amadan
db-region-forward plans: Astra's round 2 findings, unedited
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 file changed,
+72
−0
docs/superpowers/specs/CODEX-FINDINGS-DB-REGION-FORWARD-PLANS-R2.md+72 −0
diff --git a/docs/superpowers/specs/CODEX-FINDINGS-DB-REGION-FORWARD-PLANS-R2.md b/docs/superpowers/specs/CODEX-FINDINGS-DB-REGION-FORWARD-PLANS-R2.md| new file mode 100644 |
| index 000000000..390762a0d |
| --- /dev/null |
| +++ b/docs/superpowers/specs/CODEX-FINDINGS-DB-REGION-FORWARD-PLANS-R2.md |
| @@ -0,0 +1,72 @@ |
| +| Round-1 # | Disposition at `3bdd1b14` | |
| +|---|---| |
| +| 1 | Fixed: readiness observes interfaces through `/proc`, and observation errors fail the probe. | |
| +| 2 | Original collisions fixed. A new declaration collision remains; see **25**. | |
| +| 3 | Fixed: the parent scans for the `DBREAD-REPORT` line. | |
| +| 4 | Incomplete: the removal path is corrected, but the runtime mask cannot override that path; see **27**. | |
| +| 5 | Fixed: fingerprints use the census row’s seven fields. | |
| +| 6 | Fixed: fixture replacements use the existing etag. | |
| +| 7 | Fixed: admission tests follow the streaming implementation. | |
| +| 8 | Fixed: installed-unit pull acceptance follows agent support. | |
| +| 9 | Fixed: sequence advances only after confirmed publication. | |
| +| 10 | Fixed: retry preserves the previous reservation and waits for worker shutdown. | |
| +| 11 | Incomplete beyond the accepted audit-insert exception: publication boundaries and the serial mutation test still have gaps; see **28, 33**. | |
| +| 12 | Blocking calls and phase bounds addressed. The claimed impossibility of testing the final bound check is incorrect; see **35**. | |
| +| 13 | Fixed: body reading receives the pre-header deadline and a stalled-body test. | |
| +| 14 | Fixed: draining is checked before admission and after jitter. | |
| +| 15 | Incomplete: failures enqueue probes, but the loop can discard them without probing; see **29**. | |
| +| 16 | Fixed: the second read is submitted after the first worker starts. | |
| +| 17 | Fixed: the witness checks interfaces and uses a real ATTACH target. | |
| +| 18 | Addressed: both admission counts, release before/after pickup, and fresh-server counts are covered. | |
| +| 19 | Addressed: publication is gated until the request ends, with late-write assertions. | |
| +| 20 | Ordering mutation addressed; the independent completeness mutation remains unwitnessed; see **31**. | |
| +| 21 | Telemetry is added, then deleted by Plan 3’s replacement block; see **26**. | |
| +| 22 | Manifest validation addressed. It invalidates the hash-test fixture; see **32**. | |
| +| 23 | Fixed: cleanup tests exercise `dbPull`, including binary SIGINT. | |
| +| 24 | Original clamp, malformed-manifest and worker-`run` cases addressed. A separate hash mutation gap remains; see **32**. | |
| + |
| +25. **P0 — Plan 2, Task 7: `dbStream` collides with an existing function.** |
| + [Plan 2:2243](/home/paulca/amadan.net/carlos/platform-db-region-forward/docs/superpowers/plans/2026-10-22-db-region-forward-plan-2-query.md:2243) declares `type dbStream`, but package `console` already contains [`func dbStream`](/home/paulca/amadan.net/carlos/platform-db-region-forward/internal/console/apidb.go:475). Types and functions share the package namespace, so Task 7 cannot build. **Fix:** rename the new relay type, its constructors and `dbfCall` references consistently, including its census identity. |
| + |
| +26. **P0 — Plan 3, Task 5: the replacement leaves an unused variable and removes required telemetry. Reopens round-1 #21.** |
| + [Plan 3:713](/home/paulca/amadan.net/carlos/platform-db-region-forward/docs/superpowers/plans/2026-10-22-db-region-forward-plan-3-pull.md:713) replaces the block containing both timing logs. It leaves `attemptStart`, declared at [Plan 1:4972](/home/paulca/amadan.net/carlos/platform-db-region-forward/docs/superpowers/plans/2026-10-22-db-region-forward-plan-1-box.md:4972), without its sole use at line 5067. This fails compilation and removes the measurements Plan 3 relies on. **Fix:** retain both timing logs in the replacement, adapting the planning message for pulls that hold files without restoring them. |
| + |
| +27. **P0 — Plan 1, Task 15: the readiness mask test still cannot establish its premise. Reopens round-1 #4.** |
| + [Plan 1:7142](/home/paulca/amadan.net/carlos/platform-db-region-forward/docs/superpowers/plans/2026-10-22-db-region-forward-plan-1-box.md:7142) restores `/etc/systemd/system/carlos-dbread@.service`, then line 7149 masks it with `--runtime`. That creates the mask under `/run/systemd/system`, below `/etc/systemd/system` in systemd’s load precedence. The restored service remains effective. The installation location agrees with [`ensureSystemUnits`](/home/paulca/amadan.net/carlos/platform-db-region-forward/internal/host/systemunits.go:67). **Fix:** temporarily replace the effective `/etc` unit with a `/dev/null` symlink, reload, assert that it is masked, and explicitly remove the symlink before restoring the saved unit. |
| + |
| +28. **P1 — Plan 2, Task 6: admission can still publish after cancellation. Reopens round-1 #11, without reopening the declined SQL-layer change.** |
| + [Plan 2:1443](/home/paulca/amadan.net/carlos/platform-db-region-forward/docs/superpowers/plans/2026-10-22-db-region-forward-plan-2-query.md:1443) checks cancellation before the audit insert, then creates both objects without another check until after the queue create. Cancellation during the insert or after request creation therefore permits subsequent publication: the existing [`DirStore.Put`](/home/paulca/amadan.net/carlos/platform-db-region-forward/internal/release/store.go:414) explicitly ignores its context. This contradicts J1 and the claim that cancellation during the insert leaves only an audit row. **Fix:** check cancellation after the insert and before each subsequent publication, with the appropriate cancel-only exit once publication may have occurred. Test cancellation at those boundaries using the existing store. |
| + |
| +29. **P2 — Plan 1, Tasks 11–12: a requested readiness probe can be lost. Reopens round-1 #15.** |
| + [Plan 1:5528](/home/paulca/amadan.net/carlos/platform-db-region-forward/docs/superpowers/plans/2026-10-22-db-region-forward-plan-1-box.md:5528) consumes `probeAfter` once. `Probe` then returns immediately when admission is blocked. After the failed connection closes, its unit may still be deactivating; [the orphan check](/home/paulca/amadan.net/carlos/platform-db-region-forward/docs/superpowers/plans/2026-10-22-db-region-forward-plan-1-box.md:3275) correctly blocks the probe, but nothing retains the request. Capability can remain advertised until the five-minute timer. The new test only checks the channel length. **Fix:** retain a pending probe until admission permits it, and test the real loop with a failed worker whose unit lingers after connection closure. |
| + |
| +30. **P2 — Plan 2, Tasks 6–7: accelerated pickup tests depend on the wall clock’s fractional second.** |
| + Admission [truncates `issued` to seconds](/home/paulca/amadan.net/carlos/platform-db-region-forward/docs/superpowers/plans/2026-10-22-db-region-forward-plan-2-query.md:1425), and streaming derives the pickup deadline from that timestamp. [Task 7:1598](/home/paulca/amadan.net/carlos/platform-db-region-forward/docs/superpowers/plans/2026-10-22-db-region-forward-plan-2-query.md:1598) sets a 400 ms window while requiring three wait lines. For admissions more than 400 ms into a second, the deadline has already passed. The following one-second/five-line flushing test has the same problem. **Fix:** use a controlled clock or budgets covering timestamp quantization plus the required observation interval. Preserve production timestamp semantics. |
| + |
| +31. **P2 — Plan 2, Tasks 7 and 14: T18 still does not witness the completeness guard. Reopens round-1 #20.** |
| + In [Plan 2:2022](/home/paulca/amadan.net/carlos/platform-db-region-forward/docs/superpowers/plans/2026-10-22-db-region-forward-plan-2-query.md:2022), the first result read sees nothing; the first listing takes its snapshot and then publishes both result and chunk 2. The next round sees both. Consequently, removing `next > res.LastSeq` still returns the result after both chunks. Reversing the two writes inside the hook does not expose an intermediate state to the console. **Fix:** make one listing omit chunk 2 *after* a result read has returned `last_seq: 2`; release the chunk on a later round and assert that no result was emitted meanwhile. |
| + |
| +32. **P2 — Plan 3, Tasks 9–10: the hash-mismatch test fails before reaching the hash check.** |
| + [Plan 3:1565](/home/paulca/amadan.net/carlos/platform-db-region-forward/docs/superpowers/plans/2026-10-22-db-region-forward-plan-3-pull.md:1565) supplies a 13-byte “LTX file.” The new [manifest minimum-size check](/home/paulca/amadan.net/carlos/platform-db-region-forward/docs/superpowers/plans/2026-10-22-db-region-forward-plan-3-pull.md:1352) rejects it immediately. Removing the hash comparison therefore leaves the test green, contrary to Task 10’s mutation table. Simply padding the fixture would also leave later LTX validation as an independent rejection. **Fix:** use valid, restorable LTX bytes and a structurally valid manifest, changing only the summary digest. |
| + |
| +33. **P2 — Plan 2, Tasks 6 and 14: the serial-context mutation never executes the changed call. Reopens round-1 #11’s validation.** |
| + [Plan 2:1144](/home/paulca/amadan.net/carlos/platform-db-region-forward/docs/superpowers/plans/2026-10-22-db-region-forward-plan-2-query.md:1144) cancels during queue creation. The subsequent context check returns before `announceDBRead`, so replacing that call with detached `s.bumpSerial` cannot change the test outcome. **Fix:** add a separate cancellation during the serial read, after the admission check, using a cancellation-aware store wrapper. Assert that the subsequent serial write is refused with `announceDBRead` and succeeds under the detached-call mutation. |
| + |
| +34. **P2 — Plan 2, Tasks 10–11: no task supplies T7’s required real CLI/console backhaul acceptance path.** |
| + [Task 11:3599](/home/paulca/amadan.net/carlos/platform-db-region-forward/docs/superpowers/plans/2026-10-22-db-region-forward-plan-2-query.md:3599) substitutes a handler that independently writes and flushes fabricated lines, and uses an HTTP client rather than the CLI. Task 10 exercises the real console locally, but does not close that integration gap. [Spec T7](/home/paulca/amadan.net/carlos/platform-db-region-forward/docs/superpowers/specs/2026-10-22-db-region-forward-design.md:983) explicitly requires the real CLI and console through both paths. **Fix:** put the combined acceptance test in the root or an external test package with a reusable backhaul harness. Observe progress from the actual CLI process through both edges. |
| + |
| +35. **P2 — Plan 2, Tasks 7 and 14: the final owner-deadline check has a feasible witness.** |
| + [Task 14:4333](/home/paulca/amadan.net/carlos/platform-db-region-forward/docs/superpowers/plans/2026-10-22-db-region-forward-plan-2-query.md:4333) says no in-process client can force a line write past the deadline. A controlled `ResponseWriter` can hold the final chunk write until the owner deadline passes, then complete within the allowed write slack. That reaches the [otherwise untested check](/home/paulca/amadan.net/carlos/platform-db-region-forward/docs/superpowers/plans/2026-10-22-db-region-forward-plan-2-query.md:2421). **Fix:** add this labelled unit test and require removing only the check to change an ended response into an incorrectly relayed result. The stated reason for accepting no witness is false. |
| + |
| +36. **P2 — Plan 2, Tasks 6 and 8: invalid UTF-8 SQL is rewritten before `Sign` can reject it.** |
| + [Plan 2:2776](/home/paulca/amadan.net/carlos/platform-db-region-forward/docs/superpowers/plans/2026-10-22-db-region-forward-plan-2-query.md:2776) marshals the SQL first. Go replaces invalid UTF-8 during JSON encoding; [`checkQuerySQL`](/home/paulca/amadan.net/carlos/platform-db-region-forward/db.go:517) does not validate it. The console therefore signs valid replacement text, defeating Plan 1’s explicit “exact bytes or refusal” requirement. Raw HTTP input has the analogous issue through [`decodeJSONBody`](/home/paulca/amadan.net/carlos/platform-db-region-forward/internal/console/authcli.go:1143). **Fix:** validate SQL before CLI serialization and reject malformed string encodings at the HTTP boundary. Add a binary-level invalid-byte test proving that no altered query is published. |
| + |
| +37. **P2 — Plan 2, Task 8; Plan 3, Task 7: the chunk limit does not bound buffer or spool growth.** |
| + [Plan 2:2831](/home/paulca/amadan.net/carlos/platform-db-region-forward/docs/superpowers/plans/2026-10-22-db-region-forward-plan-2-query.md:2831) and [Plan 3:1218](/home/paulca/amadan.net/carlos/platform-db-region-forward/docs/superpowers/plans/2026-10-22-db-region-forward-plan-3-pull.md:1218) increase the allowed total by `SealOverhead` for every received chunk, without bounding chunk count. Repeated overhead-sized chunks never consume the payload allowance; empty malformed chunks grow the slice or create spool files without consuming any byte allowance. Validation waits until the result. **Fix:** enforce independent ciphertext-byte and chunk-count limits derived from the supported payload, duration and flush cadence; reject malformed short chunks before storage. Test memory and file sinks with excessive tiny chunks. |
| + |
| +38. **P2 — Plan 2, Tasks 10 and 14: the named deadline-extension mutation need not fail.** |
| + [Task 10:3442](/home/paulca/amadan.net/carlos/platform-db-region-forward/docs/superpowers/plans/2026-10-22-db-region-forward-plan-2-query.md:3442) sends a complete JSON body and assumes the server’s two-second `ReadTimeout` remains active unless extended. In the checked Go implementation, request-body EOF starts the background reader, which [clears the read deadline](/usr/local/go/src/net/http/server.go:687); the EOF callback is installed at [server.go:2059](/usr/local/go/src/net/http/server.go:2059). Removing the handler’s deadline calls therefore does not necessarily interrupt this response, so Task 14’s required mutation remains green. **Fix:** add an explicit connection/deadline observation that proves the post-admission extension occurs, while retaining the real-path test for streaming and flushing. |
| + |
| +Plan 1: **REVISE**. Plan 2: **REVISE**. Plan 3: **REVISE**. |
| + |
| +**REVISE** |
| \ No newline at end of file |