amadan
docs: region HA plan 1b-next rev 10 fixes stage A's task order and proves create-time selection
Astra round 9, two findings, both accepted. ValidateManifest moves to internal/hostfiles/manifestcheck.go, which Task 5 now creates, so Task 5 builds before Task 7. The create test now drives Attempt with selection on box-b and completion offering box-a. It expects a refusal, an intent naming box-b and its enrollment, then a box-b completion with selection run once. Removing the selection fails it. Stage A was dry-run on 3407d114 in task order (1, 2, 3, 4, 5, 6, 7, 9a), building and testing after each task; no other ordering fault.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 file changed,
+93
−46
docs/superpowers/plans/2026-10-07-region-ha-1b-next-relocation.md+93 −46
diff --git a/docs/superpowers/plans/2026-10-07-region-ha-1b-next-relocation.md b/docs/superpowers/plans/2026-10-07-region-ha-1b-next-relocation.md| index 43837ad25..c7db808d2 100644 |
| --- a/docs/superpowers/plans/2026-10-07-region-ha-1b-next-relocation.md |
| +++ b/docs/superpowers/plans/2026-10-07-region-ha-1b-next-relocation.md |
| @@ -1,15 +1,28 @@ |
| -# Region HA 1b-next: Relocation, Row Cases, Create Choice and Fences Implementation Plan (rev 9) |
| +# Region HA 1b-next: Relocation, Row Cases, Create Choice and Fences Implementation Plan (rev 10) |
| > **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development (recommended) or superpowers:executing-plans to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking. |
| **Goal:** Build what region HA spec 1 had to leave until the host lifecycle claim was on main: the `relocating` operation within one region, released by the source's stop evidence (drain) or by its termination fence (failover); reconcile's row cases for it; create's once-only choice of executor box with `boxchoice.Choose`; and every claim CAS that consumes a termination fence. All of it dormant behind `CARLOS_REGION_HA`, and none of it mergeable until the joint two-box simulation round passes (L18). |
| -**Architecture:** Two stages (ruling 24). **Stage A, build now:** Tasks 1 to 7 and 9a, buildable on main today and dry-run on every revision: the claim library's relocation transitions and `released` coverage (`internal/hostclaim`), create's executor selection (`internal/hostclaim`, `internal/hostops`), the row and wake decisions (`internal/hostbox`), the writers-stopped observation (`internal/stopevidence`), the regional worker and the participant driver (new `internal/hostrelocate`), and the box-side release adapter with its receipt verifier (`internal/host`). **Stage B, gated:** Tasks 8a, 8b, 8c, 9 and 10 bind to claim Plan 6b and moves Plans 1 and 2, none merged. They keep their design and contracts here; their code is rewritten against the real 6b code after it merges and re-reviewed then (the "Stage B re-plan" step before Task 8a lists every obligation rounds 1 to 8 placed on them). What those need and no plan declares is a numbered request, never an assumption. The last task is the merge gate. The worker only reads termination fences: `hostfence.TerminationWorker` writes them, and `hostactors.Directory` is the only roster reader. |
| +**Architecture:** Two stages (ruling 24). **Stage A, build now:** Tasks 1 to 7 and 9a, buildable on main today and dry-run on every revision: the claim library's relocation transitions and `released` coverage (`internal/hostclaim`), create's executor selection (`internal/hostclaim`, `internal/hostops`), the row and wake decisions (`internal/hostbox`), the writers-stopped observation (`internal/stopevidence`), the regional worker and the participant driver (new `internal/hostrelocate`), and the box-side release adapter with its receipt verifier (`internal/host`). **Stage B, gated:** Tasks 8a, 8b, 8c, 9 and 10 bind to claim Plan 6b and moves Plans 1 and 2, none merged. They keep their design and contracts here; their code is rewritten against the real 6b code after it merges and re-reviewed then (the "Stage B re-plan" step before Task 8a lists every obligation rounds 1 to 9 placed on them). What those need and no plan declares is a numbered request, never an assumption. The last task is the merge gate. The worker only reads termination fences: `hostfence.TerminationWorker` writes them, and `hostactors.Directory` is the only roster reader. |
| **Tech Stack:** Go 1.26, module `github.com/carlosframework/platform`; `release.Store` (create-only and ETag compare-and-swap puts); the claim library (`hostclaim`), roster (`hostactors`), fences (`hostfence`, `termfence`), box choice (`boxchoice`), files (`hostfiles`), generation selection (`genselect`), stop evidence (`stopevidence`, `internal/host` stop receipts), execution controller (`hostexec`). |
| **Spec:** `docs/superpowers/specs/2026-10-04-region-ha-box-placement-design.md`, rev 5.4 with §24 (rulings H1 to H19 final). Read §0, §2, §5.2, §5.3, §5.8, §5.9, §5.10, §9 (L1 to L20, accepted) and §24 first. Then the claim spec rev 6.30 on `origin/design-replica-ownership` (`docs/superpowers/specs/2026-10-02-host-lifecycle-claim-design.md`): §1.1's activation gate, §4 ("Same-region relocation (L1)" and the relocation exception to CC11), §5.1 and P5-D2/P5-D6 (the create intent), §6.1 ("Release before full stop (L10)"), §6.4a item 2 (`released`), §7.3 D2 ("Automatic termination (L2, L4)", "The fence's journal reference") and D4 ("Automatic loss persistence"). Then moves rev 7.22 on `origin/design-moves-any-region` §7.6 ("One install routine, two sources", L16 and L17) and §7.10 (the pre-flip conversion). The contracts note `docs/superpowers/notes/2026-10-07-region-ha-contracts.md` gives `hostfiles` v2, `CopyManifest`, `Publish` and `boxchoice`. Plan 1b (`docs/superpowers/plans/2026-10-06-region-ha-1b-claim-readers.md`) lists in "Waits for the claim" what this plan now builds. |
| +## Rev 10: round 9 dispositions |
| + |
| +Astra's round 9 (`CODEX-PLAN-REGION-HA-1BN-R9.md`) resolved both round 8 findings and raised two new ones. Both are accepted; none is declined. |
| + |
| +This revision also adds a dry run that applies stage A in task order. The earlier dry runs applied every task at once, which is how finding 1 got through. This time a clean 3407d114 took Tasks 1, 2, 3, 4, 5, 6, 7 and 9a one at a time. After each task: `go build ./...`, vet of that task's packages, and that task's tests. With finding 1 fixed, every step built and passed and turned up no other ordering fault. The tree as a whole then passed vet for darwin and windows and the cross-builds. |
| + |
| +| # | Stage | Evidence checked | Disposition | What changed | Where | |
| +|---|---|---|---|---|---| |
| +| 1 (P1) | A | Applied in order, Task 5 failed to build: `internal/hostrelocate/pin.go:259:23: undefined: hostfiles.ValidateManifest`. The helper was first defined in Task 7's `internal/hostfiles/platform.go`. | accepted | `ValidateManifest` now lives in its own file, `internal/hostfiles/manifestcheck.go`, which Task 5 creates (Files list, Step 4, the Step 5 run and the Step 6 `git add`). Task 7's `platform.go` keeps only `EnvItem` and `StagePlatformDelete` and uses the helper unchanged. | Task 5, Task 7; the in-order dry run | |
| +| 2 (P2) | A | Selection and completion in rev 9's test both named box-a, and the intent check called `BeginCreateOn` itself. The test still passed with `Attempt`'s selection removed. | accepted | The fake authority now has a selected box, the box completion offers, and a call counter. With selection on box-b and completion offering box-a, `Attempt` must refuse with `ErrWrongState`. The persisted claim must still be `creating`, with `selected_executor` box-b and `executor_enrollment` enrollment-b. `Complete` with box-b then serves on box-b, and selection must have run exactly once. Removing `Attempt`'s use of the selection (`if selected` made false) fails the test: the completion substitutes box-a. | Task 2 (`TestCreateIsTodaysWithoutASelection`) | |
| + |
| +Astra's readings of rulings 1 to 24 stand. |
| + |
| ## Rev 9: round 8 dispositions |
| Astra's round 8 (`CODEX-PLAN-REGION-HA-1BN-R8.md`) resolved the release-retry finding and added two P2s. I checked both against `internal/host/claimstop.go` and `internal/hostguard/fence.go` and accepted both; none is declined. Both fixes are stage A code. They were dry-run on a clean 3407d114: build, vet for darwin and windows, cross-builds, and the targeted `hostclaim`, `hostrelocate` and `host` tests. Two new guards were each removed in turn and their tests failed (listed in the Self-review). Ruling 23 is amended. |
| @@ -208,7 +221,7 @@ Left out, with where it goes: |
| - **Go environment.** `GOFLAGS=-buildvcs=false`. Leave `GOCACHE` at its default; if the sandbox refuses it, `GOCACHE=$TMPDIR/gocache` for that command. Socket tests need `TMPDIR=/tmp/k` (`mkdir -p /tmp/k`). Run tests niced (`nice -n 19`), targeted with `-run`; never the full `-race` suite, and no simulation sweeps. Scratch goes under `$TMPDIR`. |
| - **Gate before each commit:** `go build ./... && go vet ./<pkgs>/ && gofmt -l <dirs>` (empty), the task's targeted tests, then `GOOS=darwin go build ./... && GOOS=windows go build ./...`. (`GOOS=windows go vet ./internal/...` fails on main's own test files, `release/versions_test.go`, `appconfig/syncexec_test.go` and `activator/activator_test.go`; vet the task's packages instead.) |
| - Commit messages: lowercase `area:` prefix and a sentence stating the behaviour, then a blank line and `Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>`. Work on a branch cut from `origin/main` (suggested `region-ha-1b-next`). Merging is Paul's call, through `amadan branch merge`, and only after Task 11. |
| -- **Dry run.** Tasks 1 to 7 were applied in order to `origin/main` at 3407d114, built, vetted, cross-built for darwin, windows and linux/arm64, and their tests run; nineteen guards were each removed in turn and their test watched to fail (rev 1), then rev 2's twenty-five, rev 3's eleven, rev 4's eight, rev 5's seven, rev 6's eleven, rev 7's three, rev 8's two and rev 9's two (listed in the Self-review). Then the code was removed; only this document is committed. |
| +- **Dry run.** Tasks 1 to 7 were applied in order to `origin/main` at 3407d114, built, vetted, cross-built for darwin, windows and linux/arm64, and their tests run; nineteen guards were each removed in turn and their test watched to fail (rev 1), then rev 2's twenty-five, rev 3's eleven, rev 4's eight, rev 5's seven, rev 6's eleven, rev 7's three, rev 8's two, rev 9's two and rev 10's one (listed in the Self-review); from rev 10 on, stage A is also applied one task at a time in plan order, building and testing after each. Then the code was removed; only this document is committed. |
| ## Review Focus |
| @@ -229,7 +242,7 @@ Left out, with where it goes: |
| | `internal/hostops/executor.go`, `loads.go`, `operations.go`, `backfill.go`, `backfill_controller.go` | `ExecutorChooser` over the roster, the edges snapshot and claim loads, and `Permits`; `Authority.SelectExecutor` before the create CAS, or today's create without one | 2 | |
| | `internal/hostbox/relocationrows.go`, `wakepolicy.go`, `internal/hostguard/admissionfence.go` | §5.3's row cases; who may wake under `relocating`; the policy's relocation owner, its `reconcile` action and `RelocationPolicy`; the admission-fence reader | 3 | |
| | `internal/stopevidence/writers*.go` | L10's writers-stopped observation; one process's descriptors on the database | 4 | |
| -| `internal/hostrelocate/worker.go`, `pin.go` | The regional worker: start (eligibility, shape), one replayed CAS per step, the pin under the location lease, the release deadline; the pinned recovery set by claim generation, `ReadPin`, `CopyPinnedManifest` | 5 | |
| +| `internal/hostrelocate/worker.go`, `pin.go`, `internal/hostfiles/manifestcheck.go` | The regional worker: start (eligibility, shape), one replayed CAS per step, the pin under the location lease, the release deadline; the pinned recovery set by claim generation, `ReadPin`, `CopyPinnedManifest` | 5 | |
| | `internal/hostrelocate/participant.go` | A participant box's transitions, ordered over its local effects | 6 | |
| | `internal/host/relocationreleases.go`, `relocationeffects.go`, `relocationflush.go`, `internal/hostfiles/platform.go` | Stop receipts as release evidence; the release sequence inside root's stop collection (stop writers, observe, flush, record, drain); retained controllers; durable positions; the full files flush; `EnvItem` | 7 | |
| | `internal/host/relocationassembly.go` | Gated: the release providers bound to 6b's assembly | 8a | |
| @@ -3184,14 +3197,14 @@ index e20b1982..7c727f9d 100644 |
| func reportKey(reservation, box string) (string, error) { |
| ``` |
| -Apply to `internal/hostops/operations_test.go` (the fake authority implements the new method; `TestCreateIsTodaysWithoutASelection` pins dormancy): |
| +Apply to `internal/hostops/operations_test.go` (the fake authority implements the new method; `TestCreateIsTodaysWithoutASelection` pins dormancy and, rev 10, drives `Attempt` with a selection that differs from what completion offers): |
| ```diff |
| diff --git a/internal/hostops/operations_test.go b/internal/hostops/operations_test.go |
| -index 42ebf9d1..8b0a2f56 100644 |
| +index 42ebf9d1..f37e17c3 100644 |
| --- a/internal/hostops/operations_test.go |
| +++ b/internal/hostops/operations_test.go |
| -@@ -15,8 +15,18 @@ import ( |
| +@@ -15,10 +15,32 @@ import ( |
| "github.com/carlosframework/platform/internal/release" |
| ) |
| @@ -3199,49 +3212,74 @@ index 42ebf9d1..8b0a2f56 100644 |
| +type authority struct { |
| + err error |
| + // selects is region HA's create-time choice; false is today's create. |
| -+ selects bool |
| ++ // selected is the box it chooses (box-a when empty); executor is the |
| ++ // box completion offers (box-a when empty); selections counts calls. |
| ++ selects bool |
| ++ selected, executor string |
| ++ selections int |
| +} |
| +func (a *authority) SelectExecutor(context.Context, hostclaim.Observed, Record) (hostclaim.ExecutorSelection, bool, error) { |
| ++ a.selections++ |
| + if !a.selects { |
| + return hostclaim.ExecutorSelection{}, false, a.err |
| + } |
| -+ return hostclaim.ExecutorSelection{Box: "box-a", Enrollment: "enrollment-a"}, true, a.err |
| ++ box := a.selected |
| ++ if box == "" { |
| ++ box = "box-a" |
| ++ } |
| ++ return hostclaim.ExecutorSelection{Box: box, Enrollment: "enrollment-" + box[len("box-"):]}, true, a.err |
| +} |
| func (a *authority) Create(context.Context, hostclaim.Observed, Record, string) error { return a.err } |
| func (a *authority) Executor(context.Context, hostclaim.Observed, Record) (string, error) { |
| ++ if a.executor != "" { |
| ++ return a.executor, a.err |
| ++ } |
| return "box-a", a.err |
| -@@ -138,6 +148,36 @@ func TestAttemptUsesPreRegistrationObservation(t *testing.T) { |
| + } |
| + func (a *authority) StartDelete(context.Context, hostclaim.Observed, Record) error { return a.err } |
| +@@ -138,6 +160,47 @@ func TestAttemptUsesPreRegistrationObservation(t *testing.T) { |
| t.Fatal("deleted claim") |
| } |
| } |
| + |
| +// TestCreateIsTodaysWithoutASelection pins dormancy (region HA §8 step 2): |
| +// with no create-time choice the claim carries no selected executor and |
| -+// completion takes the box Executor names; with one, the intent names it |
| -+// and completion is bound to it. |
| ++// completion takes the box Executor names. With one, Attempt itself |
| ++// records the selection in the create CAS (round 9 finding 2): selection |
| ++// chooses box-b while completion offers box-a, so the completion refuses, |
| ++// the persisted intent names box-b and its enrollment, and a completion |
| ++// with box-b serves without selecting again. |
| +func TestCreateIsTodaysWithoutASelection(t *testing.T) { |
| + f := newFixture(t) |
| + obs := f.serving(t, "off.bab.example.com") |
| + if obs.Claim.Op.Exec != "box-a" || obs.Claim.Op.Intent["selected_executor"] != "" || obs.Claim.Op.Intent["executor_enrollment"] != "" { |
| + t.Fatalf("HA off: %+v", obs.Claim.Op) |
| + } |
| -+ f.auth.selects = true |
| -+ obs = f.serving(t, "on.bab.example.com") |
| -+ if obs.Claim.Op.Exec != "box-a" { |
| -+ t.Fatalf("HA on: %+v", obs.Claim.Op) |
| -+ } |
| -+ before, err := hostclaim.Read(f.ctx, f.store, "two.bab.example.com") |
| ++ f.auth.selects, f.auth.selected, f.auth.selections = true, "box-b", 0 |
| ++ const host = "on.bab.example.com" |
| ++ before, err := hostclaim.Read(f.ctx, f.store, host) |
| + if err != nil { |
| + t.Fatal(err) |
| + } |
| -+ r := f.record(t, "two.bab.example.com") |
| -+ created, err := hostclaim.Update(f.ctx, f.store, before, hostclaim.BeginCreateOn(r.Holder, r.Body, "c", "test", f.now, hostclaim.ExecutorSelection{Box: "box-a", Enrollment: "enrollment-a"})) |
| ++ id := f.c.NewID() |
| ++ if _, err := f.c.Attempt(f.ctx, before, f.record(t, host), id, "test"); !errors.Is(err, hostclaim.ErrWrongState) { |
| ++ t.Fatalf("completion substituted box-a for the selected box-b: %v", err) |
| ++ } |
| ++ pending, err := hostclaim.Read(f.ctx, f.store, host) |
| + if err != nil { |
| + t.Fatal(err) |
| + } |
| -+ if created.Claim.Op.Intent["selected_executor"] != "box-a" || created.Claim.Op.Intent["executor_enrollment"] != "enrollment-a" { |
| -+ t.Fatalf("HA on, the intent: %+v", created.Claim.Op.Intent) |
| ++ if pending.Claim.Op.Kind != hostclaim.KindCreating || pending.Claim.Op.Intent["selected_executor"] != "box-b" || pending.Claim.Op.Intent["executor_enrollment"] != "enrollment-b" { |
| ++ t.Fatalf("HA on, the persisted intent: %+v", pending.Claim.Op) |
| ++ } |
| ++ f.auth.executor = "box-b" |
| ++ done, err := f.c.Complete(f.ctx, host, id) |
| ++ if err != nil || done.Claim.Op.Kind != hostclaim.KindServing || done.Claim.Op.Exec != "box-b" { |
| ++ t.Fatalf("completion with the selected box: %+v %v", done.Claim, err) |
| ++ } |
| ++ if f.auth.selections != 1 { |
| ++ t.Fatalf("selection ran %d times, want once", f.auth.selections) |
| + } |
| +} |
| + |
| @@ -4730,7 +4768,7 @@ Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>" |
| Spec §5.8 "Who acts". `Worker.Start` checks that this box is an active, unfenced worker of the region; that the claim serves on the source and the host is an instance of a relocatable shape (`Relocatable`); that the target is in the complete eligible set (`Eligible`, §2); the source's fence (a failover needs one, a drain refuses one); that a drain's source has a writer session to release (ruling 11); `Directory.CheckBoxStart` for the starter, the target and a live source (active, unfenced, no executable update reserved: H14); the box-started census (L5, L20); and the app admission registration; then `StartRelocation`. `Worker.Step` makes at most one worker CAS from the claim alone: a fenced source converts the operation (`FenceSource`), a fenced target is replaced (`ReplaceTarget`, or `MarkStuck` once two are used), then the phase's own step: the barrier, the pin after a release or after the failover window (selected and journaled under the replica lease on `holder.location`, finding 2), naming and installing the target, recording `installed` once `Prepared` verifies P, serving after a passing probe, `probe-failed` past the probe deadline, `stuck` past the release deadline (ruling 14) or on a live target's third replacement. `StorePinner` selects the database plan with `genselect.Select` and the files pin (the newest manifest in the admitted chain, independently of the database baseline, B2-4, with the chain as its origins), checks every bound before it writes, and writes the pin object create-only at the key of the claim generation it selected against (ruling 16); a retry at the same generation reuses its own object; an empty pin needs its evidence (ruling 15). `ReadPin` is every reader's digest-checked read; the pinner retains the pinned manifest's exact bytes in the control bucket (ruling 21) and `CopyPinnedManifest` writes P's files manifest from that copy and nothing else. A target replacement is looked for only while replacements remain; exhaustion is stuck at once. |
| **Files:** |
| -- Create: `internal/hostrelocate/worker.go`, `internal/hostrelocate/pin.go` |
| +- Create: `internal/hostrelocate/worker.go`, `internal/hostrelocate/pin.go`, `internal/hostfiles/manifestcheck.go` (`ValidateManifest`, rev 10) |
| - Test: `internal/hostrelocate/worker_test.go`, `internal/hostrelocate/pin_test.go` |
| **Interfaces:** |
| @@ -6492,15 +6530,43 @@ func CopyPinnedManifest(ctx context.Context, claims, data release.Store, pin Fil |
| } |
| ``` |
| +`internal/hostfiles/manifestcheck.go` (`CopyPinnedManifest` needs it; Task 7's `platform.go` sits beside it in the same package): |
| + |
| +```go |
| +package hostfiles |
| + |
| +import "fmt" |
| + |
| +// ValidateManifest checks every entry and platform item of m against the |
| +// admitted origins, as Restore and CopyManifest do before they touch |
| +// anything (contracts note §1). A caller holding a manifest's exact bytes |
| +// from somewhere other than its prefix (a relocation's retained copy) |
| +// validates them with it before writing them under a new generation. |
| +func ValidateManifest(m Manifest, origins []string) error { |
| + if m.V != ManifestVersion { |
| + return fmt.Errorf("hostfiles: manifest is version %d; this binary reads %d", m.V, ManifestVersion) |
| + } |
| + if len(origins) == 0 { |
| + return ErrOrigin |
| + } |
| + for _, o := range origins { |
| + if err := checkPrefix(o); err != nil { |
| + return err |
| + } |
| + } |
| + return checkManifest(m, origins) |
| +} |
| +``` |
| + |
| - [ ] **Step 5: Run the tests** |
| -Run: `nice -n 19 go test ./internal/hostrelocate/ -count=1 -v 2>&1 | grep -E '^(---|ok|FAIL)'` |
| -Expected: PASS for all twenty-two tests. |
| +Run: `nice -n 19 go test ./internal/hostrelocate/ ./internal/hostfiles/ -count=1 -v 2>&1 | grep -E '^(---|ok|FAIL)'` |
| +Expected: PASS for all twenty-two `hostrelocate` tests, and `hostfiles` unchanged. |
| - [ ] **Step 6: Commit** |
| ```bash |
| -git add internal/hostrelocate/worker.go internal/hostrelocate/pin.go internal/hostrelocate/worker_test.go internal/hostrelocate/pin_test.go |
| +git add internal/hostrelocate/worker.go internal/hostrelocate/pin.go internal/hostrelocate/worker_test.go internal/hostrelocate/pin_test.go internal/hostfiles/manifestcheck.go |
| git commit -m "hostrelocate: a regional worker starts a relocation and replays it one claim CAS at a time, reading fences only |
| Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>" |
| @@ -7853,26 +7919,6 @@ func (p *Publisher) StagePlatformDelete(name string) error { |
| p.dirty = true |
| return nil |
| } |
| - |
| -// ValidateManifest checks every entry and platform item of m against the |
| -// admitted origins, as Restore and CopyManifest do before they touch |
| -// anything (contracts note §1). A caller holding a manifest's exact bytes |
| -// from somewhere other than its prefix (a relocation's retained copy) |
| -// validates them with it before writing them under a new generation. |
| -func ValidateManifest(m Manifest, origins []string) error { |
| - if m.V != ManifestVersion { |
| - return fmt.Errorf("hostfiles: manifest is version %d; this binary reads %d", m.V, ManifestVersion) |
| - } |
| - if len(origins) == 0 { |
| - return ErrOrigin |
| - } |
| - for _, o := range origins { |
| - if err := checkPrefix(o); err != nil { |
| - return err |
| - } |
| - } |
| - return checkManifest(m, origins) |
| -} |
| ``` |
| `internal/host/relocationflush.go`: |
| @@ -11029,3 +11075,4 @@ Expected: exit 0. Exit 2 is pending: wait and read again. Exit 1: read the log a |
| - **Rev 7 guards**, each removed in turn and its test watched to fail: the `KCMP_FILES` shared-table check (the real kernel's unshared thread with the copied descriptor passes as the leader's); the `KCMP_FILE` description check (the fixture's shared table with another description passes); an unavailable kcmp failing closed (ENOSYS and EPERM pass instead of `ErrIncomplete`). Three in all. |
| - **Rev 8 guards**, each removed in turn and its test watched to fail: `Release` marking a same-controller retry with recorded positions as resumed; the resumed drain skipping straight to the producers' drain. Two in all. |
| - **Rev 9 guards**, each removed in turn and its test watched to fail: `FenceExhaustedTarget` keeping a live source's `op.exec` and phase (the `starting` and `releasing` cases revoke it); `Release` keeping the recorded directory revision whenever positions are recorded (the same-controller retry asks at the new revision). Two in all. |
| +- **Rev 10 guard**, removed and its test watched to fail: `Attempt` creating with the selection it made (`TestCreateIsTodaysWithoutASelection`: the completion substitutes box-a). The in-order dry run is the check for finding 1. One in all. |