carlos / platform Public

ACCEPT

Reviewed 37ffe34b..4a134a2b against spec rev 17, the round-2 findings, ledger, and fix-wave-2 report. Read-only: no builds, tests, or mutants rerun. The worktree is clean; git diff --check passes.

• R2-1 — ADDRESSED. Before calling the refused child’s Stop, cleanup transfers its process and build identity to e.shed under a.mu (activator.go:2571). The generations snapshot includes that identity (generations_file.go:114). Both the terminal-stop path and pending-stop sweep refuse completion while the respawn remains in flight or its shed child remains retained (activator.go:2957, activator.go:3032). Neither original sequence—failed shed Stop or Stop blocked beyond the respawn wait—can now close replication, delete the entry, or drop the replacement’s pin prematurely.

• R2-2 — ADDRESSED. Retry registration and the transition to stopping share a.mu; retries require the entry still to be current and awake (opset.go:379). The barrier joins restoreDone, and pending cleanup independently refuses release while restoring remains true (opset.go:125, opset.go:473). Thus a paused old retry prevents entry replacement until its backend write finishes; it cannot resume inside a later entry’s overlap.

New breakage: none found in the fix diff.

The indefinitely blocked shed Stop is acceptable fail-closed behaviour within this scope. Its cleanup operation has not finished, so releasing the entry on a timer would recreate the ownership escape. The reaper deliberately waits for that operation before taking over (activator.go:3104). A Stop that returns without proving exit remains retryable; a Stop that never returns leaves the host unavailable. This change provides safety, not recovery from an indefinitely wedged backend.

Lock discipline is sound: Stop calls, parent writes, channel waits, and generations-file persistence run outside a.mu; ownership transfers and retry registration run under it. Clearing restoring before closing its completion channel is safe because the backend write has already returned.

The R2-1 flag-off changes are necessary corrections to worker cleanup. R2-2 adds no flag-off parent-write path. The supplied regression tests cover both original sequences; the report records passing focused race checks, the 3,000-seed sweep, and nine caught mutants.

Out-of-scope observations: the previously deferred F6 descendant-proof limitation remains unchanged. No additional observations to park.