amadan
Astra review, hostfiles path cap round 2: unedited — round-1 P2s closed except one: a deep tombstone's file left on disk strands the next scan and relocation's flush
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 file changed,
+25
−0
docs/superpowers/plans/CODEX-REVIEW-HOSTFILES-CAP-2.md+25 −0
diff --git a/docs/superpowers/plans/CODEX-REVIEW-HOSTFILES-CAP-2.md b/docs/superpowers/plans/CODEX-REVIEW-HOSTFILES-CAP-2.md| new file mode 100644 |
| index 000000000..913aa76c6 |
| --- /dev/null |
| +++ b/docs/superpowers/plans/CODEX-REVIEW-HOSTFILES-CAP-2.md |
| @@ -0,0 +1,25 @@ |
| +--- |
| + |
| +**FIRST PROMPT:** |
| +Review `hostfiles-cap-live-entries` at `4411ffff` against the round-2 brief, read-only. |
| + |
| +**WHAT:** |
| +Check both previous findings, downstream recovery behavior, and readiness to merge. |
| + |
| +**STATUS:** |
| +**Request changes: one P2 remains.** |
| + |
| +**P2 — Skipping deep tombstones can strand the subsequent flush** at [restore.go:110](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/hostfiles-cap-live-entries/internal/hostfiles/restore.go:110). When the tombstoned file still exists at the destination, Restore now reports success without removing it. The new regression fixture demonstrates the exact boundary: its parent directory is 4095 bytes, but the remaining file is 4097 bytes. A subsequent scan returns `ErrTooDeep`; [ReleaseFlushFiles.Flush:137](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/hostfiles-cap-live-entries/internal/host/relocationflush.go:137) therefore never commits. Relocation’s `EndProbe` requires that flush before stopping the probe, so retries cannot progress and the deadline ultimately leaves the operation stuck. `Establish` itself succeeds because it copies the manifest without scanning disk. |
| + |
| +The first round-1 P2 is closed. The second fix removes the unbounded tombstone traversal, but leaves this downstream failure. Cap-free `StageDelete` introduces no reader incompatibility: it only replaces an existing entry with an accepted tombstone. A scan encountering a live over-cap path fails before its deletion phase, so it cannot wrongly retire that file. |
| + |
| +No other findings. The census envelope hash matches; the legacy seal is unchanged. This was static review; no tests were run, including the full `internal/host` suite. |
| + |
| +**NEEDED:** |
| +Nothing from you for this review. |
| + |
| +**RECOMMENDED:** |
| +Resolve existing deep tombstones without unbounded traversal, and test restore → scan → commit plus the relocation flush. Not ready to merge after the freeze until that path is addressed. |
| + |
| +**SESSION:** |
| +Safe to close. HEAD and working tree are unchanged; no files or background processes were created. |
| \ No newline at end of file |