amadan
Region HA plan 1b-next: Astra round 6 findings (6 resolved, 1 new; not ready), unedited
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 file changed,
+28
−0
docs/superpowers/plans/CODEX-PLAN-REGION-HA-1BN-R6.md+28 −0
diff --git a/docs/superpowers/plans/CODEX-PLAN-REGION-HA-1BN-R6.md b/docs/superpowers/plans/CODEX-PLAN-REGION-HA-1BN-R6.md| new file mode 100644 |
| index 000000000..0c70ac75b |
| --- /dev/null |
| +++ b/docs/superpowers/plans/CODEX-PLAN-REGION-HA-1BN-R6.md |
| @@ -0,0 +1,28 @@ |
| +Reviewed `222ff1c6`. **P** refers to the [implementation plan](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-1b-next/docs/superpowers/plans/2026-10-07-region-ha-1b-next-relocation.md). |
| + |
| +| Round 5 finding or partial | Disposition | Assessment against rev 6 | |
| +|---|---|---| |
| +| R4-5 — durable controller cleanup | Resolved | Participation is journaled before opening. Every clear requires successful scoped cleanup in that call, including retries and restart recovery. Stage B retains these obligations. | |
| +| 1 — replacement on a box owing `park-local` | Resolved | Selection excludes these boxes; `replaceTargetSlot` independently refuses them inside the CAS. Tests cover replacement phases and choosing a clean spare. | |
| +| 2 — regional chores remain assigned to a dead box | Resolved | `fenceBox` reassigns both regional chore kinds, preserves their identities and records the reassignment. Tests cover both discharge outcomes. | |
| +| 3 — reconcile changes with HA disabled | Resolved | Task 9a preserves the original serving-only check when both callbacks are nil. Tests check refusal and unchanged claim/local state. | |
| +| 4 — interrupted journal write hides recovery work | Resolved | Temporary files are ignored; damaged committed entries produce errors without hiding readable entries. `Sweep` reports those errors. | |
| +| 5 — deleted environment file remains published | Resolved | Flush stages an explicit deletion on `ENOENT`. Tests cover publication followed by removal; Stage B requires removing the destination file too. | |
| + |
| +**New finding:** |
| + |
| +1. **P1 — Task 4, Step 3: an unshared thread’s database descriptor can pass as the replicator’s.** |
| + |
| + At [P4292–4300](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-1b-next/docs/superpowers/plans/2026-10-07-region-ha-1b-next-relocation.md:4292), `scanOne` treats matching descriptor numbers and paths as proof that a thread shares the leader’s descriptors, then deduplicates them. |
| + |
| + A thread can unshare its descriptor table, close descriptor 5 and independently reopen the same database as descriptor 5. The scan represents that independent holder as the leader’s allowed replicator descriptor. `WritersStopped` consequently succeeds, permitting the final flush while another writer still holds the database. Process-start verification does not distinguish threads within that process. |
| + |
| + This violates claim §6.1’s requirement for positively identified replicator descriptors. Existing tests cover differing descriptor numbers or a missing leader descriptor, but not independent descriptors with matching numbers and paths. |
| + |
| + **Fix:** require positive kernel evidence that the thread shares the leader’s descriptor table; fail closed when that identity cannot be established. Add shared-versus-unshared tests where both tables contain the same database descriptor number, including an independently reopened descriptor. |
| + |
| +I accept rulings 1–24. Stage B’s re-plan carries the earlier integration obligations; the new finding concerns Stage A’s observation mechanism. |
| + |
| +All **12 embedded patches pass `git apply --check`**. Compilation and tests were not reproduced in this read-only sandbox. No files changed. |
| + |
| +**Verdict: not ready.** |
| \ No newline at end of file |