| 1 | # Review brief: region HA spec 1 rev 5.3, round 4 |
| 2 | |
| 3 | You are an independent second reader. Review |
| 4 | `docs/superpowers/specs/2026-10-04-region-ha-box-placement-design.md` at |
| 5 | the commit named in the prompt, in the repository at the working |
| 6 | directory (Go; carlos platform). |
| 7 | |
| 8 | ## What changed and why |
| 9 | |
| 10 | Your rev 5 round 3 findings (`CODEX-FINDINGS-REGION-HA-REV5-3.md`, B3-1 |
| 11 | to B3-5) were all about the volume guard. Rather than patch it again, |
| 12 | Paul ruled **H19** (2026-10-06), which supersedes H15 and the volume half |
| 13 | of H10: |
| 14 | |
| 15 | - the failover fence for **execution** rests on a verified `terminated` |
| 16 | read alone, bound to the roster's `cloud` identity (event, describe, |
| 17 | later the group's history; absence never evidence): claim §7.2's own |
| 18 | lost-box rule; |
| 19 | - disk evidence (the box's volume records, launch-time to last running, |
| 20 | all `DeleteOnTermination`, none removed) decides **only** whether the |
| 21 | dead box's `park-local` chores are discharged automatically (claim |
| 22 | D5). Otherwise they stay open for an operator, and recovery waits on |
| 23 | nothing; |
| 24 | - a surviving disk copy (Recycle Bin, copy, snapshot, image, detach) is |
| 25 | a data-retention concern for the operator path, not a two-writer risk. |
| 26 | |
| 27 | So rev 5.3 removes the SCP, holds, change role, guard attestation and |
| 28 | service-role audit, and rewrites §5.9 (what counts, disk evidence for |
| 29 | discharge, the volume record), §6 (disks), §7, §8, §9 (L2, L3), §10 and |
| 30 | §19. §22 is the disposition table, with a note revisiting B1-3, B1-4, |
| 31 | B2-1, B2-2 and B2-3. |
| 32 | |
| 33 | ## Fixed: do not re-argue |
| 34 | |
| 35 | Rulings H1 to H19 in §0 (H19 supersedes H15 and the volume half of |
| 36 | H10), and the claim's own ruled text (R6 in particular: no warm reuse of |
| 37 | a local database). Report only mechanisms that fail to honour them, are |
| 38 | unsafe, or are missing. |
| 39 | |
| 40 | ## Sources to check against |
| 41 | |
| 42 | - Claim spec: `git show origin/design-replica-ownership:docs/superpowers/specs/2026-10-02-host-lifecycle-claim-design.md` |
| 43 | (§2, §4, §5.1, §5.9 PROPOSED, §6.4, §6.4a, §6.6 PROPOSED, §7, §8, §10.1 PROPOSED). |
| 44 | - Claim code on main: internal/hostclaim, internal/hostguard, |
| 45 | internal/stopevidence, internal/park, internal/genselect. |
| 46 | - Moves spec: /home/paulca/amadan.net/carlos/platform-moves-design/docs/superpowers/specs/2026-10-02-move-any-app-design.md |
| 47 | (latest committed rev on that worktree's branch). |
| 48 | - Plan 1a's code on main, for §18 and §19's claims about it. |
| 49 | ## Focus |
| 50 | |
| 51 | 1. **First, a disposition table** for B3-1 to B3-5: resolved, moot under |
| 52 | H19 (say whether you agree it is moot), or not resolved, each with |
| 53 | the section that answers it. |
| 54 | 2. **Then, specifically: does any two-writer or data-loss path now |
| 55 | depend on disk evidence?** Follow every place the fence, the census |
| 56 | (L5, L20), relocation (§5.8), §5.10, H17's confirmer and the claim's |
| 57 | admission rules (C4, §6.4, §6.4a, P6-D2) are used, and say whether any |
| 58 | of them still reads volume records, tags or IAM state, or would admit |
| 59 | a writer from a surviving disk. |
| 60 | 3. **Then only new findings.** Do not re-raise anything resolved in any |
| 61 | earlier round (rounds 1 to 6 of rev 4.x, rev 5 rounds 1 to 3) unless |
| 62 | this revision broke it; if it did, say which change broke it. Data |
| 63 | retention of surviving disk copies is out of scope by H19. |
| 64 | |
| 65 | ## Output |
| 66 | |
| 67 | The disposition table, the answer to focus 2, then new findings ranked |
| 68 | P1 (unsafe or blocks a plan), P2 (wrong or missing), P3 (clarity). Each: |
| 69 | section, the problem, a concrete failing sequence, and a suggested fix. |
| 70 | End with a verdict: ready for plan, or not ready. |
| 71 | |
amadan