carlos / platform Public

Astra review P5 of the zero-downtime plans (REJECT: 5 partial, 4 new)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude 2 weeks ago b027eef35da95d298684983cc7d062299bb3951f parent 90b2076

1 file changed, +19 −0

docs/superpowers/plans/CODEX-FINDINGS-ZDD-PLANS-P5.md +19 −0

CI passed — run details

diff --git a/docs/superpowers/plans/CODEX-FINDINGS-ZDD-PLANS-P5.md b/docs/superpowers/plans/CODEX-FINDINGS-ZDD-PLANS-P5.md

new file mode 100644

index 000000000..c77fd24b9

--- /dev/null

+++ b/docs/superpowers/plans/CODEX-FINDINGS-ZDD-PLANS-P5.md

@@ -0,0 +1,19 @@

+REJECT

+P4 partial P1 #1: **PARTIAL** — `stop()` skips `genTerminated` when the leader remains alive after a claims kill error.

+P4 partial P1 #6: **PARTIAL** — pointer capture is fixed; `GenFellBack` still performs serving/config writes before publishing the failure hold.

+P4 partial P2 #3: **PARTIAL** — `straySidecars` retains processes, but stop completion does not retain their lease.

+P4 partial P2 #4: **CLOSED** — claims-on holds and successors now repeat the execution gate after preparation.

+P4 partial P3 #3: **CLOSED** — `startAdmitted` classifies cancellation before recording failure or falling back.

+P4 #1: **PARTIAL** — nil-`stopOld` respawns bypass proof; `KillHost` wrongly exempts nested workers; failed worker wakes lack `Gen.Worker`.

+P4 #2: **CLOSED** — config activation precedes slot release and no longer depends on the event-reporting read.

+P4 #3: **PARTIAL** — flag-off publication exists, but the new callback can restore an obsolete serving version; finding 4 below.

+P4 #4: **CLOSED** — `waitServingGen` now leads through the normal generation-bound transport and attribution.

+1. **P1 — Plan 5, Task 11: a refused worker gate still permits execution after lease loss.** The [refusal branch](/home/paulca/amadan.net/carlos/platform-design-zero-downtime-deploys/docs/superpowers/plans/2026-10-07-zero-downtime-deploys-5-scheduler.md:6816) converts every gate error into `onto = e.attemptRestore`, leaving `wanted` true. The shared gate explicitly returns `errSwapLeaseLost` and fence errors. Consequently, after retiring the incumbent, a replacement that discovers it no longer owns the host still executes the previous build against its database. This violates **§7.4**. **Smallest fix:** ownership, fence and shutdown refusals must prevent every spawn. Restore after supersession only through fresh ownership checks at the execution boundary.

+2. **P1 — Plan 3, Task 10 / Plan 2, Task 3: strict-parent cleanup invokes a child-only method.** [`closeEntryParent`](/home/paulca/amadan.net/carlos/platform-design-zero-downtime-deploys/docs/superpowers/plans/2026-10-07-zero-downtime-deploys-3-swap.md:7233) clears the stored parent and calls `CloseRemove`. [Plan 2’s implementation](/home/paulca/amadan.net/carlos/platform-design-zero-downtime-deploys/docs/superpowers/plans/2026-10-07-zero-downtime-deploys-2-containment.md:1594) rejects a handle with `p.parent == nil` before releasing its descriptors or reservation. Every normal claimed stop therefore leaks the parent reservation; the next wake is rejected by the [existing reservation check](/home/paulca/amadan.net/carlos/platform-design-zero-downtime-deploys/internal/cgroup/strict_linux.go:199). This breaks the parent lifecycle required by **§§7.3–7.4**. **Smallest fix:** use `Close` for the empty parent and retain its handle if closing fails.

+3. **P2 — Plan 3, Tasks 4/10: final claims validation failures are classified as build failures.** After Step 3a succeeds, `spawnClaimedGen` enters another `Work.With`. That validation can reject a changed stamp or durable fence with [`hostguard.ErrStampMismatch` or `ErrFenced`](/home/paulca/amadan.net/carlos/platform-design-zero-downtime-deploys/internal/hostguard/guard.go:141). `startClaimedSuccessor` returns the raw error, but [`classifyStep`](/home/paulca/amadan.net/carlos/platform-design-zero-downtime-deploys/docs/superpowers/plans/2026-10-07-zero-downtime-deploys-3-swap.md:3087) recognizes neither error. The attempt becomes `SwapFailed` and halts the cohort although nothing executed. **§7.4** requires abandonment when claims validation fails. **Smallest fix:** distinguish admission refusals from executable failures at the claimed-spawn boundary and classify them as abandonment.

+4. **P2 — Plan 5, Tasks 11/14: `OnWorkerServing` introduces unordered serving-version writes.** The [new callback](/home/paulca/amadan.net/carlos/platform-design-zero-downtime-deploys/docs/superpowers/plans/2026-10-07-zero-downtime-deploys-5-scheduler.md:7065) runs after the respawn unlocks and clears `workerRespawning`; its [agent handler](/home/paulca/amadan.net/carlos/platform-design-zero-downtime-deploys/docs/superpowers/plans/2026-10-07-zero-downtime-deploys-5-scheduler.md:8540) unconditionally writes `ServingVersion`. With the flag off, A’s publication can pause while subsequent convergence installs and publishes B, then resume and overwrite B with A indefinitely. Plan 6 displays that obsolete value, violating **§7.9**. **Smallest fix:** serialize publication with incarnation installation, or use an incarnation-aware conditional write that rejects older publications.

\ No newline at end of file