amadan
Astra joint round 2 (J1 fix): unedited
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 file changed,
+45
−0
docs/superpowers/plans/CODEX-REVIEW-TWO-BOX-R2.md+45 −0
diff --git a/docs/superpowers/plans/CODEX-REVIEW-TWO-BOX-R2.md b/docs/superpowers/plans/CODEX-REVIEW-TWO-BOX-R2.md| new file mode 100644 |
| index 000000000..5c1ce1083 |
| --- /dev/null |
| +++ b/docs/superpowers/plans/CODEX-REVIEW-TWO-BOX-R2.md |
| @@ -0,0 +1,45 @@ |
| +**P2 — Source files lose protection before rollback is ruled out.** [regionha_test.go:2141](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-two-box-build/internal/sim/hostlife/regionha_test.go:2141) |
| + |
| +The `landing` branch stops protecting the source region when the target’s admission changes `holder.Gen`. Admission does not commit the move; a clean rollback remains possible. |
| + |
| +The reachable sequence is: |
| + |
| +1. Use the new stopped-move witness’s setup: a source restart queues a generation park, while the older generation holds the keyed manifest. |
| +2. Delay that park until the target probe is admitted, before commit. `filesHome` now returns false for the source, allowing the sibling to archive its manifest and referenced object. |
| +3. Roll back cleanly. [moves_test.go:1509](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-two-box-build/internal/sim/hostlife/moves_test.go:1509) restores the source generation. |
| +4. The unchanged-files publisher can skip republication at [regionha_test.go:2014](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-two-box-build/internal/sim/hostlife/regionha_test.go:2014). A subsequent source failure leaves failover without the keyed manifest. |
| + |
| +At `a2ef0203`, the region-blind chain lookup preserved that source manifest. This is a regression introduced by the regional restriction. It is established by static tracing, **not an executed reproduction**. |
| + |
| +**Fix:** preserve the source rollback files and their references until rollback is ruled out. Add a witness that delays the queued park until after target admission, rolls back cleanly, then requires source-region failover to succeed. |
| + |
| +The other answers to the brief: |
| + |
| +- **Original late-PUT defect:** the region-qualified lookup addresses it, and the revised witness covers both the manifest and object. |
| +- **Phase table:** “no home” for creating, deleting, parking and purging agrees with §5.1. Keeping the source region throughout relocation agrees with claim §6.2a’s unchanged-region rule, including pinning without an executor. The landing condition follows the table’s current-generation authority, but that alone does not preserve the files needed for rollback. |
| +- **Optional invariant:** add independent preservation coverage, including rollback files. Keep the existing INV-3 scenarios as separate liveness evidence; their expected failure strings should not prevent a safety check. An invariant derived from the same `filesHome` predicate would miss this defect. |
| +- **J2/J3:** unchanged by this fix. |
| + |
| +`git diff --check` and package formatting passed. Go tests could not run because the sandbox refused creation of the build directory. The supplied sweep results and identity hashes remain independently unverified. |
| + |
| +--- |
| + |
| +**FIRST PROMPT:** |
| +Review the J1 fix at dfab457c against the R2 brief and stage A fe144bab. |
| + |
| +**WHAT:** |
| +Check J1 closure, phase semantics and regressions. |
| + |
| +**STATUS:** |
| +Review complete; one P2 rollback-preservation finding. |
| + |
| +**NEEDED:** |
| +Nothing from you. |
| + |
| +**RECOMMENDED:** |
| +Preserve rollback files and add the post-admission rollback witness. |
| + |
| +**SESSION:** |
| +Safe to close. No files changed or processes left running; the read-only workspace prevented saving a handoff file. |
| + |
| +**Verdict: J1 is not closed.** |
| \ No newline at end of file |