carlos / platform Public

Astra stage B plan round 1: unedited

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Paul Campbell pushed by claude 2 weeks ago 808c36a7d5639113d7ec0b89c419c3131a8d783e parent bb95591

1 file changed, +33 −0

docs/superpowers/plans/CODEX-PLAN-REGION-HA-STAGE-B-R1.md +33 −0

diff --git a/docs/superpowers/plans/CODEX-PLAN-REGION-HA-STAGE-B-R1.md b/docs/superpowers/plans/CODEX-PLAN-REGION-HA-STAGE-B-R1.md

new file mode 100644

index 000000000..16af5a542

--- /dev/null

+++ b/docs/superpowers/plans/CODEX-PLAN-REGION-HA-STAGE-B-R1.md

@@ -0,0 +1,33 @@

+Reviewed `bb955916` against the brief and the checked-out implementation.

+1. **P1 — Two execution controllers compete for the same host lock.** [Plan:399](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-1b-next-build/docs/superpowers/plans/2026-10-10-region-ha-1b-next-stage-b.md:399) opens a separate relocation controller. Main’s `productionClaimLocal` already discovers operation participants and opens their controllers (`claimparticipation.go:318`, `:188`). Both use the same host lifetime lock. Whichever opens second blocks; the relocation acknowledgement or the probe’s `WorkSource.Prepare` cannot proceed. Reuse main’s participation owner and test both discovery orders.

+2. **P1 — The remote build requires an installation that nothing activates.** [Plan:556](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-1b-next-build/docs/superpowers/plans/2026-10-10-region-ha-1b-next-stage-b.md:556) requires `hostguard.Capture` to find `install_stamp` during `installing`. Task 9 removes reconcile activation, while Task 8c activates only in `installed`. A fresh target therefore cannot build P, and the worker cannot advance to the phase that activates it. The proposed fixture conceals this by pre-activating the guard. Specify and test activation from an empty target.

+3. **P1 — Local installation is ordered backwards for the real census and registry.** [Plan:814](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-1b-next-build/docs/superpowers/plans/2026-10-10-region-ha-1b-next-stage-b.md:814) creates/restores files and imports wake state before `MintHeld`. `ImportWake` requires an existing route (`hostfiles/wake.go:85`); `EmptyInstallationCensus.Initialize` refuses existing host files, rows or timers (`hostbox/empty_census.go:69`, `:131`). Consequently, a fresh target fails either before or during row creation. Establish typed ownership before materialization, mint the held row before importing wake state, and exercise the production census.

+4. **P1 — Every newly derived route uses the unsupported flat layout.** [Plan:745](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-1b-next-build/docs/superpowers/plans/2026-10-10-region-ha-1b-next-stage-b.md:745) calls `NestedPaths` on `registry.Route{Host: …}`, whose paths are empty. It always returns false, so `RouteFor` produces flat paths. The isolated launcher requires the nested database and socket (`claimroleassembly.go:93`, `:119`). Derive the destination from the authoritative layout and use matching files/env paths throughout installation and launch.

+5. **P1 — The held-stage request is never reached with claims enabled.** [Plan:869](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-1b-next-build/docs/superpowers/plans/2026-10-10-region-ha-1b-next-stage-b.md:869) calls `release.MaterializeHeld`. That API immediately returns `ErrHeldClaimWired` when `CARLOS_HOST_CLAIM` is on (`materializeheld.go:428`). The plan handles only `ErrStageBlocked`, so it returns before writing the relay request—even after M3 lands. Use the claim-aware staging path and test with the actual flags enabled.

+6. **P1 — P’s first probe always fails at publication.** [Plan:1235](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-1b-next-build/docs/superpowers/plans/2026-10-10-region-ha-1b-next-stage-b.md:1235) makes `Publish` unconditionally refuse and assigns publication to `PublishFenced`. However, `ClaimWakeAssembly` calls `Inputs.Publish` before replication when `in.Prepared` is true, and bypasses `PublishFenced` for that case (`claimwakeassembly.go:420`, `:465`). Implement the existing prepared-publication contract or explicitly revise the shared assembly. A direct `PublishFenced` test will not catch this.

+7. **P1 — Root’s relocation-attempt verifier remains unwired.** [Plan:1950](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-1b-next-build/docs/superpowers/plans/2026-10-10-region-ha-1b-next-stage-b.md:1950) checks a serving wake and the generic protocol. Production root construction leaves `ClaimLaunchRoot.Attempts` empty; `PreflightKind(relocating)` therefore refuses regardless of protocol version (`claimlaunch_production.go:81`, `claimlaunch_root.go:94`). Plan 11 explicitly requires this additional provider. Neither runtime construction nor the pass performs the promised preflight gate, so the participant can also spend probe attempts before discovering the refusal. Add the authoritative reader and a relocation-specific gate before counting attempts.

+8. **P1 — Releasing the hold does not perform the promised cold restart.** [Plan:1605](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-1b-next-build/docs/superpowers/plans/2026-10-10-region-ha-1b-next-stage-b.md:1605) assumes the activator retires the probe when the row becomes ready. `RetireExcept` keeps entries included in the edge’s ready-route set (`activator.go:4083`). Moreover, after the kind-changing CAS, stopping the captured relocating session fails `sameStopWriter` (`claimwakestop.go:273`). Specify an explicit stop/receipt/completion sequence and test a real probe through the subsequent serving wake. The proposed adapter-only test does not establish ruling 32.

+9. **P1 — Runtime construction panics on the production data store.** [Plan:1748](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-1b-next-build/docs/superpowers/plans/2026-10-10-region-ha-1b-next-stage-b.md:1748) asserts `a.Data.(release.Store)`. Production supplies `*lease.versionedS3`, which implements `lease.VersionedStore`, not `release.Store` (`claimproduction.go:125`). Construct a separate data-bucket `release.Store`; test the provider boundary without a fake implementing both interfaces.

+10. **P1 — The pass-through install loses execution-authority checks.** [Plan:804](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-1b-next-build/docs/superpowers/plans/2026-10-10-region-ha-1b-next-stage-b.md:804) checks claim fields inside `Guard.With`, but never checks main’s local execution authority, deadline or quarantine. `Guard.With` does not provide those checks; `WorkSource.With` does. Combined with the no-op cancellation hooks at line 1747, an install can continue after its controller loses authority while the claim remains unchanged. Ruling 34 needs a typed install authority retaining these checks, plus a lease-loss-during-install regression.

+11. **P2 — C8 is incorrectly recorded as an implemented production dependency.** [Plan:40](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-1b-next-build/docs/superpowers/plans/2026-10-10-region-ha-1b-next-stage-b.md:40) calls this “main’s C8 provider.” This checkout contains the interface and a test implementation, but no production `Establish` implementation or caller registering `ClaimProductionMoveSources`. Thus `out.Serving.Files` remains nil and the proposed relocation source refuses to open. Give this dependency an owner, fallback and activation test instead of marking it met.

+12. **P2 — Replica leases receive the logical region instead of the AWS region.** [Plan:1735](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-1b-next-build/docs/superpowers/plans/2026-10-10-region-ha-1b-next-stage-b.md:1735) sets `region = self.Region` and passes it to `lease.Acquire`, including through `cfg.Region`. That argument controls the S3 client/signing region; main uses `actor.Cloud.Region` (`claimassembly.go:186`). Separate the logical placement region from the storage client region and test unequal values.

+13. **P2 — The promised unopened-install recovery cannot run.** [Plan:794](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-1b-next-build/docs/superpowers/plans/2026-10-10-region-ha-1b-next-stage-b.md:794) reactivates the original stamp, but `Guard.Activate` explicitly refuses retired stamps (`hostguard/guard.go:207`). The install check also accepts only `installed`, although `Participant.Step` calls `EnsureLocal` during `probing`. A retired or damaged unopened installation cannot recover as claimed. Resolve the stamp/phase contract and restore the end-to-end recovery test from the original obligations.

+14. **P2 — The supplied owner code does not compile as directed.** [Plan:1324](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-1b-next-build/docs/superpowers/plans/2026-10-10-region-ha-1b-next-stage-b.md:1324) adds `Files release.Store` to a struct already containing `Files ClaimFilesManifest`; line 1388 supplies both duplicate fields. Separately, `Host, Op string` with ``json:"host","op"`` gives both fields the same JSON name, so the attempt journal loses both identities. Use distinct provider names and separate JSON tags, then compile the assembled snippets and test journal round-tripping.

+**Verdict: not ready to build.** The C1 drain restriction is a reasonable fallback, but the production integration and activation gates above remain unresolved.

+Static review only; no files changed or tests executed.

\ No newline at end of file