carlos / platform Public

PLAN: NOT READY

Reviewed da2832aa against the approved moves spec, claim spec at 98b45332, and these local remote-tracking tips:

| Reference | Tip | |---|---| | origin/main | 01f890ce | | origin/feat/hostclaim-console | 5422d8fc | | origin/feat/hostclaim-box | 2bd3ea1f | | origin/feat/hostclaim-leases | ca5a79d8 |

No files changed, hosts contacted, or tests run. “Resolved” below means the revised plan specifies a satisfactory fix, not that an implementation has passed verification.

Round-1 dispositions:

| R1 | Finding | Disposition | Assessment | |---:|---|---|---| | 1 | MoveLanding collision | Resolved | Journal renamed MoveLandingJournal. A separate collision remains below. | | 2 | Stop-evidence import cycle | Resolved | Moving reconstruction to stopevidence and passing eb.Cgroups removes the identified cycle. | | 3 | Strict-spawn return signature | Resolved | Three results and prepared-handle lifetime are now specified. | | 4 | Stale receipt version | Resolved | Receipt must match current source and destination; otherwise recopy. | | 5 | Unusable staging TTL | Resolved | The 45-minute staging TTL fixes the arithmetic. The proposed real-lease fixture still needs correction. | | 6 | Sign-at-check | Partly | Disabling retries helps, but calling the SDK in the same goroutine does not bind its signature timestamp to the check. An arbitrary pause before SDK signing remains possible. | | 7 | Forbidden move.json recovery read | Partly | GET removed; the replacement pending-intent protocol cannot distinguish an existing foreign object. R2-7 below. | | 8 | Application env collision | Partly | Namespaces fixed. Extract still has no duplicate-destination rejection or corresponding negative test. | | 9 | Target absent from touched | Resolved | First staging write now follows target-region and target-box registration. | | 10 | Empty ETag report writes | Resolved | Mutable reports use read/ETag/CAS replacement. | | 11 | Floor fails open | Partly | Local floor added, but the new door rejects every request. Unknown-floor handling also equates participation with a held registry row, missing preparing participants. | | 12 | Incomplete immutable stop report | Resolved | Complete report follows checkpoint and precedes execution release. | | 13 | Archive publication after archived | Resolved | Publication and seal update now precede advancement. Archive identity replay remains a separate issue. | | 14 | Runner slips past drain | Resolved | Runner claims before its decisive fresh route read. Converger remains outside this handshake. | | 15 | LTX lock page | Resolved | Skip explicitly specified while retaining Commit. | | 16 | Restore over existing scratch | Resolved | Replay removes operation-owned scratch before restoring. | | 17 | Retirement without a chore | Partly | Chore added, but inventory registration does not match the real API’s path/stamp contract. | | 18 | First probe checks source generation | Partly | First landing validation separated. Dirty recovery and subsequent marker handling still do not compose. | | 19 | Claim never reaches commit phase | Partly | Happy-path mirroring added; interrupted record/claim phase writes have no complete catch-up procedure. | | 20 | Declare-lost overrides winning commit | Resolved | Rollback now competes on the record first. Other loss-ordering failures remain below. | | 21 | Loss payload mismatch | Partly | Plan 4 corrects several fields; Plan 6 still omits required account and request_id. Current branch requirements also remain unmet. | | 22 | Recovery cannot consume declaration | Partly | none and loss journal accepted, but actual loss admission and terminal completion still fail. | | 23 | Orphan claims undiscoverable | Resolved | Claim discovery and a distinct orphan-release transition added. | | 24 | Polling misses terminal outcome | Resolved | Operation-bound LastMove is persisted and returned. | | 25 | Probe app launch contract | Resolved | Uses --socket and --db. | | 26 | Unlisted Plan 8b activation dependency | Resolved | Index explicitly names 8b and refuses production activation until it lands. Runbook needs to carry that gate too. | | 27 | Forbidden recovery transitions | Partly | New closures help, but Task 7 still says retry always resumes probing, contradicting Task 1’s verification retry. Loss ordering also invalidates its own legality test. | | 28 | Reverting lacks staging cleanup | Resolved | Producer and target-side dispatcher now specified. | | 29 | MinIO test excluded from CI | Resolved | Explicit host-package invocation and PASS assertion added. | | 30 | Task dependency/order failures | Partly | Paging and CLI heading corrected. Other forward dependencies and premature copy wiring remain. | | 31 | Copy inventory derived from approval rows | Resolved | Independent ID inventory and negative fixtures specified. | | 32 | Clean rehearsal writes before failure | Resolved | Before-write mode explicitly suppresses mutations. |

New findings, including failures introduced by the revisions:

1. P1 — Every move request fails the new completeness check. Plan 1:1054 calls readEdgesSnapshot and then snap.complete(). On main, instancesplacement.go:236 defines that as Complete && BoxesComplete; readEdgesSnapshot:242 never sets BoxesComplete. Every invocation therefore returns incomplete. Use the appropriate complete reader, or explicitly define the narrower evidence check. Test a successful request through the real reader.

1. P1 — Another duplicate Go identifier prevents compilation. Plan 1:449 declares the constant MoveStuck; Plan 4:57 declares the transition function MoveStuck in the same package. Rename one. The revised snippets also retain a two-argument Revert call at Plan 2:365 despite its new five-argument signature.

1. P1 — The real claim store rejects both new park kinds. Plan 2:788 changes Obligation.Kind’s documentation, but does not extend Claim.Validate. Main’s claim.go:266 rejects scopes on either new kind, and :274–288 rejects the kinds themselves. hostclaim.Update always validates before persistence. Consequently revert, commit, abort and retirement CASes fail. Direct closure tests such as Plan 3’s commit test bypass this failure. Extend all relevant validators and exercise real Update/Read round trips.

1. P1 — The dependency graph promises integration the branches do not provide. Index:69 correctly admits the missing startAdmitted entry point, but understates the missing work: hostclaim-box adds adapters without modifying the live activator wake/start path. SelectedTimers also has no ReplaceTimers method. On hostclaim-console, adoptHostRecord and StartClaimRecoveryPass have no production callers; merging it does not cause the promised next-reconcile adoption. Assign explicit integration tasks and prerequisites. Also, Plan 3 Task 8 consumes DeleteIfHold, introduced only by the dependency-blocked Task 7.

1. P1 — Intermediate merges expose unfinished move behavior. Plan 1:584 deletes working cut tests and turns the cut into a no-op, while Task 14 still automatically enters cutting. Its interim abort clears the record without releasing the new move claim. Plan 2 then enables stopping/flipping before recovery and probing exist. There is no deployment feature gate covering these partially implemented mutations. “Dormant release” and withholding production rollout do not make each advertised merge independently shippable. Keep incomplete entry points explicitly disabled until their completion and recovery paths exist.

1. P1 — Return-lane writes omit the staging lease and signing contract. Plan 4:106 writes snapshots, archives, timers and move.json through PutVersioned/CopyVersion, without acquiring the source-region staging-work lease or applying the guarded signing path. The moves spec explicitly applies the forward lane’s exclusion and horizon rules to the return lane. Specify that adapter and persist its actual bound before publishing the return seal; test a paused return writer against cleanup. This is additional to unresolved R1-6.

1. P1 — Writing pending before PUT defeats the foreign-lane refusal. Plan 1:2946 always records pending before PutIfAbsent. Thus an already-existing object with no prior ledger becomes indistinguishable from a successful earlier PUT whose response was lost. The “ErrExists with no ledger” branch is unreachable in that sequence. Even retaining the pre-call state cannot resolve a crash immediately after intent persistence. Use target-owned identity validation before accepting the lane, and test that exact crash with a foreign object already present.

1. P1 — The revised local inventory step cannot retire an earlier installation correctly. Plan 2:812 activates stamp F, then calls RecordInventory with database/files/env paths before retiring the previous stamp. Main’s park/local.go requires paths relative to DataDir, tags them with the captured stamp, and rejects an existing path tagged with another stamp. Absolute paths fail immediately; registering old files under F either conflicts or makes RetireArtifacts(previousStamp) select nothing. Preserve the old inventory/stamp for retirement, then register installed artifacts under F. Include .gen and other required artifacts explicitly.

1. P1 — Landing holds the lease that its park engine must acquire. Plan 2:812 retains OwnLease(holder.location) through published; the next phase calls Park.Run for that location. Main’s park/remote.go:404 independently acquires that same lease. A landing with earlier remote residue cannot pass parking. Define lease ownership transfer/reuse, or acquire the build lease after retirement. The fake lease harness must reject a second acquisition.

1. P1 — A landing’s whole-location park cannot finish after the new generation becomes live. Plan 2:813 advances after Parked, leaving acknowledgement pending until the horizon, then builds and serves in the same location. On later verification, main’s park engine lists the new generation and marker; selected at remote.go:346 refuses protected live objects for a whole-location park. The old obligation therefore blocks finalization. Define how this retirement distinguishes earlier residue from the newly authoritative generation without weakening live-data protection, and test acknowledgement after the probe publishes.

1. P1 — Record/claim phase mirroring still wedges at interrupted writes. Plan 2:811 handles a claim already ahead, but not one behind: crash after record parking, before claim checking → parking; the next record step expects the claim at parking, and fails against checking. The console pass handles flip/commit/rollback halves, not these intermediate phases. A similar cut window exists at Plan 2:714: replay after successful ExecToNone calls a closure that rejects already-empty execution. Specify catch-up/idempotency before further work and test each half-write boundary.

1. P1 — Source finalization can permanently lose its completion stamp. Plan 3:358 requires the source row still to carry this hold. It deletes that row at line 361 and writes SourceParkedAt afterward. A crash between them makes the next pass fail its entry condition forever, leaving the close blocked. Replay must recognize its own completed deletion using durable operation state while still refusing a replacement row.

1. P1 — Dirty-return probes reject their prepared generation before admission. Plan 3:309 requires every recovery probe’s local markers to name observed holder.generation. A dirty return has installed rb_… markers, while ReturnToSource(clean=false) deliberately retains the target’s generation until admission. The probe refuses its own valid input. Separate prepared recovery from recovery into the source’s existing generation, and distinguish claim operation ID, hold ID and prepared generation ID.

1. P1 — The probe never enforces the actual launch-input pin. Plan 3:307 renders current configuration, then validates markers and admits. No step compares the newly rendered input versions and actual spawn environment with move.inputs. The comparison in Plan 2’s configured phase is earlier and can become stale. A bundle change or agent restart between configured and probing can therefore run different inputs and still commit. Enforce §7.7’s check at spawn; recovery must record its current inputs separately.

1. P1 — Declare-lost rewrites the state its own legality check requires. Plan 4:194 first sets the target to released, Dirty=false; line 190’s owner accepts restoring targets in releasing or returning, so validation against the resulting record refuses. Retaining an old record would conceal a different problem: a previously released dirty target now looks like an ordinary clean return before the loss claim is committed. Persist a distinct loss decision that ordinary recovery cannot consume until the corresponding durable declaration is complete.

1. P1 — The loss flow still cannot pass the real Plan 8 admission API. Plan 4:195 creates a prepared record without WriteSources and never advances it to committed with ResultClaimGen. On hostclaim-leases, lost.go:119 requires committed state; :149–191 requires exact frozen sources and validated baselines. The plan also puts every target session in AdditionalWritesLost, duplicating the latest predecessor already represented by primary WritesLost. Local chore discharge additionally needs exact DestroyedStorage attestations, which the proposed payload omits. Port the branch’s real declaration/handover/admission sequence, including crashes, instead of stopping the test at DeclareLost.

1. P1 — The destroyed-local-only loss case performs unrelated regional retirement. Plan 4:196 unconditionally queues a target-region whole-location park and covers predecessors after declaration. Case (c) is explicitly legal after commit because it should discharge only local chores and change no data authority. Give it a separate consequence path; assert that holder authority, regional chores and coverage remain unchanged.

1. P1 — Declared-lost rollback still waits for a stamp only the lost box writes. Plan 4:131 requires TargetParkedAt to close. Its only producer is the target’s cleaning phase at line 107. Task 10 removes that box from participation and requires it to refuse move work; no surviving actor completes the corresponding record state. Define terminal accounting for discharged local work and surviving regional cleanup, then test through LastMove, not merely source re-admission.

1. P2 — The readiness window starts before restore, contrary to the specified budget. Plan 3:331 records Opened=now before ProbeWake, which then renders, admits, purges and restores. The spec starts the 30-second window at the first app start and prices restore separately. Large restores consume or exhaust the readiness allowance before the app runs. Persist admission/attempt accounting separately from the first-start timestamp; include restore delay in the test.

1. P2 — Randomized archive sealing defeats the promised replay identity. Plan 2:716 replays Build + Seal from the top and claims create-only PUT returns the same object. Seal generates a fresh key and ciphertext, so files-<sealed> is a different key every time. Persist the chosen archive identity, manifest and sealed key before publication, then reuse those bytes. Test a crash after each PUT using the real randomized sealer.

1. P2 — Timer convergence can still write after the snapshot barrier. Plan 2:738 drains runner claims but only checks Frozen on entry to convergeHost. Main explicitly runs convergence from overlapping agent loops. A converger paused after its check can resume and upsert/delete/fire timers after the cut snapshots them; Runner.Busy does not cover it. Include convergence in the freeze/drain protocol and test that interleaving.

1. P2 — T11 admits moves using example rates rather than measured rates. Plan 1:2559 defaults missing CARLOS_MOVE_RATES to ExampleRates. The approved T11 requirement is explicitly based on measured cross-region, regional-storage and disk rates. No measurement producer or freshness requirement is planned. Require usable measurements before passing T11; missing measurements must not silently become the worked example.

1. P2 — Log sequencing and deduplication do not provide the claimed guarantees. Plan 6:79 assumes writers choosing the same sequence collide, but keys contain both sequence and event name: two different events at sequence N both succeed. Deduplicating by event name also suppresses legitimate repeated probe_attempt, stuck and retry occurrences. Use durable transition/attempt identities and test concurrent writers plus repeated occurrences.

1. P2 — Copy approval and several concrete APIs still arrive after their consumers. Plan 1:2975 asks the new gate to become green although Task 4 already writes strings whose record remains pending. Approval must precede those implementation tasks. Separately, Task 4 uses moves.ProtocolVersion before Task 12 defines it; Task 11 uses Task 14’s harness. leasetest.LocalStore at line 1363 does not exist on main, and inline hostguard.Capture(...) calls ignore its (Captured,error) signature. Replace placeholders with actual setup and move prerequisites before the per-task commit gates.

1. P2 — The rehearsal’s declared prerequisites cannot execute its loss run. Plan 7:79 lists rollout, grants, floor and adoption, but not claim Plan 8b’s activation prerequisites. Run 4 then invokes a door that Plan 4 explicitly refuses outside tests until 8b. Add that prerequisite and the real adoption integration; merging the three named branches alone does not satisfy either.

The approved design can remain intact, but the remaining work is not entirely local. Several fixes are small edits; admission, loss recovery, retirement and activation require coordinated contracts across the moves plans and claim integration work. The series needs another revision before implementation can safely proceed.

---

FIRST PROMPT: Read-only round-2 review of the moves Phase 1 plans at da2832aa.

WHAT: Check round-1 fixes, new defects and build readiness.

STATUS: Review complete. PLAN: NOT READY. Repository unchanged.

NEEDED: Nothing for this review.

RECOMMENDED: Revise the blocked interfaces and recovery sequences, then review the updated series.

SESSION: Safe to close. Nothing running; no handoff file written.