amadan
#162: why the shared-flat-directory refusal removes where a contested host holds
Summary
found by the third adversarial review and decided rather than patched. Every process in a shared flat directory runs as the same uid, so holding the file there would leave a live pair key readable by the very neighbour that caused the refusal. Removal denies both sides equally; the cost is a denial of service a writer who can mint a row on the box can cause, which is the same accepted class as the contested-host DoS.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
1 file changed,
+10
−1
docs/superpowers/specs/2026-09-21-replica-placements-design.md+10 −1
CI passed — run details
diff --git a/docs/superpowers/specs/2026-09-21-replica-placements-design.md b/docs/superpowers/specs/2026-09-21-replica-placements-design.md| index b445611ac..eb262aa51 100644 |
| --- a/docs/superpowers/specs/2026-09-21-replica-placements-design.md |
| +++ b/docs/superpowers/specs/2026-09-21-replica-placements-design.md |
| @@ -610,7 +610,16 @@ loser's app would read a key minted for another account's pair — and sign |
| a lease call with it, which that pair's sibling would accept. So: |
| - the writer refuses **both** when two flat hosts on a box would share one |
| - directory, logs once naming them, and removes any stale file there; |
| + directory, logs once naming them, and removes any stale file there. |
| + **Removal, not the "hold" a contested host gets (§6)** — and that |
| + asymmetry is deliberate. Every process in a shared flat directory runs as |
| + the same uid, so a file left there is readable by the neighbour that |
| + caused the refusal; holding it would leave a live pair key where the |
| + wrong process can read it, while removing it denies both sides equally. |
| + The cost is that a flat-layout victim loses its file when a neighbour row |
| + appears on that box, which a writer who can mint a row on the box can |
| + cause deliberately. That is a denial of service, in the same accepted |
| + class as §6's — availability traded for a key that cannot leak; |
| - the write and the removal decision are made **per directory**, never per |
| host, or removing one host's file would delete a flat neighbour's; |
| - the residual hole is not the writer's to close: a flat row with no |