amadan
Astra stage B plan round 4: unedited
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 file changed,
+49
−0
docs/superpowers/plans/CODEX-PLAN-REGION-HA-STAGE-B-R4.md+49 −0
diff --git a/docs/superpowers/plans/CODEX-PLAN-REGION-HA-STAGE-B-R4.md b/docs/superpowers/plans/CODEX-PLAN-REGION-HA-STAGE-B-R4.md| new file mode 100644 |
| index 000000000..9dc8c46a5 |
| --- /dev/null |
| +++ b/docs/superpowers/plans/CODEX-PLAN-REGION-HA-STAGE-B-R4.md |
| @@ -0,0 +1,49 @@ |
| +Reviewed plan rev 4.1 at `9f7fae68`. Branch HEAD `785bc156` adds only brief 4. |
| + |
| +1. **P1 — A transient C10 read failure can still break restart recovery.** [Plan:215](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-1b-next-build/docs/superpowers/plans/2026-10-10-region-ha-1b-next-stage-b.md:215) |
| + |
| + `completedRelocationDischarge` returns `(false, nil)` when its claim read fails. The caller at line 271 then runs ordinary cleanup. |
| + |
| + After a restart between the serving CAS and participation discharge, `clearUntracked` supplies the current serving observation. If only C10’s reread fails, ordinary cleanup finds the stopped probe’s retained launch record and requests a serving-shaped stop. Root’s `BeginFence` replaces the completed probe’s active fence **before** recovery verification. |
| + |
| + N6 still supplies the original probe receipt. [`BeginColdHandover`:42](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-1b-next-build/internal/hostguard/coldhandover.go:42) rejects the replacement fence, preventing the first serving wake even after storage recovers. |
| + |
| + Propagate the read error without falling through. Because the caller currently checks only `done`, return `(true, err)` or make the caller stop on any error. Add a restart test that fails only C10’s reread once, asserts no replacement fence, then verifies discharge and serving handover on retry. |
| + |
| +The round-3 dispositions are: |
| + |
| +| Finding | Assessment | |
| +|---|---| |
| +| 1: key evidence | Closed. The O2′ diff and 17-case test match instance-key rev 3 exactly. | |
| +| 2: admission before discharge | Closed for the checked paths. Discharge precedes hold release and fence removal. | |
| +| 3: restart cleanup | Partially closed; the read-error path above remains broken. | |
| +| 4: passed-probe stop deadline | Closed by `Probe.At` and the bounded `stuck` outcome. | |
| +| 5: deleted env entries | Closed in install and repairing `EnsureLocal`. | |
| + |
| +Ruling 66’s admission assumption holds for scheduled delivery, the due-wake sweep and the timer runner. The planned `relocating` hold blocks them; after restart, the persisted hold remains effective without the in-memory fence. |
| + |
| +The post-render key check is acceptable: failure precedes the install receipt and probe, preserves the hold, and reaches bounded `stuck` through the installed-phase deadline. |
| + |
| +**Verdict: not ready to build.** Fix the C10 read-error path first. |
| + |
| +Static review only. No files changed or tests run; the compile record does not establish execution of the specified new recovery scenarios. |
| + |
| +--- |
| + |
| +**FIRST PROMPT:** |
| +Review plan rev 4.1 at `9f7fae68`, following brief 4. |
| + |
| +**WHAT:** |
| +Check round-3 closure, admission, restart recovery and key verification. |
| + |
| +**STATUS:** |
| +Review complete: one P1 remains. |
| + |
| +**NEEDED:** |
| +Nothing. |
| + |
| +**RECOMMENDED:** |
| +Stop cleanup on C10 read errors and add the transient-failure restart test. |
| + |
| +**SESSION:** |
| +Safe to close. No processes remain running; no handoff file written in this read-only workspace. |
| \ No newline at end of file |