carlos / platform Public

REJECT

1. High — Task 5: intent cleanup can erase an unrecorded failure. A failed wake deletes its activator entry before delivering OnGen (internal/activator/activator.go:1453, :1549). Owns checks only that entry (:2068), so dropUnownedWakes can run between deletion and failure delivery (internal/rollout/manager.go:638). Adding End there allows: hold B executes and fails → entry disappears → intent is durably removed → agent crashes before recording B. F5 survives. Smallest plan fix: require token-specific proof of no execution or completed outcome delivery before ending an orphaned intent. Do not equate !Owns with an outcome. Also handle the successful “B untried, good build booted” GenHealthy path (internal/activator/wakeplan.go:667), which has no later terminal event to close B’s intent.

1. High — Task 5: the persisted mode can differ from the executed mode. resolve selects mode from policy/demand (internal/rollout/manager.go:852), but Swap converts foreign-layout overlap attempts into holds (internal/activator/swap.go:264). An intent written before Swap therefore records overlap; a crash after the foreign hold executes reconstructs neither hold-down nor marker. Automatic fallback becomes possible. Smallest plan fix: persist the effective execution mode before any stop or launch, including layout overrides. Add a foreign-layout hold crash/reopen regression.

1. High — Task 4: ignoring a stale book write does not prevent a stale cohort halt. failCohort calls q.halt unconditionally after Record (internal/rollout/queue.go:497). Thus a delayed pre-retry failure can be ignored by the proposed book guard but still halt the newly reopened cohort and supersede its attempts. The book-only tests miss this. Smallest plan fix: return a distinct stale-outcome disposition and suppress the entire failure transition for it. Test through done and OnGen, asserting queue admission and running-attempt revisions remain unchanged after retry.

1. High — Task 4: preserving the first sequence for repeated executions of the same hold build leaves N6 open. The plan explicitly preserves Seq/At when account/app/build match. Current marking identifies only that triple (internal/rollout/failures.go:199); good publication clears later (internal/rollout/manager.go:979). Sequence: an existing B marker precedes C’s snapshot; B executes again while C’s publication is delayed; re-marking B preserves its old sequence; C clears the restriction protecting B’s newer execution. Smallest plan fix: identify executions separately from builds. Refresh the marker epoch for each distinct execution while deduplicating repeated reports of the same execution. Extend N6’s regression accordingly.

1. High — Tasks 8–10: the promised recovery cannot be requested through the supported door. Declined status publishes no host holds (internal/host/rollout.go:481), and retryHostBuild rejects every unavailable report (internal/console/apiretry.go:50). Marker-only declined hosts therefore cannot obtain the signed retry Task 9 requires. There is also an armed mismatch: status can report marker B while the installed target is A (internal/rollout/status.go:84); the console signs B, but Task 8’s proposed wantBuild check requires A. Smallest plan fix: specify declined hold reporting and permit authenticated retries for those holds; distinguish the restricted execution/build from the requested recovery target. Add API-to-box tests for both sequences. The declined-recovery ruling is agree with conditions, not implementable as written.

1. High — Task 9: the exec gate misses nested and claims-backed declined launches. Nested starts call runExecGate, not launchGate (internal/activator/backend_exec.go:1682). Claimed wakes check the declined planner before preparation (internal/activator/claimwake.go:214), then obtain the executable from the live link (internal/activator/claim_snapshot.go:87). Neither receives Task 9’s new final gate. A repoint after planning can still select a held build. Smallest plan fix: enumerate and gate all declined launch mechanisms against the actual selected identity. Resolve, or explicitly retain as an enablement blocker, the acknowledged flat live-link read/exec race. Accepting claims-on decline does not waive enforcement of inherited failure restrictions.

1. High — Task 3: rollback provenance is checked at planning but remains bypassable at execution. The proposed planCheck change updates only the marked-build arm. Its existing good-build arm permits execution whenever the captured route installs its good build (internal/rollout/wakeplan.go:317). A marker established or replaced after planning is therefore not checked against the rollback authorization. Smallest plan fix: capture verified rollback authorization tied to the marker’s identity/epoch, and require that same authorization at the final gate without performing store I/O there. N5/N7’s proposed selection changes are sound; ruling 205 needs this execution-time condition.

1. High — Tasks 2 and 17: missing-record handling and deferred status defects remain incomplete. Task 2 preserves an absent host’s existing mode. If it previously entered modeURL, polling continues because the loop checks only mode and urlLive (deploywatch.go:317), ignoring unread. Separately, the deferred status issue is a real flag-on defect: waking/stopping hosts retain old queue observations (internal/rollout/manager.go:347, :372), while status derives Awake solely from cached serving (internal/rollout/status.go:49). A waking host can appear asleep before its settle is registered. Spec §9.1’s genuine-sleeper exception does not justify that. Smallest plan fix: suspend URL polling while the target is unreadable and test prior-URL-to-missing transitions. Carry explicit waking/stopping state into completion, or retain this as an enablement blocker.

1. High — Task 6: classifying an uncertain exit is insufficient to authorize fallback. Nested start errors can wrap both the proposed exited sentinel and failed termination proof (internal/activator/backend_exec.go:1709). spawnPlanned currently refuses fallback when proc == nil (internal/activator/wakeplan.go:393). The task requires fallback for the sentinel without specifying how to distinguish successful cleanup from an unproven live generation. Smallest plan fix: carry explicit termination evidence. Permit nil-process fallback only after proven cleanup; otherwise record the failure and retain containment. Test both cleanup outcomes. The hold-failure classification itself is sound.

1. Medium — Tasks 11 and 13: specify safe publication ordering, not just the intended result. Task 13’s insertion point is inside a.mu (internal/activator/swaphold.go:107), but persistGenerations takes genMu then a.mu (internal/activator/generations_file.go:238). An inline implementation deadlocks. Task 11’s FIFO writer likewise does not establish activation order when callbacks are submitted after releasing m.mu (internal/rollout/wakeplan.go:445). Smallest plan fix: prescribe hold publication outside a.mu, followed by reacquisition and full admission revalidation before stopping. Sequence acknowledgement jobs at the state transition, with nonblocking submission and defined cancellation/join behavior.

1. Medium — Tasks 11 and 13 contradict the flag-off constraint. configAckFunc also serves ordinary flag-off sync (internal/host/agent.go:1152); imposing its new timeout changes that behavior. Bucket retention is unconditional (internal/host/retention.go:26), so adding GoodVersion pins changes deletion eligibility even after disabling swaps. Task 15 is not the only exception. Smallest plan fix: explicitly authorize these exceptions or scope the new behavior to flag-on operation. Do not claim every added behavior is controlled by an armed/declined hook.

1. Medium — Task 14: an existing generation directory does not prove the parent is safe. The proposed test deliberately permits parent PIDs when g1 exists. An empty leftover g1 does not move legacy processes out of the parent. Current ensureParent merely returns when populated, and StartChildGated proceeds (internal/cgroup/gen.go:133, :168). Smallest plan fix: refuse direct parent processes regardless of child-directory existence; distinguish direct membership from descendant population. Propagate the refusal through StartChildGated, and test a populated parent with an empty stale generation directory.

1. Medium — Tasks 8 and 17: the signing ruling needs a stronger recovery identity. Root signing correctly closes unsigned forgery, but the proposed grant names only the build, with an in-memory replay watermark. The underlying retry clears the current restriction (internal/rollout/manager.go:533, :539). After restart, a captured grant can clear a later failure of that same build. The ruling acknowledges this exposure; that is not closure of failure-specific authorization. Smallest plan fix: bind grants to a persisted restriction/retry epoch and persist consumption, or explicitly retain the replay limitation as an unresolved security decision. I agree with conditions on signing, conservative unresolved-intent reconciliation, and schema-2 refusal; the current reader really rejects unknown schemas (internal/rollout/failures.go:118). I agree with the owner’s claims exclusion and decline interpretation. I disagree with categorizing all remaining status work as non-defects. Coverage-only items, simulation replay, and real-box evidence may remain deferred, explicitly retaining their gate obligations.

1. Low — Tasks 1–3, 14 and 17: correct task-local examples and copy instructions. overlapEnv takes a string, so overlapEnv(nil) is invalid (internal/host/rollout_test.go:58). DirStore.Put returns two values (internal/release/store.go:402). putTestRecord is absent; TestListRecords seeds through CreateRecord (internal/provision/provision_test.go:413). Task 3’s “signed” harness pointer is an unsigned fixture (internal/rollout/fake_test.go:352), and the proposed book clock must explicitly use h.clock. ensureParent currently returns nothing, requiring a signature/caller change (internal/cgroup/gen.go:127, :168). Smallest plan fix: replace placeholders with exact helpers/signatures and separate mocked pointer tests from signature verification. Add TODO-COPY markers wherever new errors can reach members; planned wake errors can pass through directly (internal/rollout/wakeplan.go:304). Reusing HeldDownRefusal also needs correction where rollback is deliberately refused: its approved text promises rollback recovery (:47).

Read-only review of e61b858e; no files changed and no tests run.