# Moves into the home region (home-region part 2) Implementation Plan

> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking.

Rev 4.1, 2026-10-15. Paul approved starting part 2 on 2026-10-15. Written against `main` at a5003aba. Tracking thread: amadan #236. Revs 1 to 3 (be29ccd0, c139b80b, bdbfe3fd) were reviewed by Astra, each NOT READY; rev 4 (9c2fbf01) was judged READY with one P3, fixed here. The dispositions of all four rounds are at the end. Next: Paul's rulings (R1 to R7).

**Goal:** Let a Phase 1 move name the home region as its target, under host claims, with the same guarantees a move between two named regions has. That means the commit, a clean or dirty rollback, a pre-flip revert, abort, declare-lost, and the parks in home after the commit. Today the door refuses every such move (MV-N21: "moves to the home region are not supported yet. the home publishes no staging lane").

**Architecture:** Almost all of the box and claim machinery already handles a home target. Part 1 (359e8ac2) maps every record code to an engine region once (`park.PlacementRegion`: the home's `""` is `@home`). Claim Plan 13 (a0806e4c, 2ad5412c) keeps the home box's roster name (for example `ie`) as its claim engine region. It grants the `@home` alias only when the signed roster entry equals the signed fleet home designation. It compares the two names through one rule (`regionname.SameRegion` under `op.intent.home_region`), and it keeps whichever spelling claim state already holds rather than rewriting it. `BeginAdmittedMove` already start-guards both spellings for a home target, `ClaimMoveRosterPlaces` already maps a home roster box to `@home`, and region HA's `ConvertCommittedLanding` already accepts a landing whose `to` is `@home`. What is missing is narrow:

1. **The console door.** It refuses `to == ""` outright. Behind that refusal, its staging capability (`placements()`) skips every edges file without a `placement`, which is exactly the home box, so the home never reads as stageable. Six of its sentences would print the raw code (`""`) for the home. And nothing stops a box whose `CARLOS_REGION` equals the home's name from being picked as a home target, which that box cannot serve.
2. **T3 on the home box.** `moves.CompareEnv` reports `region-missing` whenever the source sets `CARLOS_REGION` and the target does not. A home box never sets it (`agentOwnedVars` adds it only when the box has a region). So every move into home fails T3 and waits at `preparing` for ever. Moves out of home pass only because the loop runs over the source's variables.
3. **Proof through the production owners.** No test runs a move into home through the real box paths. The close harness's probe is a fake (`probeLog.wake`, `movesland_probe_test.go:73`) that calls `AdmitWriter` with a hard-coded `uk-box` and `uk`. It bypasses the production probe owners, their admission evidence and the C8 files publication, which is exactly where the home box's roster name `ie` meets the move's `@home`. The harness's held-env composer also sets `CARLOS_REGION=uk`, which would hide gap 2.

Everything else (the staging lane, the lease key, Touch, Commit, Revert, the rollback halves, the parks, the loss path) is already written region-agnostically and needs executable witnesses, not code.

**Tech Stack:** Go; `internal/console`, `internal/moves`, `internal/host` (tests), `internal/hostclaim` and `internal/hostops` (tests only).

**Spec:** move-any-app design rev 7.22 (`docs/superpowers/specs/2026-10-02-move-any-app-design.md`): §2 and §7.1 (the refusal of "a target of home", F2), §7.3 (staging lane and lease, T1 to T13), §7.6 (landing), §7.9 and §7.10 (revert, rollback, return lane, declare-lost), §16 F2 ("Moves into home": `CARLOS_HOME_PLACEMENT`, home as a target, `carlos move back`). Task 0 amends §2, §7.1 and §16. Claim rev 6.33 (Plan 13's Task I) for the home alias. Index: `2026-10-06-moves-phase1-0-index.md`; D6, D13, D14 and D15 bind every task here. Part 1: `git show 359e8ac2`. Plan 13: `docs/superpowers/plans/2026-10-12-host-lifecycle-claim-13-home-region.md` on `design-replica-ownership`.

## Global Constraints

- **Off means off.** Every change is behind `CARLOS_MOVES_PHASE1` (D13). The legacy door (switch off) keeps its own refusal, em dash and all, unchanged. With the switch on, a home target is admitted **only on a host-claim console** (`s.cfg.HostClaim` with a claim runtime). The plain Phase 1 path keeps refusing it before any write (Ruling R1).
- **One region rule.** A record code becomes an engine region only through `park.PlacementRegion`. Two engine regions are compared only through `park.SameRegion` / `regionname.SameRegion` under the operation's `home_region`, or `park.PlacementMatches` for a code against an engine region. No new `==` between a placement code and an engine region: `TestPlan13NoDirectPlacementEngineComparison` (`home_region_comparison_test.go`) must stay green.
- **Supplied arguments versus retained state.** Every region a moves call site newly hands the claim for a home target is the placement-derived `@home`, never the roster name. Claim state the move finds already written (`touched.regions`, `quiet_after` keys, earlier chores, admissions, predecessor regions) may hold either spelling, and nothing in this plan rewrites, duplicates or canonicalizes it. The first rule is proved at runtime from clean claim state, where a wrong spelling cannot hide (Task 3's `TestHomeTargetFreshStateShowsOnlyTheHomeToken`), and the reviewed set of call sites is pinned by a static inventory that proves nothing about provenance (Task 3's `TestMovesHomeRegionCallSiteInventory`). The second is checked at runtime on claim state, seeding both spellings: whatever spellings the claim held before a step are still there after it, nothing is rewritten, and no chore is duplicated (Review Focus 1).
- **Empty is unset.** `""` stays unset at every engine and claim boundary. Do not make `Validate`, `parkQueueGuard`, `AdmitWriter`, `PublishGeneration` or `Cover*Predecessors` accept it (Plan 13's constraint, kept).
- **No claim or region HA production code changes.** This plan writes tests in `internal/hostclaim` and `internal/hostops` only where they drive moves' own call sites. Anything that would change claim or region HA behaviour is an ask (below), not a task.
- **Cold only (P7, D14); one-box regions only (D15).** Nothing here relaxes either. T8 and S1 keep counting every edges file that publishes the placement. Ruling R2 decides how dev lives with that.
- **Copy.** Every new operator-facing string is a `pending` row in `2026-10-06-moves-phase1-copy.md` in the commit that writes it, and in `movesCopyIDs` (`approved_moves_copy_test.go`). Ids MV-N510 to MV-N529 are reserved for this plan (checked free on every branch on 2026-10-15). An approved template whose fill changes keeps its text and its row; only the argument passed in changes. No em dashes anywhere: a full stop and a new sentence, lower case where the door's sentences are lower case.
- **Gate.** While iterating, targeted runs only: `go test ./internal/moves ./internal/console -run 'Home|MoveDoor|CompareEnv' -count=1` and `go test ./internal/host -run 'Home|Plan13|ProbeOwners|Revert' -count=1`. Never run the whole `internal/host` suite locally; CI's `make test` is the full run (Paul, 2026-10-12). Before handing off, once: `go build ./...`, `go vet ./...`, `gofmt -l .`, the copy gate (`go test . -run 'Moves|Copy' -count=1`) and the cross-compile (`GOOS=darwin`, `GOOS=windows`, `GOOS=linux GOARCH=arm64` `go build ./...`). The Go build cache stays at its default. Use `GOFLAGS=-buildvcs=false` if the worktree's VCS metadata is unreadable from the sandbox. Tests serial and niced; no `internal/sim/hostlife` sweep.
- **Nothing rolls without Paul's go.** Merge only on amadan with `amadan branch merge -squash`, after re-merging `main` and a green CI on the tip.

## What already exists (do not rebuild)

| piece | where | what it already does for a home target |
|---|---|---|
| home's engine region | `internal/regionname`, `park.HomeRegion`, `park.PlacementRegion` | `""` maps to `@home`; `@home` is outside the placement alphabet |
| the alias | `regionname.SameRegion`, `claimRegionBinding` (`internal/host/claimregion.go`), `Roster.MatchesHome` | the roster name and `@home` are one region only under a verified designation |
| alias-aware replay | `QueueResidueParks`, `queueReplicaPark` (`TestPlan13ResidueAliasQueue`, `TestPlan13ReplicaAliasQueue`, `internal/hostclaim/plan13_followups_test.go`) | an `@home` replay of a chore already queued under `ie` changes nothing and adds nothing |
| the start CAS | `hostops.BeginClaimMove`, `ClaimMoveRosterPlaces`, `hostclaim.BeginAdmittedMove` | maps a home roster box to `@home`; writes `op.intent.to = @home` and `home_region`; start-guards both spellings (CC11 over `ie` and `@home`) |
| the home lane's lease | `stagingLeaseKey` (`internal/host/movespass.go`) | `control/staging-leases/@home/<host>` in the deployment bucket, for every caller that passes a record code |
| the source finds home's bucket | `loadMoveFleet` (`internal/host/movesreport.go`) | keeps the placementless box under `""`, so `fleet.targets[""]` is the home box's `data_bucket` |
| Touch | `sourceRound` (`internal/host/movesphase1.go:321-331`) | skips the write when `touched` already holds either spelling of home and the target box; otherwise adds `@home` |
| T8, T9, T12 | `checkOneOwner`, `checkClaim`, `checkQuiet` | name home by the operation's home name; T9 accepts either spelling in `touched`; T12 reads the later of both quiet keys (`TestPlan13HomeTargetReadiness`, `TestPlan13MoveQuietReadsLegacyAndHomeToken`) |
| arming on the home box | `armMovesParks` | arms only when the claim grants the `@home` alias; T13 fails closed otherwise |
| parks under either name | `park.Engine.OwnsRegion`, `hostbox.Regional.Run`, the moves filters (`PlacementMatches(cfg.ParkHomeRegion, cfg.Region, o.Region)`) | `region:@home` chores run on the home box's moves engine and its regional runner |
| production probe owners | `movesProbeOwners` (`internal/host/movesprobeowners.go`) | compare the admission's region with `op.intent.to` and the predecessor's through `SameRegion`; project home history for the baseline (`HolderRegionView`) |
| predecessor cover | `hostclaim.CoverRegionPredecessors` | compares through `SameRegion` under the op's home binding |
| fence and loss | `MoveFenceRegions`, `VerifyMoveTargetFence`, `move_loss_owner.go` | a home target's fence binding maps to `@home` (`TestPlan13FenceRecoveryHomeAndNamed`, "target-home") |
| committed landing on a dead target | `hostclaim.ConvertCommittedLanding` (region HA) | accepts `to = @home` under the op's binding; the relocation's `intent.region` is the roster name |
| authoritative region | `movesAuthoritative` (`internal/host/movessources.go`) | landing and restoring compare through `SameRegion`; the source stays protected until commit or return (J2/F4) |

## Answers to the brief's questions

**Q1. What is missing for a move whose target is home.**

- **Staging lane.** Bucket: the home box's own data bucket, `CARLOS_HIBERNATE_BUCKET`, which its edges file publishes as `data_bucket` with no `placement`. Lease: `control/staging-leases/@home/<host>` in the deployment bucket (part 1's `stagingLeaseKey`). Lane keys: `moves/<host>/<move id>/...` in the home bucket, written by the named source under its `sibling_staging_arns` grant (M17). Who publishes it: the home box's edges-file pass already publishes the coordinates; the console just does not read them (`placements()` skips a file with no `placement`). Task 5 adds a move-only fold. Nothing new is published.
- **How the source finds the bucket and the ARNs.** It already does: `loadMoveFleet` keys the home box under `""`, and every source step looks up `fleet.targets[rec.Move.To]`. IAM is infra: every named region's `sibling_staging_arns` must list the home data bucket's ARN (the source pushes the lane into it), and the home box's must list every named bucket (the home target's T10 probe and its dirty return lane). M17's mesh ("every region lists every other region's data bucket") already says this; P-2 of the runbook has to check that the home bucket is in it (Task 6).
- **T1 to T13 on a home box.** All but T3 already work (table above). T3 is gap 2: `CompareEnv` must accept a home target that sets no `CARLOS_REGION` (Task 1). T8 has a deployment precondition, not a code gap: exactly one edges file in the deployment may lack a `placement` (Ruling R2).
- **Landing on a home box.** Already written: the landing runs on the box the claim names, queues its earlier-stay residue as `park-generation` chores (D6), and commits with `Commit(id, PlacementRegion(From), source, @home, ...)`. The probe's admission, through the production probe owners, records the home box's engine region, its roster name. Task 3 proves it end to end through those owners.
- **Rollback, revert and return lanes (source named, target home).** The home box releases with `TargetReleased(..., @home, ...)`, which matches `op.intent.to` exactly; its cleaning park and the move's lane park are queued with `@home`. A dirty return lane is written by the home box into the named source's bucket under `control/staging-leases/<source>/<host>`, and `QueueReturnLanePark` names the source region. A cut that fails before the flip reverts on the source with `Revert(id, source, @home, &laneScope, ...)`, and the home box parks the lane. Task 4 proves each.
- **Parks in home after the commit.** Two kinds, both owned by home's regional runner: the staging lane's `park-replica` (queued by `Commit`) and the residue `park-generation` chores of an earlier stay (queued at the landing's `parking` step, including the legacy root generation `@root` of a host that was created in home). A new chore is queued with `@home` and owner `region:@home`. A chore the claim already owes under `ie` (from an earlier stay or a sweep) is kept as it is, and the `@home` replay neither duplicates nor rewrites it (Plan 13's alias-aware queue). The home box's moves engine runs the immediate half; `hostbox.Regional` on the home box acknowledges. The source's location park runs in the named source region.
- **The `@home` alias in Touch, Commit and Release.** Touch: when `touched` lacks every spelling of home or lacks the target box, the source adds `PlacementRegion(To)`, which is `@home`, and the target box; when it already holds `ie` (Run 1b, after Run 1 moved the host out of home under the same claim), it writes nothing. Commit: `targetRegion` is the home box's `parkRegion()`, `@home`, which matches `op.intent.to` exactly; the source's quiet key is the named region. Release: `TargetReleased` passes `@home`; `ReleaseMove` and the K8 release name no region. The claim compares `op.intent.to` exactly, and that is safe because `op.intent.to` is itself written as `@home` by the start CAS and moves always supplies `@home`. Task 3 pins the supplied arguments (Review Focus 1, Ask A1).
- **How the door resolves `--to`.** As today: `homeRegionIn` maps the console's home name (`CONSOLE_HOME_REGION`, or the claim-mode fallback `dbClaimHomeRegion`) to `""`. No `home` keyword (Ruling R3): a named region called `home` stays a named region, as Plan 13 rules. With no home name configured the home cannot be named, and the request is `invalid region` as today.

**Q2. Claim-side and region HA changes.** None required in production code. The asks are each backed by an executable witness in this plan, plus one optional hardening (A1).

**Q3. What is shared with part 1, and the failure modes.** Shared: `park.PlacementRegion`, `stagingLeaseKey`, `cfg.parkRegion()`, `moveFleet`'s home key, the engine bindings (`ParkHomeRegion`), the predecessor mapping and the park view's J2/F4 rule. Part 2 adds no new mapping. The failure modes are listed in Review Focus and in "Failure modes" below.

**Q4. Rollout and Run 4.** See "Rollout order" and "Rehearsal changes" below. Run 4 itself does not need moves into home. It needs Runs 2 and 3, which as written move into home.

## Review Focus

1. **One region, two names (Plan 13's dedupe rule).** Two separate properties, each with its own witness:
   - **Supplied arguments are `@home`.** The claim compares `op.intent.to` exactly in `Abort`, `Revert`, `TargetReleased`, the loss and fence paths, and in `requireRetiredRegion` (`internal/hostclaim/move.go:549`). `QueueStagingPark` does not compare it: it validates the scope and queues through the alias-aware `queueReplicaPark` (`move.go:598`), so a wrong spelling there shows as a new chore's region, not a refusal. If a moves call site passed the roster name `ie` instead, most of these refuse (fail closed), but `requireRetiredRegion`'s `region != to` would read `ie` as "not the target" at `landing/committed` and allow a whole-location park in the live home region. The park view still protects the live generation (`movesAuthoritative` answers `@home`, compared through `SameRegion`), so that is defence in depth. The staging lease is the other place: a key spelled with the roster name would split the lane's lease from the source's `@home` key and let two writers stage at once.
   - **Retained state keeps its spelling.** `touched`, `quiet_after`, earlier chores and admissions may already name home as `ie`. A replay must neither add a second chore for the same work under `@home` nor rewrite the `ie` one, and Touch must not write when `ie` is already there. Witnesses seed both spellings.
2. **T3's home rule.** A home target must set no `CARLOS_REGION`; a named target must still set its own, different from the source's. A target in home that does set one is a box that is not the home box, and T3 must fail it (`region-present`), not wave it through (Task 1).
3. **Production owners, not fakes.** The landing, the restarted probe, the C8 files publication, the source's recovery after a rollback and the pre-flip revert must run through `movesProbeOwners`, `movesRecoveryOwners` and the claim runtime, with the home box's engine region `ie` and the op's `to` `@home`. A witness that admits through a fake probe with a literal region proves nothing here (Tasks 2 to 4).
4. **The door's home capability must not leak into create.** `placements()` feeds the create gate's `published` flag and `armedPlacements`; adding `""` there would change create. Task 5 folds the home only in a move-only reader, and `TestCreatePlacementsUnchangedByHomeFold` pins create.
5. **A home-named box is not a home box.** A box with `CARLOS_REGION=<home name>` is home to the console (`homeRegionIn`) but not to itself (no alias; its `cfg.Region` is `ie`, so it never writes a target report, and the source's `fleet.targets[""]` never finds it). The door must refuse it, and say why, before the capability check would give a misleading staging refusal (MV-N511, Task 5).
6. **Parks after the commit, from both engines.** The home box runs home chores from its moves engine (region `@home`) and from `hostbox.Regional` (region = roster name, alias `@home`). Both must acknowledge the same chore once, and a named box must never acknowledge either (`TestPlan13NamedBoxCannotAcknowledgeHomeDelete` covers the named side; Task 4 covers the home side).

---

## File structure

| path | responsibility |
|---|---|
| `docs/superpowers/specs/2026-10-02-move-any-app-design.md` | §2, §7.1, §16 F2 amendment (Task 0) |
| `internal/moves/envreport.go`, `internal/moves/envreport_test.go` | T3's home rule in `CompareEnv` (Task 1) |
| `internal/host/movesreport.go` | `checkEnv` passes the home target to `CompareEnv` (Task 1) |
| `internal/host/movesphase1_harness_test.go` | the `intoHome` option: the source's code, box and bucket, and the target's, parameterized (Task 2) |
| `internal/host/movesland_test.go`, `internal/host/movesland_probe_test.go` | `targetCfg` and `probeLog` take the target from the harness instead of `uk`/`uk-box` (Task 2) |
| `internal/host/movesparks_test.go` | `newCloseHarness` can run its probe through the production owners (Task 2) |
| `internal/host/movesprobeowners_test.go`, `internal/host/movesrecoveryowners_test.go`, `internal/host/moveswakesource_test.go` | their fixtures accept a home target box (Task 2) |
| `internal/host/movesrevert_test.go`, `internal/host/movescut_test.go` | the pre-flip revert fixture accepts a home target (Task 2) |
| `internal/host/moveshome_target_test.go` | new: the into-home witnesses (Tasks 1, 3 and 4) |
| `internal/hostops/move_home_target_test.go` | new: declare-lost and recovery grant witnesses for a home target (Task 4) |
| `home_region_args_test.go` | new, repository root: the inventory of every call site that hands the claim a region on a move's path, each with its runtime witness (Task 3) |
| `internal/console/apiinstancemove.go` | the door's home-target rules and display fills (Task 5) |
| `internal/console/instancesplacement.go` | `movePlacements`, the move-only home fold (Task 5) |
| `internal/console/boxselect.go` | one home name for selection (Task 5) |
| `internal/console/apiinstancemove_home_test.go` | new: the door's home-target tests (Task 5) |
| `docs/superpowers/plans/2026-10-06-moves-phase1-copy.md`, `approved_moves_copy_test.go` | rows MV-N510 to MV-N512, MV-N21 withdrawn |
| `docs/superpowers/plans/2026-10-06-moves-phase1-rehearsal.md`, `docs/superpowers/plans/2026-10-06-moves-phase1-0-index.md` | P-0, P-2, Run 1b, Runs 2 to 4, Run 6 (Task 6) |

---

### Task 0: Spec amendment

**Files:** modify `docs/superpowers/specs/2026-10-02-move-any-app-design.md`.

- [ ] §2: "between two non-home, non-fleet placements or out of home" becomes "between two non-fleet placements, into home only with host claims on".
- [ ] §7.1's refusal list: "a target of home" becomes "a target of home on a console without host claims, or a home whose box sets a region code of its own".
- [ ] §16 F2: home as a target is delivered by this plan. `CARLOS_HOME_PLACEMENT` is superseded by Plan 13's signed fleet home designation, which names home once for every reader; no environment variable is added. `carlos move back` stays a follow-on (Ruling R3).
- [ ] A spec header line for the revision, citing this plan and #236.
- [ ] Commit: `git commit -m "spec: moves into home (part 2), §2, §7.1, §16 F2"`.

---

### Task 1: T3 accepts a home target that sets no region

**Files:** modify `internal/moves/envreport.go`, `internal/host/movesreport.go`; tests in `internal/moves/envreport_test.go` (extend) and `internal/host/moveshome_target_test.go` (create).

**Interfaces:**
- `moves.CompareEnv(source, target EnvReport, flatLayout, targetHome bool) []EnvDiff`. Every existing caller passes `targetHome` explicitly; there is one production caller (`checkEnv`) plus tests.
- For the region class:
  - `targetHome` false: unchanged (`region-missing` when the target lacks it, `region-same` when equal).
  - `targetHome` true: the target must **not** carry `CARLOS_REGION`. Absent is no diff. Present is `EnvDiff{name, "region-present"}`, checked in both loops (the source may or may not carry it: a move between two home boxes is refused at the door, but T3 does not rely on that).
- `checkEnv` passes `targetHome := rec.Move.To == ""`. That is a record-code test on a record code, which the lint allows. It must not be derived from `cfg.Region`: a second placementless box is a T8 failure, not a T3 pass.
- `region-present` is a fill-in token inside MV-N129's list (`<NAME (kind)>, ...`), so it gets its own row (MV-N512), as MV-N146's fill-in did.

**Tests:**
- `TestCompareEnvHomeTargetSetsNoRegion`: source with `CARLOS_REGION=uk`, target without, `targetHome` true: no diff. The same pair with `targetHome` false: `region-missing` (today's rule kept). Target with `CARLOS_REGION=ie` and `targetHome` true: `region-present`. Source without and target without, `targetHome` true: no diff.
- `TestHomeTargetT3FromTheRealComposition`: build the home box's held environment through the production composer (`agentOwnedVars` with no region, as the box's `ComposeHeldEnv` calls it), not the harness's fixture, so the test fails today and passes after the fix. Assert the target report's T3 is `ok`.
- `TestNamedTargetT3Unchanged`: the existing T3 tests pass with `targetHome` false at every call.

**Copy:** MV-N512 (below), pending.

- [ ] Write the failing tests; implement; targeted runs; commit with the copy row and the inventory line: `git commit -m "moves: T3 accepts a home target that sets no region (home part 2)"`.

---

### Task 2: Fixtures for a home target box

Fixture work only. No production code changes, and every existing test passes unchanged at the end of the task.

**Files:** `internal/host/movesphase1_harness_test.go`, `internal/host/movesland_test.go`, `internal/host/movesland_probe_test.go`, `internal/host/movesparks_test.go`, `internal/host/movesprobeowners_test.go`, `internal/host/movesrecoveryowners_test.go`, `internal/host/moveswakesource_test.go`, `internal/host/movesrevert_test.go`, `internal/host/movescut_test.go`. Read each fixture's current constructor before editing; the list is what the into-home witnesses touch, and an implementer who finds another hard-coded `uk`/`uk-box`/`data-uk` on the target side parameterizes it the same way and adds it to the commit.

**The `intoHome` option.** It mirrors `fromHome` (`h.src = ""`) for the target:
- the source is placed in a named code that is not the home's name (use `ca`), with box `ca-box` and bucket `data-ca`, so no fixture name suggests home and the home's name never collides with the source (today's fixture hard-codes `ie-box` and `data-ie` in several places; parameterize them as `fromHome` parameterized the source's code);
- the target is `home-box`, placement `""`, bucket `data-home`, AWS region `eu-west-1`; its edges file has `data_bucket` and no `placement`;
- the roster names `home-box` in region `ie` and carries the fleet designation `home_region: ie`; the claim's op carries `home_region: ie`; the target's `moveCfg.ParkHomeRegion` is `ie`, as `armMovesParks` would set it;
- the target's held-env composer sets **no** `CARLOS_REGION` (the current fixture's `env["CARLOS_REGION"] = "uk"` would hide Task 1's gap);
- the start uses `BeginAdmittedMove(..., PlacementRegion(""), MoveAdmission{HomeRegion: "ie", ...})`, as the claim-mode door does, not the plain `BeginMove`;
- an option to seed retained claim state under either spelling: `touched.regions` holding `ie` or `@home`, a `quiet_after` key under either, and an earlier residue chore owed under `ie`.

**The production probe for the close harness.** `newCloseHarness` (`movesparks_test.go:38`) installs `probeLog.wake`, which admits with a literal `Box: "uk-box"` and `Region: "uk"`. Add a harness mode that wakes the probe through the production `movesProbeOwners` over the claim runtime, as `TestMovesProbeOwnersThroughTheClaimRuntime` (`movesprobeowners_test.go:814`) does, with the target box's identity: `m.Box = home-box`, `m.Region = ie` (the claim engine's name), `m.HomeRegion = ie`, `m.FleetHomeRegion = ie`. The fake stays for the existing tests.

**The recovery owners and revert fixtures.** `movesRecoveryOwners`' fixture and the cut and revert fixtures accept a home target (the source box is `ca-box`, the target `home-box`), so the source's recovery after a rollback and a pre-flip revert can run through the production owners.

**Tests:** `TestIntoHomeFixtureIsAHomeTarget`: the fixture's record has `Move.To == ""`; the target's edges file has no placement; the claim's `intent.to` is `@home` and `home_region` is `ie`; the target's held env has no `CARLOS_REGION`; the production probe mode admits on `home-box` with region `ie`.

- [ ] Parameterize; run the targeted suites to show nothing existing changed; commit: `git commit -m "moves: fixtures for a home target box (home part 2)"`.

---

### Task 3: The commit into home, through the production owners

**Files:** extend `internal/host/moveshome_target_test.go`; create `home_region_args_test.go` at the repository root.

**Tests (each through the production owners from Task 2, never the fake probe):**
- `TestMoveIntoHomeStagesTheHomeLane`: the source round writes `move.json` and the replica lane into `data-home` under `moves/<host>/<id>/`; it takes the lease `control/staging-leases/@home/<host>` and no other. Touch, with `touched` empty of home: the write adds `@home` and `home-box`. With `touched` already holding `ie` and `home-box` (seeded): no Touch write, and `touched` is byte-identical afterwards. With `touched` holding `ie` but not `home-box`: one write that adds `@home` and `home-box` and leaves `ie` in place, so `touched` then holds both spellings. That is correct, not a defect: Touch is a union and never canonicalizes. Every case asserts preservation (each region and box held before is still held after) and that the only region Touch ever adds is `@home`; none asserts that exactly one spelling is present.
- `TestMoveIntoHomeTargetChecksPass`: on `home-box`, T1 to T13 are all `ok`. T8 names the home by its name. T10 probes `data-ca`. T12 refuses inside a quiet window recorded under `ie`, and again under `@home`.
- `TestMoveIntoHomeCommitsAndCloses` (through the real cut, flip and landing, then the production probe owners and the claim runtime, as `TestMoveFromHomeClosesThroughTheSourcePark` does for part 1 with the fake):
  - an earlier home stay is seeded in `data-home` (a root generation and one named generation); the landing queues one `park-generation` per residue generation with region `@home`, owner `region:@home`, and none for the install's own;
  - the probe's admission, written through `AdmitWriter` with the production `AdmissionEvidence`, records `home-box` with region `ie` and `PredecessorRegion` `ca`; the admission evidence compared `ie` with `op.intent.to = @home` through `SameRegion` and passed;
  - the C8 provider establishes the prepared generation's files manifest under `data-home`'s `<location>/files/g-<id>/` (`moves.GenerationFilesPrefix`), as `TestLandingWakesEstablishThroughC8` does for a named target;
  - the commit queues the source's location park in `ca`, the lane park with `@home`, and covers the source's predecessor; `quiet_after` gains `ca` and never `""`;
  - after the horizon, the home box's engine acknowledges the lane park, the source parks its location, and the record closes with `Region == ""` and `LastMove.Outcome == "done"`;
  - the result can move out of home again: `ClaimMoveRosterPlaces` and the source round accept a second move `"" -> ca` (part 1's path).
- `TestMoveIntoHomeRestartedProbe`: the first probe attempt is admitted and the agent restarts before readiness. The restarted attempt is published fenced (`TestMovesProbeOwnersPublishARestartedAttemptFenced`'s shape) on `home-box`, its admission's predecessor is the first attempt's generation in `ie`, and the commit proceeds as above.
- **The first half of Review Focus 1: supplied regions are `@home`.** Rev 3 proposed a static provenance check. Round 3 showed its classifier could not prove provenance (`to := c.Op.Intent["home_region"]; park.PlacementRegion(to)` passed while supplying `ie`), and a sound version needs dataflow across functions, parameters, struct fields decoded from signed intents, and closures. That is a project of its own, and a heuristic version gives false assurance. Rev 4 uses two narrower pieces instead: a runtime proof, and a static inventory that claims nothing about provenance.
  - **`TestHomeTargetFreshStateShowsOnlyTheHomeToken` (runtime, the proof).** Each into-home witness in Tasks 3 and 4 runs once from **clean** claim state: the start CAS writes `intent.to = @home` and `home_region = ie`, and nothing else in the claim names home (no `touched` entry, no quiet key, no chore). From clean state a wrong spelling cannot hide, because each harmful use shows up:
    - a chore queued with `ie` is a new obligation whose `Region` or `Owner` names `ie` (alias-aware replay absorbs a call only when an equivalent chore already exists, and none does);
    - a Touch with `ie` adds `ie` to `touched`;
    - a staging lease keyed with `ie` shows in the fake lease's recorded keys;
    - an exact comparison against `intent.to` (`Abort`, `Revert`, `TargetReleased`, `ReleaseFencedTarget`, `ReleaseLostTarget`) refuses, and the witness fails;
    - `QueueStagingPark` does not compare with `intent.to`: it validates the scope (`parkQueueGuard`, the lane's location) and calls the alias-aware `queueReplicaPark` (`internal/hostclaim/move.go:598`). A fresh `ie` there would queue a new lane chore named `ie`, which the chore-region assertion below catches.

    After each witness the test asserts that every obligation created for the target side has `Region == "@home"` and `Owner == "region:@home"`, that `touched` gained only `@home` and the target box, and that the lease keys are `control/staging-leases/@home/<host>` for the home lane. A second call with the wrong spelling after a correct first one would be absorbed, but by construction it neither duplicates nor rewrites (that is the retained-state rule below), so it is harmless. The one harmful absorbed case, `requireRetiredRegion` allowing a location park, would create a **new** obligation and is therefore visible.
  - **`TestMovesHomeRegionCallSiteInventory` (static, a pin, not a proof)** in `home_region_args_test.go` at the repository root. It lists every production call site that hands the claim a region on a move's path, and compares the list with a golden inventory in the test. Each inventory row is `{file, enclosing function, callee or composite type and field, argument expression text, witness}`.
    - **Sites:** in every non-test `.go` file under `internal/host`, `internal/hostops` and `internal/console`, every call to `hostclaim.Touch`, `Abort`, `Revert`, `Commit`, `QueueLocationPark`, `QueueStagingPark`, `QueueResidueParks`, `QueueReturnLanePark`, `TargetReleased`, `BeginMove`, `BeginAdmittedMove`, `ReleaseFencedTarget`, `ReleaseLostTarget` and `moves.StagingLeasePrefix`, and every composite literal of `hostclaim.FencedTargetRelease` and `hostclaim.LostTargetRelease` (fields `TargetRegion` and `SourceRegion`), plus each helper that builds the regions they carry: `moveLossRelease` (the `LostTargetRelease` literal), `claimLossIntent` (which copies `TargetRegion` from `op.intent.to`) and `recordLossIntent` (which sets `SourceRegion` from the record), all in `internal/hostops/move_loss_owner.go`. The intent read back from a signed loss record (`lossIntentOf`) is not a new derivation and is not listed.
    - **Witness column:** the runtime test that drives that site with a home target from clean state, or `named-only` with the guard that keeps a home target away. Two rows are expected to be `named-only`: the plain-path `BeginMove(..., to, ...)` (MV-N510 refuses `to == ""` first, Task 5), and any site Task 3 or 4 finds unreachable for a home target. Retained, validated intent is a narrow, named exception: `LostTargetRelease.TargetRegion` is `in.TargetRegion`, which `claimLossIntent` copies from `op.intent.to` and the loss record signs, so its witness is `TestMoveIntoHomeDeclareLost`, and the row says so.
    - **What fails:** a site not in the inventory; an inventoried site whose argument expression text changed; an inventory row whose site no longer exists. The failure message says to add or update the row and name a runtime witness. Fixtures: a new `hostclaim.Commit(id, from, src, rr.row.Region, ...)` site fails as unknown; `to := c.Op.Intent["home_region"]` followed by `hostclaim.QueueStagingPark(id, park.PlacementRegion(to), ...)` at a new site fails as unknown, and at an inventoried site fails as changed; a `FencedTargetRelease{TargetRegion: o.Claim.Op.Intent["home_region"], ...}` literal fails as changed; an unchanged tree passes.
    - **What it does not do:** it classifies nothing as safe by its shape. `plan13Placement` and `plan13Engine` are not used. The inventory's value is that a reviewer saw each site once and a runtime witness covers it, and that no new site appears without both.
  - **Why this trade.** The runtime proof covers exactly the paths a home target takes in the witnesses, with no heuristic. The inventory closes the gap a runtime proof leaves, new or edited call sites, by forcing a review and a witness rather than pretending to verify them. A moves-side injection point over the transition factories remains rejected: it adds production indirection on the claim's authority path to serve a test.
- `TestHomeTargetRetainedChoresKeepTheirSpelling`: with a residue chore and a lane chore already owed under `ie` (seeded), the landing's `QueueResidueParks(@home)` and the commit's `QueueStagingPark(@home)` leave the obligation list byte-identical (no second chore, no rewrite to `@home`); the same with them owed under `@home`. Both are acknowledged once by the home box's engine. This is the second half of Review Focus 1.

- [ ] Write the tests; fix only what they prove broken (expected: nothing outside Task 1); targeted runs; commit: `git commit -m "moves: commit into home through the production owners (home part 2)"`.

---

### Task 4: Revert, rollback, abort, loss and conversion with a home target

**Files:** extend `internal/host/moveshome_target_test.go`; create `internal/hostops/move_home_target_test.go`.

**Tests (production owners throughout):**
- `TestMoveIntoHomePreFlipRevert`: the cut stops the source on `ca-box` and fails before the flip (the shape of `TestCutDeadlinePassedReverts`). `Revert(id, ca-box, @home, &laneScope, ...)` queues the lane park with `@home`, owner `region:@home`; the source's revert probe re-admits on `ca-box` through `movesRecoveryOwners` (`TestRevertProbeAdmitsUncovered`'s shape) in region `ca`; `home-box`'s moves engine runs the lane park on `data-home`, and the home box's `hostbox.Regional` acknowledges it after the horizon. Nothing in `data-ca` is parked.
- `TestMoveIntoHomeCleanRollback`: the probe fails before any write. `TargetReleased` names `@home` and matches `op.intent.to`; the cleaning park of `home-box`'s location and the move's lane park are queued with `@home`; the source reopens on `ca-box` through `movesRecoveryOwners`, asserted in two stages as production recovery works (`movesrecoveryowners.go:300`, and the existing clean-return test at `movesrecoveryowners_test.go:465`). Before the admission: after the clean `ReturnToSource`, `holder.generation` is `src_gen`, and the recovery owners' baseline plan (`r.baseline`) restores from `src_gen`. After the admission: `holder.generation` is the fresh generation the admission named (`fresh1` in that fixture's naming), not `src_gen`; the last admission has `Coverage == "clean-return"`, `WritesLost == nil` and no `AdditionalWritesLost`, and its `Region` is `ca`. Its `Predecessor` and `PredecessorRegion` are the previous last admission's (`hostclaim/generation.go:117` takes both from it, not from the restore baseline): the failed home target's admitted generation and its region in the spelling that admission recorded, which is `ie` in the fixture, not `@home` (the existing named-target shape is `movesrecoveryowners_test.go:446`). The record ends `rolled_back`; nothing is parked in `data-ca` that the source still serves (J2/F4 through `restoring`).
- `TestMoveIntoHomeDirtyReturn`: the probe writes, then fails. `home-box` seals its installation and writes the return lane into `data-ca` under `control/staging-leases/ca/<host>`; `QueueReturnLanePark` names `ca`; the source installs the return through the recovery owners, establishing its files from the return's manifest (C8), and the pre-move generations park after the return (D6), not before.
- `TestMoveIntoHomeAbortParksTheHomeLane`: abort before the cut. `Abort` queues the lane park with `@home`; `home-box`'s moves engine runs it; `hostbox.Regional` on `home-box` (region `ie`, alias `ie`) acknowledges it after the horizon; a named box's runner refuses it; the record clears only after that (Plan 5 Task 1's rule). This is Ask A2's witness.
- `TestHomeRegionalAcknowledgesBothSpellings`: the real `hostbox.Regional` on `home-box` acknowledges a lane `park-replica` and a residue `park-generation` owed under `@home`, and the same owed under `ie`, each exactly once; a `ca` box's runner acknowledges none of the four. Also Ask A2's witness.
- `TestMoveIntoHomeDeclareLost` (hostops): a home target stopped mid-landing and declared lost through Plan 4 Task 10's door. The loss intent's `TargetRegion` is `@home`; the source is re-admitted with the loss through `AdmitWriterWithLoss`; the record shows `loss_ref`. It reuses Plan 13's `TestPlan13FenceRecoveryHomeAndNamed` fixture rather than a new one. `ReleaseLostTarget` must succeed with `TargetRegion == @home` against `intent.to == @home`.
- `TestMoveIntoHomeFencedTargetRelease` (hostops): a home target terminated after it released, from clean claim state. `MoveRecoveryGrant.ReleaseFencedTarget` builds `FencedTargetRelease` with `TargetRegion: park.PlacementRegion(m.To)` (`@home`) and `SourceRegion` `ca`; `hostclaim.ReleaseFencedTarget` accepts it against `intent.to`; the location and lane parks it queues name `@home`. The witness for the inventory's `FencedTargetRelease` row.
- `TestCommittedLandingIntoHomeConvertsOnTargetFence`: after the commit, `home-box` is fenced as terminated. `hostclaim.ConvertCommittedLanding` turns the claim into `relocating` with `intent.region = ie` (the roster name) and `move_to_region = @home`, and keeps the lane park and the source's finalization chores in their retained spelling. This is Ask H1's witness. It changes no region HA code.

- [ ] Write the tests; any production fix they force is in moves' code only, and a failure that points into claim or region HA code becomes an ask on #236, not a patch; targeted runs; commit: `git commit -m "moves: into-home revert, rollback, abort, loss and conversion witnesses (home part 2)"`.

---

### Task 5: The door admits a home target under host claims

**Files:** modify `internal/console/apiinstancemove.go`, `internal/console/instancesplacement.go`, `internal/console/boxselect.go`; create `internal/console/apiinstancemove_home_test.go`; the copy record and `approved_moves_copy_test.go`.

**Interfaces:**
- `movePlacements(ctx, s release.Store, home string) (caps map[string]placementCapability, homeNamed []string, published bool)`: `placements()` plus the home, folded under `""` from every edges file with no `placement`. Same reachability rule: no `eip`, no capability. Staging is `data_bucket != ""`. `homeNamed` is the sorted box ids of edges files whose `placement` equals `home` (when `home != ""`). `published` keeps `placements()`'s meaning, so a home-only fleet still reads "publishes no armed regions". `placements()` and `armedPlacements()` are unchanged.
- `(s *Server) stagingNames(caps) string`: `stagingCodes` with each code passed through `homeRegionOut`, so MV-N20's list names the home by its name.
- `(s *Server) moveHomeName() string`: `dbClaimHomeRegion()` with host claims, `cfg.HomeRegion` without. `selectMoveBoxes`, `verifiedRoster` and `eligibleBoxes` take the home name from it. That is the name `homeRegionIn` already uses, so selection and the door agree when the console's home is the claim-mode fallback.

**The Phase 1 request door, in order (`handleAPIInstanceMoveRequest`):**
1. `to == ""` and not a host-claim console: refuse with MV-N510 (400) before any read or write. This replaces MV-N21 on this path.
2. `to == rec.Region`: unchanged (MV-N16 already fills through `homeRegionOut`).
3. The manifest rule: a home target is allowed when some entry of `m.Regions` maps to `""` through `homeRegionIn`, or the list is empty. Named targets keep `slices.Contains`. MV-N2 fills `<to>` through `homeRegionOut`. Before writing this step, read the create door's rule (`instanceRegionAllowed` at `apiinstances.go:1268` and `regionchoices.go:23-41`). If create treats a home entry differently, follow `regionchoices.go`'s `homeRegionIn` mapping and record the difference in the task's report as a finding for the create door.
4. **New, before the capability check:** `to == ""` and `len(homeNamed) > 0`: refuse with MV-N511 (409), naming the first box. Why here and not after selection: the home fold takes placementless files only, so a deployment whose only home box sets `CARLOS_REGION=<home name>` has no `caps[""]` staging, and the capability check would answer MV-N20 ("publishes no staging bucket"). That is false, since the box may well publish a bucket, and it hides the misconfiguration the operator has to fix. Checking the edges files the capability read already loaded costs nothing extra. Because the read is not liveness-joined, a stale file of a home-named box that has since gone also refuses; that fails closed and is fixed by removing the file, which the refusal names. A deployment with both a placementless home box and a home-named box also gets MV-N511, not M-C21, for the same reason.
5. Staging: `movePlacements` in place of `placements`. MV-N20 fills `<to>` through `homeRegionOut` and the list through `stagingNames`.
6. `selectMoveBoxes` as today. MV-N23 fills `<to>` through `homeRegionOut`. M-C21's `ManyRegion` is already `homeRegionOut`.
7. The floor: MV-N5 (`apiinstancemove.go:633`) fills `<from>` and `<to>` through `homeRegionOut` (today `to` is raw).
8. `startClaimModeMove`: MV-N177 (`:786`, `:797`) fills `<to>` through `homeRegionOut` (today raw); the call to `moveClaimCASFailed` at `:831`, and the plain path's call, pass `homeRegionOut(to)`, so MV-N30 ("the instance has unfinished cleanup in <to>") names the home. `moveClaimCASFailed`'s parameter is renamed `toName` to say it is a display name. Every other step is unchanged: `MatchesHome` and `ClaimMoveRosterPlaces` already refuse a home target without the designation.

The record, the claim and `BeginClaimMove` keep receiving the code `to` (`""`); only display arguments change. The legacy door (switch off) is not touched. Its em-dash refusal stays until Plan 6 Task 8 retires it.

**Tests (`apiinstancemove_home_test.go`, using the claim test fixture of `apiinstancemove_claim_test.go`):**
- `TestMoveDoorClaimModeAcceptsHomeTarget`: `--to ie` on a console whose home is `ie`, a roster with the designation, a placementless home box with a data bucket: 202. The claim is `moving` with `intent.to = @home` and `intent.home_region = ie`; the record's `Move.To` is `""`; the view's `target` is `ie`.
- `TestMoveDoorPlainPathRefusesHomeTarget`: switch on, no host claims: 400 with MV-N510; the claim and the record are byte-identical before and after.
- `TestMoveDoorHomeStagingFromItsEdgesFile`: home box without `data_bucket`: MV-N20 naming `ie`, with a list that names no empty code; with it: passes.
- `TestCreatePlacementsUnchangedByHomeFold`: `placements()` over a fleet with a placementless box returns the same map and `published` as before this task (Review Focus 4).
- `TestMoveDoorHomeTargetMustPublishNoPlacement`: the only `ie` box publishes `placement: ie` and a data bucket: 409 with MV-N511 naming it, not MV-N20; no claim read, no registration. A second case with both a placementless home box and a home-named box: MV-N511 again.
- `TestMoveDoorHomeTargetNeedsTheDesignation`: the roster has no `home_region`: MV-N177 reading "... active boxes in ca and ie"; nothing registered.
- `TestMoveDoorManifestNamesHome`: `regions: ["ie","uk"]` allows `--to ie`; `regions: ["uk"]` refuses with MV-N2 naming `ie`.
- `TestMoveDoorHomeRefusalsNameTheHome`, one case per sentence, each driven to its refusal with a home target: MV-N2, MV-N5 (a home box below the floor: "a box in ca or ie is below the moves protocol floor..."), MV-N16, MV-N20, MV-N23, MV-N30 (a pending chore under `@home` or `ie` makes `BeginAdmittedMove` return `ErrPendingChore`: "the instance has unfinished cleanup in ie..."), MV-N177. Each asserts the exact approved template with `ie` filled, and that no sentence contains `" in  "`, `" or  "` or `" and "` followed by the end of the string.
- `TestLegacyMoveDoorStillRefusesHome`: switch off: the legacy sentence, byte for byte.
- The lint (`TestPlan13NoDirectPlacementEngineComparison`) stays green.

**Copy:** MV-N510 and MV-N511 pending. MV-N21 is withdrawn: its row is removed from the record with a note, as MV-N388's was, and from `movesCopyIDs`, in this commit. MV-N2, MV-N5, MV-N20, MV-N23, MV-N30 and MV-N177 keep their approved text; only their fills change (MV-N16 already names the home).

- [ ] Write the failing tests; implement; targeted runs plus the copy gate; commit: `git commit -m "console: the move door admits a home target under host claims (home part 2)"`.

---

### Task 6: Rehearsal runbook and index

**Files:** modify `docs/superpowers/plans/2026-10-06-moves-phase1-rehearsal.md`, `docs/superpowers/plans/2026-10-06-moves-phase1-0-index.md`.

- [ ] **P-0, the home item.** Part 2 merged and rolled (boxes, then consoles) is required for any run that moves into home. The rest of the item is unchanged: part 1, Plan 13, and Plan 13's order (readers, then the designation, then the flag). Replace the quoted MV-N21 sentence with "the door refuses moves into home without host claims (MV-N510)".
- [ ] **P-0, new: one placementless box.** For each deployment, list `control/edges/` and record that exactly one edges file has no `placement`. S1 and T8 refuse a move into **or out of** home while two do, whether or not the second box is running (an edges file outlives its box), and a retained file below the floor makes the door refuse with MV-N5. On dev, `carlos-dev-ie-b` makes two; Ruling R2's five-step procedure (stop, delete the edges file, wait out the 15-minute status window, verify complete evidence before each run, restart after) applies to every dev run that touches home, Run 1 included. Copy the procedure into the runbook verbatim.
- [ ] **P-2.** Every named region's `sibling_staging_arns` lists the home data bucket's ARN, and the home's lists every named data bucket. Record the home data bucket's name and check it is not the deployment bucket.
- [ ] **Run 1b (new), dev, `uk` to `ie`, a commit into home.** Run 1's host, moved back after Run 1's quiet window (T12). Same checks as Run 1, with `<pr-ie> = home`. Additional checks: the lane is in the home data bucket under `moves/<host>/<move>/`; the claim's `touched.regions` holds at least one spelling of home: `ie`, `@home`, or both (Touch adds `@home` when the target box is new to `touched` and never removes `ie`), and every region it held before the request is still there; after the close, `parked/<inc>/<host>/` in the home bucket holds the residue of Run 1's stay, if any; `quiet_after` names `uk`. Blockers: Run 1 passed; part 2 rolled; the designation published on dev; P-0's one-placementless-box item. Note for the operator: where the console shares the home box, the landing runs on the console's own box (Ruling R7).
- [ ] **Runs 2 and 3.** Once part 2 is rolled, they run as written (`uk` to `ie`, into home). The out-of-home arrangement stays as the fallback while part 2 is not rolled.
- [ ] **Run 4.** Unchanged: `ie` to `uk`, with `carlos-dev-uk` stopped. It never stops the home box. Its blocker becomes "Runs 1, 1b, 2 and 3 passed". It does not need moves into home itself.
- [ ] **Run 6.** "Both parts merged and rolled" stays. The "dev rehearsal from home" blocker becomes "dev Runs 1 and 1b passed".
- [ ] **Sources table.** Replace the MV-N21 line (`apiinstancemove.go:537-540`) and the `moves-home-parks` "parts 1 and 2" line with this plan and its merge commit, and add `internal/host/movesreport.go:113` (`loadMoveFleet` counts every box per placement before the data-bucket check) as the source of the one-placementless-box item.
- [ ] **Index.** Add a row after Plan 7: "Home part 2: `2026-10-15-moves-home-region-part2.md`".
- [ ] Commit: `git commit -m "docs: rehearsal and index for moves into home (home part 2)"`.

---

### Task 7: Gate and review

- [ ] The full local gate once (Global Constraints), excluding the whole `internal/host` suite, which CI runs.
- [ ] Astra (codex, from a committed brief) reviews the built branch against Review Focus 1 to 6. Commit its findings unedited beside this plan as `CODEX-PLAN-MOVES-HOME-PART2-BUILD-R1.md`; fix and record dispositions here.
- [ ] Post the branch, the witnesses for A2, H1 and H3, and the rulings on #236.
- [ ] Re-merge `main`, wait for CI, then Paul's go to merge (`amadan branch merge -squash`).

## Copy rows (pending)

To append to `2026-10-06-moves-phase1-copy.md` under a new heading "Moves into home (part 2)", each in its task's commit:

| id | file | text | status |
|---|---|---|---|
| MV-N510 | internal/console/apiinstancemove.go | moves into the home region need host claims. this console runs without them | pending |
| MV-N511 | internal/console/apiinstancemove.go | <box> sets CARLOS_REGION, so it cannot take a move into the home region | pending |
| MV-N512 | internal/moves/envreport.go (a T3 kind inside MV-N129's list) | region-present | pending |

Withdrawn in Task 5: MV-N21 ("moves to the home region are not supported yet. the home publishes no staging lane"). Fills that change but keep their approved text: MV-N2, MV-N5, MV-N20, MV-N23, MV-N30 and MV-N177 name the home by its name instead of the empty code.

## Failure modes

| # | failure | effect | guard |
|---|---|---|---|
| F1 | a moves call site supplies the home's roster name where `@home` is meant | most exact checks refuse (fail closed); `requireRetiredRegion` would allow a location park in the live home region | Task 3's `TestHomeTargetFreshStateShowsOnlyTheHomeToken` (runtime, from clean state) and `TestMovesHomeRegionCallSiteInventory` (every site reviewed and witnessed); the park view's live-set rule; Ask A1 hardening |
| F2 | the staging lease keyed by the roster name | two writers on one lane | `stagingLeaseKey` takes record codes only; Task 3 asserts the key |
| F3 | a replay canonicalizes or duplicates a chore already owed under `ie` | a second park of the same work, or a rewritten obligation the regional runner no longer matches | Plan 13's alias-aware queue; Task 3's `TestHomeTargetRetainedChoresKeepTheirSpelling` |
| F4 | a box with `CARLOS_REGION=<home name>` | as a home target the move would stall in `preparing` (no target report; the source finds no `targets[""]`) | MV-N511 at the door, before the capability check (Task 5) |
| F5 | two placementless edges files (dev's `carlos-dev-ie-b`; any agent box without `CARLOS_REGION`, running or not) | the door accepts, then S1 or T8 refuses with M-C21 / MV-N166, for moves into **and** out of home; a retained file below the floor makes the door refuse with MV-N5; deleting the file while the box's status is still fresh makes the door refuse every move as incomplete evidence | Ruling R2's five-step procedure; runbook P-0 check |
| F6 | T3 `region-missing` on a home target | every move into home waits at `preparing` | Task 1 |
| F7 | a home box on a build without Task 1 | the same wait, with T3's reason in the target report; the operator aborts | roll boxes before consoles (Ruling R5) |
| F8 | no designation, or the console's home name differs from it | MV-N177 for every claim-mode move; a home box never arms (T13) | Plan 13's rollout order; nothing new |
| F9 | the IAM mesh lacks the home bucket | the source's lane round fails `AccessDenied`, logged; or T10 fails on the home box | runbook P-2 |
| F10 | the home box is also the console's box, and it dies mid-landing | the console's move pass stops with it; box-side recovery and the durable records wait for the console's return | Ruling R7 |
| F11 | the plain Phase 1 path writes `intent.to = ""` | `BeginMove` refuses with `ErrMalformed`, which the door would answer as a 502 | MV-N510 refuses first (Task 5) |
| F12 | a door sentence filled with the raw code | an operator reads "in  " or "in ca and " | Task 5's fills and `TestMoveDoorHomeRefusalsNameTheHome` |

## Rollout order

1. **Plan 13 on every box and console** (on main since 2026-10-12; check each box reads `current` with `carlos system status`). Plan 13's own order still binds: every roster reader on a Plan 13 build, then publish the designation, then turn `CARLOS_HOST_CLAIM` on.
2. **Part 2 merged** (dormant), released, and rolled **boxes first, then consoles**, so no door admits a home target before every home box has Task 1's T3 rule.
3. **IAM:** the M17 mesh including the home bucket (P-2), applied by Paul with a scoped `tofu apply -target`.
4. **Claim activation (#250)**, which publishes the signed designation. Until then a home box never arms and the door refuses claim-mode moves under a configured home name.
5. **`CARLOS_MOVES_PHASE1`** per run, as the runbook says.

Part 2 adds no switch of its own. A home target is reachable only when the designation exists, the console runs host claims, and the switch is on.

## Rehearsal changes

- Run 1 (`ie` to `uk`) is unchanged, but **today it is blocked on dev by `carlos-dev-ie-b`'s edges file** (Ruling R2). That blocker is independent of part 2.
- Run 1b (new): `uk` to `ie`, a commit into home, Run 1's host moved back.
- Runs 2 and 3 return to as written (into home) once part 2 is rolled.
- Run 4 is unchanged and does not move into home. It gates on Runs 1, 1b, 2 and 3. Stopping the home box for a declare-lost would stop dev's console, which is why Run 4 stays out of home (Ruling R6).
- Run 5 (flagship) may keep `uk` and `us`. Adding a home leg is optional and is Paul's call when Run 5 is scheduled.
- Run 6's blockers are met by part 2 merged and rolled plus dev Runs 1 and 1b.

## Rulings needed

Only Paul can decide these. Each has a recommendation.

- **R1. Home targets only under host claims.** The plain Phase 1 path (switch on, claims off) keeps refusing a home target (MV-N510), because it has no designation to resolve home against and its `BeginMove` would write `to = ""`. *Recommend: yes.* Phase 1 cannot land anything in production without claims anyway (its parks arm only with both flags).
- **R2. Dev's second home box blocks every dev run that touches home, today, independent of part 2.** `loadMoveFleet` (`internal/host/movesreport.go:113`) adds every edges file's box to `boxes[placement]` before it checks for a data bucket, and with no liveness check. S1's `oneBoxRefusal` counts `boxes[From]` and `boxes[To]`, and T8 counts `boxes[To]`. `carlos-dev-ie-b` publishes no placement, so `boxes[""]` holds two boxes and Run 1 (`ie` to `uk`) is refused at S1 with "the home region has more than one box" before any copy. The door, which counts eligible boxes (D15), accepts it first. Options:
  - **(a) Take `carlos-dev-ie-b` out for each rehearsal window.** Stopping its agent alone is **not enough**, and neither is deleting its edges file alone. Two readers see the box, by different rules:
    - the box side (`loadMoveFleet`, so S1 and T8) counts every edges file, fresh or not, so a retained `control/edges/carlos-dev-ie-b.json` keeps `boxes[""]` at two;
    - the console's door reads the live snapshot (`ReadLiveSnapshot`, `internal/edgesfile/snapshot.go:168`): a **fresh** status snapshot whose box has no edges file makes the evidence incomplete, and `selectMoveBoxes` (`internal/console/boxselect.go:75`) then refuses every move with "the fleet's edges files could not all be read". A status snapshot is fresh until it is more than 15 minutes old (`status.BoxStale`: 3 × the 5-minute `SnapshotPeriod`).

    A retained edges file also reaches the door's protocol-floor check: `selectMoveBoxes` counts every file of either region, fresh or not, so a stale `carlos-dev-ie-b` file below the floor, or without the armed floor's `moves_floor_min_release`, refuses every move into or out of home with MV-N5. The procedure, with Paul's go for the window:
    1. stop `carlos-dev-ie-b` (the instance, or at least its agent and console units, so it neither writes status nor serves);
    2. delete `control/edges/carlos-dev-ie-b.json` from the deployment bucket;
    3. wait until its last `status/boxes/carlos-dev-ie-b.json` is more than 15 minutes old by its `generated_at`;
    4. before **each** run, verify the fleet's evidence is complete: every box with a status snapshot fresher than 15 minutes has an edges file, every edges file's box has a status snapshot, and exactly one edges file has no `placement`. The door's own confirmation is the run's **S-2**, the move request itself. Only a move request runs `selectMoveBoxes` and the floor check: `carlos move status` (`handleAPIInstanceMoveStatus`) reads the record and claim only, and S-1 only wakes the app, so neither confirms anything here. If S-2 answers "the fleet's edges files could not all be read" or MV-N5, the window is not ready. Both refusals come before any claim read or write, so nothing was started: fix the evidence and repeat S-2;
    5. after the window, start the box again. Its edges pass rewrites the file on boot. No move touching home runs until the window is reopened by steps 1 to 4.

    It also takes #286's two-home-box hazard out of the window, since rehearsal apps then wake on one box only. Cost: an operator procedure with a 15-minute wait per window, and dev loses its second home box while it lasts.
  - **(b) Make S1 and T8 count only eligible boxes**, as the door does. That is a box-side rule change: the box would need the roster, the box identity records and `boxchoice.Eligible`'s inputs, and it would loosen the check that stops a second placementless box from reconciling an unregioned record that has just landed in home (#286). It needs its own task, its own review, and a decision on what "eligible" means to a box that cannot read the console's secrets fingerprint.
  - **(c) Give `carlos-dev-ie-b` a placement of its own** (for example `CARLOS_REGION=ie-b`). That ends the collision for good, but it changes which records the box reconciles: it stops taking unregioned records, so any host woken on it moves back to `carlos-dev-ie`. That is a dev topology change with its own risk, and region HA's two-box testing in dev's home region would need another arrangement.
  - **(d) Retire `carlos-dev-ie-b`** if region HA's dev testing no longer needs it. Cleanest if true; only Paul and region HA know.
  *Recommend (a) for the rehearsal windows, now,* because it unblocks Run 1 without a code change and keeps the box rule that protects against #286. Ask region HA whether (d) is possible; if it is, prefer it over repeating (a). Do not take (b) as part of this plan: if Paul wants it, it is a separate moves task with its own review.
- **R3. `--to` vocabulary and `carlos move back`.** The door accepts the home's configured name only, as every other surface prints it; there is no `home` keyword, because a named region may be called `home` (Plan 13). `carlos move back` stays a follow-on, as spec §16 F2 lists it. *Recommend: yes to both.*
- **R4. Copy.** Approve MV-N510 to MV-N512 and the withdrawal of MV-N21 (copy review). *Recommend: review with the branch, before merge.*
- **R5. No protocol floor bump.** Task 1 changes the box's T3. A home box without it fails T3 and waits (fail closed), and the operator aborts. Bumping `moves.ProtocolVersion` to 2 would make the door refuse up front, but it would also refuse every move, to any region, until every box of both regions rolls. *Recommend: no bump; roll boxes before consoles*, as the release recipe already says.
- **R6. Run 4 stays out of home** (`ie` to `uk`), and the runbook gains Run 1b. *Recommend: yes.*
- **R7. A home target on the console's own box.** Where the console shares the home box, a landing into home puts the console on the move's target. If that box dies mid-landing, the console's move pass dies with it until the box or the console is restored. The records and the claim are durable, so nothing is lost, but recovery waits. *Recommend: accept, and note it in the runbook's Run 1b.* The alternative is refusing a home target whose box runs the console, which no edges field states today.

## Asks

None blocks this plan. Each names the witness that answers it; please review the witness rather than answer in prose. Post them on #236.

**To platform-1e (the claim):**

- **A1. The exact-region contract, and one optional hardening.** Moves' contract: every region moves supplies to `Abort`, `Revert`, `Commit`, `TargetReleased`, `QueueStagingPark`, `QueueResidueParks`, `QueueReturnLanePark` and `Touch` is a placement-derived engine region (`park.PlacementRegion` of a record code, so `@home` for home), never a roster name; retained claim state keeps whatever spelling it has. Witnesses: `TestHomeTargetFreshStateShowsOnlyTheHomeToken` (runtime, from clean state), `TestMovesHomeRegionCallSiteInventory` (every call site, including `ReleaseFencedTarget` and `ReleaseLostTarget`, mapped to its runtime witness) and `TestHomeTargetRetainedChoresKeepTheirSpelling` (runtime, Task 3). Please confirm the claim keeps its exact `intent.to` comparisons on that basis. Optional hardening, recommended: compare `requireRetiredRegion` (`internal/hostclaim/move.go:549`) through `regionname.SameRegion` under `op.intent.home_region`, so a roster-name caller can never read the live home as "not the target" (Review Focus 1).
- **A2. The home regional runner.** Witnesses: `TestMoveIntoHomeAbortParksTheHomeLane`, `TestMoveIntoHomePreFlipRevert` and `TestHomeRegionalAcknowledgesBothSpellings` (Task 4) run the real `hostbox.Regional` on a home box against `@home` and `ie` lane and residue chores. Please review them.
- **A3. No further claim gate.** Witness: `TestMoveDoorClaimModeAcceptsHomeTarget` (Task 5) and `TestMoveIntoHomeCommitsAndCloses` (Task 3) drive a `moving` op with `intent.to = @home` from the start CAS to the close. Please confirm nothing else in the claim should refuse it.

**To region HA (relocation):**

- **H1. The committed-landing conversion into home.** Witness: `TestCommittedLandingIntoHomeConvertsOnTargetFence` (Task 4): `intent.region` is the roster name, `move_to_region` is `@home`, and the lane parks and the source's finalization chores are kept in their spelling. Please review it. No code change is expected.
- **H2. The two-box model.** Moves into home stay one-box (D15, T8 and Ruling R2), so the two-box `internal/sim/hostlife` model needs no new scenario. Confirm, or name the scenario. Separately, for Ruling R2: does region HA still need `carlos-dev-ie-b` in dev's home region (option d)?
- **H3. C8 on a home landing.** Witnesses: `TestMoveIntoHomeCommitsAndCloses` and `TestMoveIntoHomeRestartedProbe` (Task 3) establish the prepared files manifest under `data-home`'s `<location>/files/g-<op>/` through the production provider on a placementless home box, and `TestMoveIntoHomeDirtyReturn` (Task 4) establishes the source's files from the return. Please review them against relocation's env-by-row lookup and prepared-authority reader.

## Self-review

- Every gap named in the brief has a task or a ruling: the lane (Q1, Task 5 fold, P-2), the ARNs (P-2), T1 to T13 (Tasks 1 and 3), the landing (Task 3), revert, rollback and return (Task 4), parks after the commit (Tasks 3 and 4), the alias in Touch, Commit and Release (Task 3's two pins), `--to` (R3).
- Nothing changes claim or region HA code. Anything a test finds there becomes an ask.
- Every witness on a path where `ie` meets `@home` runs through the production owners.
- Supplied arguments are proved at runtime from clean state, and the call sites are pinned by an inventory that claims no provenance; retained state is proved at runtime from seeded state. No assertion requires exactly one spelling of home in claim state, and no heuristic classifier is used as proof.
- Copy rows are pending, have no em dashes, and are in the commit that writes them.

## Review round 1 (Astra, on be29ccd0): dispositions (rev 2)

Verdict NOT READY, four P2. Astra confirmed the diagnosis (T3 `region-missing`, the door and capability gaps, the one-box finding at `loadMoveFleet:113`) and that no claim or region HA production change is needed; it supported R1, R3, R5 and R6, called R2(a) and R7 reasonable, and asked for executable witnesses behind A2, H1 and H3.

| # | finding | rev 2 |
|---|---|---|
| 1 | P2 the witnesses demanded canonical `@home` where Plan 13 keeps existing spellings (`sourceRound:323` skips Touch when `touched` holds `ie`; an `@home` replay keeps an owed `ie` chore, `plan13_followups_test.go:28`) | Global Constraints and Review Focus 1 split supplied arguments (`@home`) from retained state (either spelling). Task 3's Touch test covers empty, `ie` held, and `ie` without the box; `TestHomeTargetSuppliedRegionsAreTheHomeToken` asserts arguments only; new `TestHomeTargetRetainedChoresKeepTheirSpelling` seeds both spellings and asserts no duplicate and no rewrite. Run 1b's check accepts either spelling. |
| 2 | P2 the close harness's fake probe (`movesparks_test.go:38`, `movesland_probe_test.go:73`) bypasses the production owners, admission evidence and files publication | New Task 2 is fixture work only, with the full file list, and adds a production-probe mode over the claim runtime. Tasks 3 and 4 run every witness through `movesProbeOwners`, `movesRecoveryOwners` and the C8 provider, add `TestMoveIntoHomeRestartedProbe` and `TestMoveIntoHomePreFlipRevert`, and the dirty return establishes files through C8. Review Focus 3 is new. |
| 3 | P2 more empty home names in the door: MV-N5 (`:633`), MV-N177 (`:786`), MV-N30 (`:752` via `:831`) | Task 5 steps 7 and 8 pass `homeRegionOut` for every display argument, keep the approved templates and rename `moveClaimCASFailed`'s parameter `toName`; `TestMoveDoorHomeRefusalsNameTheHome` drives each of the six sentences, and MV-N16, to its refusal. |
| 4 | P2 MV-N511's test could not reach its refusal: the home fold takes placementless files only, so MV-N20 fires first at `:599` | The placement-mismatch check moves ahead of the capability check (Task 5 step 4), from `movePlacements`' new `homeNamed` list. Chosen because MV-N20 would tell the operator the region publishes no staging bucket, which is false and hides the real misconfiguration. The post-selection `TargetPlacement` check is dropped as redundant. The test now covers the home-named-only case and the mixed case. |
| also | the one-box finding as a rehearsal blocker independent of part 2 | Ruling R2 rewritten: options (a) to (d), with the correction that stopping the agent alone does not clear the count because the edges file outlives the box; recommendation (a) now, ask region HA about (d), (b) only as its own task. |
| also | A2, H1, H3 need executable witnesses | Every ask now names its witness tests; A2 gains `TestHomeRegionalAcknowledgesBothSpellings`. |

## Review round 2 (Astra, on c139b80b): dispositions (rev 3)

Verdict NOT READY: round 1's #3 and #4 addressed, #1 and #2 partial, two new P2s. All four fixed in rev 3.

| # | finding | rev 3 |
|---|---|---|
| 1 | P2 (round 1 #1, partial) Run 1b required exactly one home spelling, while Task 3 lets Touch leave both `ie` and `@home` | Run 1b accepts `ie`, `@home` or both, and asserts every region held before the request is still held. Task 3's Touch test states that both spellings after a union is correct, asserts preservation and that `@home` is the only region Touch adds, and never asserts a single spelling. Self-review records the rule. |
| 2 | P2 (round 1 #1, partial) the argument-recording test had no interception point: `hostclaim.Update` (`store.go:63`) takes an opaque closure, and alias-aware replay hides the spelling | Replaced by the static `TestMovesHomeRegionArgumentsAreDerived` over every production call site of the transition factories and `moves.StagingLeasePrefix` in `internal/host`, `internal/hostops` and `internal/console`, with allowed argument forms, a named allowlist, and failing and passing fixtures. Static was chosen over a moves-side injection point because an injection point would add production indirection on the claim's authority path to serve a test, while the static check adds nothing to production, covers call sites no test reaches and catches new ones. Its derivation-only limit is covered by the runtime pins listed with it. Global Constraints, F1 and A1 updated. |
| 3 | P2 (new) the clean-rollback assertion `holder.generation = src_gen` conflicted with production recovery, which restores from `src_gen` and admits a fresh generation (`movesrecoveryowners.go:300`; `movesrecoveryowners_test.go:465` expects `fresh1`) | `TestMoveIntoHomeCleanRollback` asserts in two stages: `src_gen` after the clean return and as the restore baseline; after the admission, the fresh generation, `clean-return` coverage, no writes lost, predecessor `src_gen` in `ca`. |
| 4 | P2 (new) R2(a) was incomplete: deleting the edges file while the box's status snapshot is fresh makes `ReadLiveSnapshot` (`snapshot.go:168`) incomplete and `selectMoveBoxes` refuses; a retained file still affects S1, T8 and the floor check | R2(a) is now five steps: stop the box, delete its edges file, wait until its status snapshot is more than 15 minutes old (`status.BoxStale`, 3 × 5 minutes), verify complete fleet evidence and one placementless file before each run, restart after the window. The ruling explains both readers and the MV-N5 effect of a retained file. Task 6's P-0 item, F5 and the runbook copy carry the same procedure. |

## Review round 3 (Astra, on bdbfe3fd): dispositions (rev 4)

Verdict NOT READY: the spelling, interception and generation items addressed; four P2s left. All four fixed in rev 4. On the static check, rev 4 takes the narrower option the coordinator offered rather than attempting provenance.

| # | finding | rev 4 |
|---|---|---|
| 1 | P2 the clean-return predecessor: `AdmitWriter` takes the predecessor and its region from the last admission, the failed home target's (`hostclaim/generation.go:117`; `movesrecoveryowners_test.go:446`), not `src_gen` in `ca` | `TestMoveIntoHomeCleanRollback` keeps the baseline (`src_gen`) and fresh-generation assertions and now asserts `Predecessor` and `PredecessorRegion` are the target's last admitted generation and its region in its recorded spelling (`ie` in the fixture). Round 2's row 3 is superseded on this point. |
| 2 | P2 the static check missed `ReleaseFencedTarget` and `ReleaseLostTarget`, whose regions arrive through `FencedTargetRelease` (`move_fence_release.go:130`) and `LostTargetRelease` (`move_loss_owner.go:732`) and are compared exactly with `intent.to` | Both factories, both composite literals' `TargetRegion` and `SourceRegion` fields, and the helpers that build them (`moveLossRelease`, `claimLossIntent`, `recordLossIntent`) are in the inventory. `LostTargetRelease.TargetRegion` is a named exception for retained, signed intent, with `TestMoveIntoHomeDeclareLost` as its witness. New `TestMoveIntoHomeFencedTargetRelease` witnesses the fenced path. A changed `FencedTargetRelease` literal is a failing fixture. |
| 3 | P2 `plan13Placement` cannot prove provenance: `to := c.Op.Intent["home_region"]; park.PlacementRegion(to)` passed while supplying `ie` | The static provenance check is withdrawn. Sound provenance needs dataflow across functions, parameters, signed-intent fields and closures; a heuristic gives false assurance. Replaced by `TestHomeTargetFreshStateShowsOnlyTheHomeToken`, a runtime proof from clean claim state, where every harmful wrong spelling is observable (a new obligation, a `touched` entry, a lease key, or an exact refusal), plus `TestMovesHomeRegionCallSiteInventory`, a golden inventory of every site with its runtime witness that classifies nothing by shape. The reviewer's counterexample is a failing fixture (unknown site, or changed expression at a known one). No heuristic classifier is used anywhere as proof. |
| 4 | P2 R2(a)'s confirmation: move status (`apiinstancemove.go:325`) runs neither selection nor the floor check, and S-1 only wakes the app | Step 4 keeps the evidence checks and names S-2, the move request, as the door's confirmation; both of its possible refusals precede any claim read or write, so a failed confirmation starts nothing. |

## Review round 4 (Astra, on 9c2fbf01): dispositions (rev 4.1)

Verdict READY: all four round-3 items addressed, and the runtime-witness trade judged sound. One P3, fixed.

| # | finding | rev 4.1 |
|---|---|---|
| 1 | P3 `QueueStagingPark` was listed among the transitions that compare their region exactly with `intent.to`; it does not (`move.go:598` validates the scope and calls the alias-aware `queueReplicaPark`) | Removed from the exact-comparison lists in Review Focus 1 and in `TestHomeTargetFreshStateShowsOnlyTheHomeToken`'s description. Both now say a fresh `ie` there queues a new lane chore named `ie`, which the chore-region assertion catches. |