amadan
zdd plan 3: Astra scoped re-review r3 (ACCEPT)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 file changed,
+17
−0
docs/superpowers/plans/CODEX-FINDINGS-ZDD-IMPL-3-R3.md+17 −0
CI passed — run details
diff --git a/docs/superpowers/plans/CODEX-FINDINGS-ZDD-IMPL-3-R3.md b/docs/superpowers/plans/CODEX-FINDINGS-ZDD-IMPL-3-R3.md| new file mode 100644 |
| index 000000000..101ab01de |
| --- /dev/null |
| +++ b/docs/superpowers/plans/CODEX-FINDINGS-ZDD-IMPL-3-R3.md |
| @@ -0,0 +1,17 @@ |
| +**ACCEPT** |
| + |
| +Reviewed `37ffe34b..4a134a2b` against spec rev 17, the round-2 findings, ledger, and fix-wave-2 report. Read-only: no builds, tests, or mutants rerun. The worktree is clean; `git diff --check` passes. |
| + |
| +- **R2-1 — ADDRESSED.** Before calling the refused child’s Stop, cleanup transfers its process and build identity to `e.shed` under `a.mu` ([activator.go:2571](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/zdd-3-swap/internal/activator/activator.go:2571)). The generations snapshot includes that identity ([generations_file.go:114](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/zdd-3-swap/internal/activator/generations_file.go:114)). Both the terminal-stop path and pending-stop sweep refuse completion while the respawn remains in flight or its shed child remains retained ([activator.go:2957](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/zdd-3-swap/internal/activator/activator.go:2957), [activator.go:3032](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/zdd-3-swap/internal/activator/activator.go:3032)). Neither original sequence—failed shed Stop or Stop blocked beyond the respawn wait—can now close replication, delete the entry, or drop the replacement’s pin prematurely. |
| + |
| +- **R2-2 — ADDRESSED.** Retry registration and the transition to stopping share `a.mu`; retries require the entry still to be current and awake ([opset.go:379](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/zdd-3-swap/internal/activator/opset.go:379)). The barrier joins `restoreDone`, and pending cleanup independently refuses release while `restoring` remains true ([opset.go:125](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/zdd-3-swap/internal/activator/opset.go:125), [opset.go:473](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/zdd-3-swap/internal/activator/opset.go:473)). Thus a paused old retry prevents entry replacement until its backend write finishes; it cannot resume inside a later entry’s overlap. |
| + |
| +**New breakage:** none found in the fix diff. |
| + |
| +The indefinitely blocked shed Stop is **acceptable fail-closed behaviour** within this scope. Its cleanup operation has not finished, so releasing the entry on a timer would recreate the ownership escape. The reaper deliberately waits for that operation before taking over ([activator.go:3104](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/zdd-3-swap/internal/activator/activator.go:3104)). A Stop that returns without proving exit remains retryable; a Stop that never returns leaves the host unavailable. This change provides safety, not recovery from an indefinitely wedged backend. |
| + |
| +Lock discipline is sound: Stop calls, parent writes, channel waits, and generations-file persistence run outside `a.mu`; ownership transfers and retry registration run under it. Clearing `restoring` before closing its completion channel is safe because the backend write has already returned. |
| + |
| +The R2-1 flag-off changes are necessary corrections to worker cleanup. R2-2 adds no flag-off parent-write path. The supplied regression tests cover both original sequences; the report records passing focused race checks, the 3,000-seed sweep, and nine caught mutants. |
| + |
| +**Out-of-scope observations:** the previously deferred F6 descendant-proof limitation remains unchanged. No additional observations to park. |
| \ No newline at end of file |