[CMGS]

Follow-ups from the reviewer's v0.1.31 whole-range round on 02ec252..93fc22b (ledger in the round notes). No P1 was found.

Changes

1. Upgrading from v0.1.31 (P2, docs). deploy.md gets a "From v0.1.31" note:

   • a config with a balloon block fails to load, so remove it on every node before the roll;
   • claims v0.1.30 inflated stay inflated: running ones deflate when the block is removed by a v0.1.30 reload, not a restart; hibernated ones need POST /v1/sandboxes/{id}/balloon with the boot target after the wake;
   • that POST now needs a target body, and an empty one answers 400 where v0.1.30 answered 202.

   No balloon logic comes back into sandboxd.

2. A downtime abort leaves no failover gap (P3, pool: a live move aborts a paused final round that overruns max_downtime_ms, and reports its phases #553 × pool: a restart keeps each claim's replica interval from its last round, and first rounds spread over an interval #551). A move aborted after unrowForMove consumed the claim's row marks the claim ReplicaDue. The next replica sweep makes it due at once and puts the row back. Before, the old anchor in m.replicas left the claim without failover for up to one interval.

3. New claims replicate as in v0.1.30 (P3, pool: a restart keeps each claim's replica interval from its last round, and first rounds spread over an interval #551). A never-replicated claim claimed within the last interval anchors its first round on ClaimedAt, one interval after the claim. Only claims older than that and without replica_at get the id offset; that is the restart case CMGS asked for.

4. settleReplicaIntent stamps replica_at when it promotes a landed pending round.

5. The balloon verb check caches only a pass. A failed or timed-out first cocoon vm balloon --help no longer refuses every later call until a restart.

6. Docs.

   • An adoption carries the round before the last.
   • The idle clock is kept across a clean restart and starts again after a crash.
   • A new warm VM retires an old one only once the warm set is back at target.
   • An aborted move is due at the next replica sweep.

Kept, per the reviewer:

• the LastSeen/SeenAtShutdown naming;
• BalloonRequest without a comment.

Cost.

• Claim path: unchanged.
• The replica sweep reads one more field per claim.
• POST /balloon reads an atomic once the check has passed, and checks again only after a failure.

Tests.

• TestANewClaimFirstReplicatesOneIntervalAfterItsClaim
• TestReplicaAdoptionCarriesTheRoundBeforeItsLast
• TestReplicaSettledLostPutReplyStampsItsRound
• TestSetBalloonChecksTheVerbAgainAfterAFailedCheck
• A move carrying replica_at in TestMoveOfAReplicatedClaimDropsItsRowBeforeTheFinalRound.
• TestMoveAbortedAfterDroppingTheRowPutsItBackOnTheNextRound now ends on a replicate sweep. Its old direct replicate call bypassed the due check, which is how it missed the gap.
• An outgoing-move row in TestSetBalloonRefusesWhatItCannotReach.
• The spread test now uses claims claimed two intervals ago.
• Mutants, all killed: no due mark on abort; no ClaimedAt anchor; no stamp on settle; the original sync.OnceValue.

/simplify (four lenses):

• Fixed:
  • balloonReady takes the request context;
  • the duplicate abort test is folded into the existing one;
  • a no-op waitFor is dropped.
• Skipped:
  • folding the settle-stamp check into the restart test: the restart path settles through the reconcile branch, which leaves replica_at as it was, so that test cannot see the stamp;
  • a cached negative for a cocoon without the verb: each POST there spawns one more check, the rate is set by the caller, and it is off the claim path.
• Altitude: a per-sandbox due flag is the right depth. It cannot be derived from the replica fields, because a move target sits in the same state while its carried interval runs.

Gates (fail-fast script):

• golangci-lint 0 issues. on darwin and linux; fmt clean; asl clean.
• go test -race ./... green on darwin; linux/arm64 green except the container-only utils test that also fails on main.
• No new comments.