# Region HA L14 to L18 against the moves spec and the claim (platform-d8, 2026-10-06) Written while folding region HA spec 1 rev 5.4 §9 (branch `design-region-ha-rev5`) into moves rev 7.19, with claim rev 6.27 (989ee349) §1.1's rulings in hand. "Claim change" means platform-1e has to do something for the moves text to hold. ## Folded into moves rev 7.19 with no conflict - **L15, the target box in the start CAS.** Moves' `hostclaim.BeginMove` (plan 1 Task 3) already takes `targetBox` and records `participants = {source, target}` and `intent.target`. Rev 7.19 §7.1 names `choose()` as the chooser for a multi-box region. No claim change: the participants list and the single-exec rule are claim §2 as they stand. Moves' door reads the roster and the edges snapshot; it needs the roster's eligibility read (region HA §5.2 `eligibleBoxes`) exported from wherever region HA builds it, or it falls back to "the lexically-first box publishing the placement" for a one-box region, which is what it does today. - **L16, one install routine.** `moves.BuildGeneration` (plan 2 Task 8) takes a pinned version set and `N`; relocation can call it with a `genselect.SelectPrepared` plan or a current listing. No claim change. - **L17, the files manifest per installation.** Moves' `local` phase publishes the installed directory through region HA's files publisher before `.files-gen`. **Claim change (already region HA's L13):** the sweep's classifier must treat `files//` as that generation's and protect the objects the files live set names; without L13, a `park-generation` chore would archive a live manifest's objects. Moves also needs the publisher's API (region HA plan 1a's) exported: `files.Publish(ctx, store, location, generation, dir, envPath) (manifestVersion string, err error)` or equivalent; the moves plan names it as a contract, not a fact. ## Folded with a claim change required - **L14, the termination fence as M16's evidence.** Moves §7.10 now says a fenced target is taken off the move automatically before the record's commit, through the declared-loss path, with `fenced_at` as the scope's evidence time. On the claim side this needs L2 to L4 as region HA requests them: `declareLostTransition` today requires `QuarantineRevision != 0` and a non-empty `Enrollment` from an operator-prepared `LossRecord` (leases branch `lost.go:221`); a fence with no quarantine revision and no operator must be a legal declaration input (L4 says a terminated box needs no readmission). Moves needs the journal to carry **one readable reference** to the fence (the `loss.` entry's intent, or a new `fence` key) so `ReturnToSource` (plan 4 Task 2) can accept it as the cited evidence; the key name is the claim's to choose. Until that lands, the moves plan marks the fence path BLOCKED-ON-CLAIM beside `--declare-lost`. - **A terminated source before the flip.** Moves §7.10 says the move aborts and relocation takes the host. The claim's `moving` op must be releasable by the fence's lost-box path while the move's staging park is still owed (abort's `park-staging`, owned by the target region): the release of a `moving` claim with outstanding obligations is today `ErrPendingChore` (`ReleaseMove`); region HA's L1 "source-loss conversion to failover from `starting` or `releasing`" needs the same for `moving`. Claim change: a fence may convert `moving` to `relocating` with the staging obligation carried over, or the obligation's owner must be allowed to acknowledge under the new op. ## Not done, stated as a limit - **L18, two boxes per region in the model.** `internal/sim/hostlife` keeps one box per region plus replacement boxes. The requested extension models relocation, an operation outside the moves spec, over a world whose `box.Region` bookkeeping assumes one box per region; it is not tractable in this revision within the CPU policy (the gate plus one niced 3000 sweep). Rev 7.19 §14.2.6 states the limit. It belongs to a joint round with the region HA session on its own branch once relocation's protocol is fixed. ## Rulings that touch both - **P7, cold-only.** Moves rev 7.19 §0.5 and §19.1: every admission cold, no certificate issued. The claim library keeps `Mode: "warm"` and `PredecessorCertified`; moves never passes them. No claim change; the claim's own §1.1 already records P7. - **Park kinds (plan review round 2, finding 3; platform-1e's interface check).** Moves drops `park-superseded` and `park-staging`: staging lanes are `park-replica` scoped to `moves//`; a source's finalization and a rolled-back target's cleaning are `park-replica` scoped to the whole location (non-authoritative there, so the engine selects everything); a landing's earlier-stay residue is `park-generation` per residue generation (the engine's live-set rule lets those acknowledge after the new generation is live). Destination stays the engine's `parked////`; F3 selects by manifest `Op`. **No new claim kind is needed in 6.27.** Reason: nothing in the move reads superseded data back (a dirty return seals the target's live installation before `cleaning` parks; a clean return restores from the source's live replica), M7's seven-day hold is F3's rule over immutable manifests, not a path, and D5's one manifest per retirement event is the engine's own. - **One claim contract moves still needs for parks on a serving box:** `Engine.Run` acquires the location's replica lease (`park/remote.go:404`). A `park-generation` chore for a location this box itself serves (the landing's earlier-stay residue acknowledging after the probe; the at-rest sweep on a serving host) can only acknowledge if the regional runner's `Leases.Acquire` shares the activator's held lease for a location this box serves (an aggregate lease adapter, claim Plan 5 D3's wording). Moves lists it as a BLOCKED-ON-CLAIM contract.