amadan
Region HA plan 1b-next: Astra round 17 findings (F1-F3 partly; 1 P1, 2 P2), unedited
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 file changed,
+47
−0
docs/superpowers/plans/CODEX-PLAN-REGION-HA-1BN-R17.md+47 −0
diff --git a/docs/superpowers/plans/CODEX-PLAN-REGION-HA-1BN-R17.md b/docs/superpowers/plans/CODEX-PLAN-REGION-HA-1BN-R17.md| new file mode 100644 |
| index 000000000..ad627200d |
| --- /dev/null |
| +++ b/docs/superpowers/plans/CODEX-PLAN-REGION-HA-1BN-R17.md |
| @@ -0,0 +1,47 @@ |
| +Reviewed `6b791017`. |
| + |
| +| Prior verdict / model finding | Disposition | Assessment | |
| +|---|---|---| |
| +| R16: lost receipt after P opens | Resolved | Receipt verification and stuck handling remain intact. | |
| +| R16: crash simulation repairs cleanup faults | Resolved | Crashes preserve faults and durable records; recovery remains separate. | |
| +| F2: files pin can lose `instance.key` | Partly | Missing manifests are refused, but an existing empty manifest bypasses the guard. | |
| +| F1: failed probe waits indefinitely without a spare | Partly | The deadline works while the target remains alive; termination bypasses it. | |
| +| F3: abandoned prepared generation leaks | Partly | Replacement during `installing` is covered; replacement from `probe-failed` can forget P. | |
| + |
| +1. **P1 — An existing empty manifest still permits key loss.** Task 5, Step 4: [`filesPin`, line 7183](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-1b-next/docs/superpowers/plans/2026-10-07-region-ha-1b-next-relocation.md:7183) returns an existing manifest before checking positive evidence. Stage B explicitly requires a manifest copy before app startup. That copy can lack `instance.key`: the app then mints its key, replicates dependent database data, and terminates before publishing the key. Recovery still installs a database without its key. |
| + |
| + **Fix:** Refuse recovery without evidence for the required files, including when a manifest exists. Test an empty manifest with an admitted writer and nonempty database. Ruling 25 also needs an upstream durability contract: the continuous-sync window does not make that database recoverable. |
| + |
| +2. **P2 — Target termination bypasses the no-spare deadline.** Task 5, Step 3: [`Step`, line 6737](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-1b-next/docs/superpowers/plans/2026-10-07-region-ha-1b-next-relocation.md:6737) dispatches a target fence to `replace` before reaching the phase deadline. When replacements remain, `replace` returns the chooser’s error indefinitely. Terminating the target after its journaled release therefore leaves the host unserved without marking the operation stuck. |
| + |
| + **Fix:** Add a bounded, fence-consuming transition for a terminated target with no spare. Extend the deadline test by terminating the target after release. |
| + |
| +3. **P2 — Replacement from `probe-failed` can discard an unopened P without recording it.** Task 1, Step 3: [`ReplaceTarget`, line 2616](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-1b-next/docs/superpowers/plans/2026-10-07-region-ha-1b-next-relocation.md:2616) deletes `prepared` in its default branch. This includes a target whose probe deadline expired before any admission, followed by termination. The later `install` cannot record the forgotten P, so completion queues no retirement. |
| + |
| + **Fix:** Record unopened P before every transition that discards it. Test probe timeout before admission, target termination, replacement, and successful completion. |
| + |
| +Rulings 1–24 remain accepted. Ruling 26’s operator-only recovery is reasonable with its stated availability cost. Rulings 25 and 27 need the corrections above. Prior Stage B contracts remain present; the new F2 contract is insufficient. |
| + |
| +All 12 embedded patches pass `git apply --check`; all 47 Go blocks parse with `gofmt`. Compilation, runtime tests and mutations were not independently reproduced. |
| + |
| +--- |
| + |
| +**FIRST PROMPT:** |
| +“Follow the review brief docs/superpowers/plans/CODEX-PLAN-REGION-HA-1BN-BRIEF-17.md. Review the plan at commit 6b791017.” |
| + |
| +**WHAT:** |
| +Review Stage A readiness and Stage B contracts. |
| + |
| +**STATUS:** |
| +Three findings: one P1 and two P2s. |
| + |
| +**NEEDED:** |
| +Nothing. |
| + |
| +**RECOMMENDED:** |
| +Correct the three paths and add the missing regression cases. |
| + |
| +**SESSION:** |
| +Safe to close — no files changed or processes left running. |
| + |
| +**Verdict: not ready.** |
| \ No newline at end of file |