Auto Scaling's |
| 68 | real behaviour; the files pin and live set against |
| 69 | `PublishGeneration`'s parks and the at-rest sweep; the receipt |
| 70 | against replacements and crashes; the emptied-region check against |
| 71 | H17's single cross-region use. |
| 72 | |
| 73 | ## Output |
| 74 | |
| 75 | The disposition table, then new findings ranked P1 (unsafe or blocks a |
| 76 | plan), P2 (wrong or missing), P3 (clarity). Each: section, the problem, |
| 77 | a concrete failing sequence, and a suggested fix. End with a verdict: |
| 78 | ready for plan, or not ready. |
| 79 | |
amadan