amadan
Astra stage B plan round 3: unedited
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 file changed,
+81
−0
docs/superpowers/plans/CODEX-PLAN-REGION-HA-STAGE-B-R3.md+81 −0
diff --git a/docs/superpowers/plans/CODEX-PLAN-REGION-HA-STAGE-B-R3.md b/docs/superpowers/plans/CODEX-PLAN-REGION-HA-STAGE-B-R3.md| new file mode 100644 |
| index 000000000..ad2ab426b |
| --- /dev/null |
| +++ b/docs/superpowers/plans/CODEX-PLAN-REGION-HA-STAGE-B-R3.md |
| @@ -0,0 +1,81 @@ |
| +Reviewed plan rev 3 at `b897dbb7`. The checkout’s later commit adds only brief 3. |
| + |
| +1. **P1 — O2′ does not bind evidence to the pinned key.** [Plan:1884](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-1b-next-build/docs/superpowers/plans/2026-10-10-region-ha-1b-next-stage-b.md:1884) |
| + |
| + `KeyAdopted` accepts any nonempty env key, without comparing it to the adoption record’s digest. `KeyQuestion` supplies neither the pinned manifest nor its key digest, so the reader cannot establish that correspondence. `KeyConfig` returns success without reading the env; an unadopted env key can override the configured key, or the env object can be unreadable. |
| + |
| + This differs from instance-key rev 2’s O2′, which requires adoption for the **exact pinned key** and consults configuration only when the env supplies no key. The custom parser also accepts `export CARLOS_INSTANCE_KEY=…`, which the launch parser does not interpret as that variable. |
| + |
| + Use the agreed pinned-manifest check and shared parser. Add mismatched adoption, overridden configuration, unreadable env and duplicate/exported assignment cases. The existing unused-key negative case covers only the nil-reader fallback. |
| + |
| +2. **P1 — Serving admission can invalidate C10 before participation is cleared.** [Plan:4514](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-1b-next-build/docs/superpowers/plans/2026-10-10-region-ha-1b-next-stage-b.md:4514) |
| + |
| + Completion releases the hold and lifts the fence without synchronously closing participation. An immediate request can advance the serving writer: `ClaimWakeAssembly` calls `writer.Admit` and `AfterAdmission` before `persistPrelaunch` selects work and invokes `productionClaimLocal.Prepare` (`claimwakeassembly.go:311`, `:529`). |
| + |
| + C10 then calls `completedPrior`, which requires the current holder still to equal the stopped probe. The serving admission has changed its stamp, session and generation, so discharge refuses. The original captured observation also cannot stop this successor, leaving participation denial behind. |
| + |
| + Require successful participation discharge before serving admission becomes possible. Test an immediate request after completion while the participation sweep is paused. |
| + |
| +3. **P1 — Restart recovery skips C10 and can block N6 permanently.** [Plan:370](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-1b-next-build/docs/superpowers/plans/2026-10-10-region-ha-1b-next-stage-b.md:370) |
| + |
| + After a crash between completion and participation cleanup, `clearUntracked` passes the **current serving observation** to `cleanup` (`claimparticipation_stale.go:31`). C10 immediately rejects that input because it requires a captured relocating claim. |
| + |
| + Cleanup consequently attempts a serving-shaped stop. That can replace the completed probe’s active fence through `BeginFence`. N6 subsequently supplies the original probe receipt, but `BeginColdHandover` refuses the different active fence (`hostguard/coldhandover.go:42`). |
| + |
| + Recover the completed relocation using the persisted participation binding and exact probe evidence before ordinary cleanup. Test a restart after the serving CAS but before `ClearStale`, through the first serving request. |
| + |
| +4. **P2 — A passed probe awaiting its stop has no deadline.** [Plan:4808](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-1b-next-build/docs/superpowers/plans/2026-10-10-region-ha-1b-next-stage-b.md:4808) |
| + |
| + Once `probe` exists without `probe_stop`, the worker returns before checking `ProbeDeadline`. If the execution lease is lost in that interval, `Participant.Step` fails its initial `Ready` check and never reaches `EndProbe`. A live target can therefore remain in `probing` indefinitely, contrary to ruling 60. |
| + |
| + Bound this state explicitly, preserving denial and reporting an operator-required outcome when stop evidence cannot be obtained. Test lease loss immediately after `RecordProbe` and persistent stop refusal. |
| + |
| +5. **P2 — Deleted env entries are verified correctly but cannot be installed or repaired.** [Plan:2698](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-1b-next-build/docs/superpowers/plans/2026-10-10-region-ha-1b-next-stage-b.md:2698) |
| + |
| + `Present` correctly requires absence for a deleted `EnvItem`. Installation checks only map membership, then calls `ReadPlatform`; a tombstone has no object to fetch, so installation fails instead of removing the local env file. |
| + |
| + Treat a deleted entry like an absent entry. Exercise this through `Install` and repairing `EnsureLocal`, including a stale local env file. |
| + |
| +The round-2 dispositions are: |
| + |
| +| Finding | Assessment | |
| +|---|---| |
| +| 1: key evidence | Open; O2′ differs from its dependency’s contract. | |
| +| 2: stale receipt CAS | Addressed in the proposed `sameInstallation` transitions. | |
| +| 3: typed directory ownership | Addressed through `PrepareState`. | |
| +| 4: later probe stamps | Safe, conservative C11 fallback; later launches remain gated. | |
| +| 5: participation cleanup | Partial; admission ordering and restart recovery remain broken. | |
| +| 6: serving-shaped re-stop | N6’s direct receipt handover is sound when correctly ordered. | |
| +| 7: build execution authority | Addressed in the proposed per-write check; build body remains stubbed. | |
| +| 8: census classification | Addressed by N9. | |
| +| 9: env verification | Byte verification addressed; tombstone repair remains broken. | |
| +| 10: bounded recovery | `installed` addressed; passed-probe stop wait remains unbounded. | |
| +| 11: C6 and lifecycle coverage | C6 fallback corrected; replacement coverage remains a specification. | |
| + |
| +For N6’s intended sequence, the receipt lookup binds host, incarnation, stamp, operation, box, session, phase, fence and digest. I found no path there that substitutes another writer’s receipt. C10 likewise requires completed stop evidence; lease loss alone does not authorize discharge. |
| + |
| +The lifecycle specification names useful scenarios, but the compile record does not establish that the new production property or its mutation checks ran. Add the precise interleavings above, including lease loss before and after the stop receipt, while retaining real cleanup and handover checks. |
| + |
| +**Verdict: not ready to build.** |
| + |
| +Static review only. No files changed or tests run. |
| + |
| +--- |
| + |
| +**FIRST PROMPT:** |
| +Review stage B plan rev 3 at `b897dbb7`, following brief 3. |
| + |
| +**WHAT:** |
| +Check round-2 closure, handover, participation, key evidence and coverage. |
| + |
| +**STATUS:** |
| +Review complete: three P1 and two P2 findings. |
| + |
| +**NEEDED:** |
| +Nothing. |
| + |
| +**RECOMMENDED:** |
| +Revise the five affected paths and their regression scenarios before implementation. |
| + |
| +**SESSION:** |
| +Safe to close. Nothing started remains running; no handoff file written in this read-only workspace. |
| \ No newline at end of file |