| 1 | # Review brief: region HA plan 1b-next, round 17 |
| 2 | |
| 3 | You are an independent second reader. This is round 17: first give a disposition table for each round 16 verdict in docs/superpowers/plans/CODEX-PLAN-REGION-HA-1BN-R16.md and the "Rev 17: two-box model findings" table (resolved, partly, or not), judged against the plan's "Rev 17: two-box model findings" table, then report only NEW findings. Review the implementation plan |
| 4 | `docs/superpowers/plans/2026-10-07-region-ha-1b-next-relocation.md` at the |
| 5 | commit named in the prompt, against the tree at the working directory |
| 6 | (Go, module github.com/carlosframework/platform, main at 3407d114, which |
| 7 | holds claim Plans 1-8b and 5) and these authorities: |
| 8 | |
| 9 | - region HA spec `docs/superpowers/specs/2026-10-04-region-ha-box-placement-design.md` |
| 10 | (rev 5.4 plus §24; rulings H1-H19 in §0; L1-L20 in §9, all accepted); |
| 11 | - claim spec rev 6.30: `git show origin/design-replica-ownership:docs/superpowers/specs/2026-10-02-host-lifecycle-claim-design.md`; |
| 12 | - claim Plan 6b (not merged): `git show origin/design-replica-ownership:docs/superpowers/plans/2026-10-06-host-lifecycle-claim-6b-box-assembly.md`; |
| 13 | - moves spec on origin/design-moves-any-region (rev 7.22); |
| 14 | - contracts note `docs/superpowers/notes/2026-10-07-region-ha-contracts.md`. |
| 15 | |
| 16 | ## Fixed: do not re-argue |
| 17 | |
| 18 | - Rulings H1-H19, Paul's approval of spec rev 5.4, and claim rev 6.30's |
| 19 | adoption of L1-L20. |
| 20 | - One implementation per concept, and main's wins: the termination fence is |
| 21 | written only by `internal/hostfence.TerminationWorker`; the roster is read |
| 22 | only through `internal/hostactors.Directory`. 1b-next must not add a |
| 23 | second writer or reader. |
| 24 | - The two-box joint model (L18) is a separate piece of work. This plan only |
| 25 | gates the merge of relocation on it. Do not ask this plan to write it. |
| 26 | - Tasks 8-10 are marked as gated on unmerged code (6b, moves Plan 2, claim |
| 27 | Plan 5's app gate). They were not compiled. Review them against the |
| 28 | interfaces those plans declare, not against main. |
| 29 | - Everything stays dormant behind CARLOS_REGION_HA. |
| 30 | |
| 31 | ## What to check |
| 32 | |
| 33 | 1. Tasks 1-7 compile and their tests pass as written. They were dry-run on |
| 34 | a clean 3407d114. A "would not compile" finding quotes the line and |
| 35 | names exactly what is undefined. |
| 36 | 2. Each test pins what its name claims and fails with its mechanism removed. |
| 37 | 3. Correctness against the claim spec: the `relocating` transitions; the |
| 38 | fence-consuming CASes; `released` coverage (L9); the L11 start guard; |
| 39 | stop evidence (L10); drain versus failover release; R6 (no warm reuse of |
| 40 | a local DB); prepared generations and AdmitWriter; executor choice (H4, |
| 41 | with the SHA-256 tie-break recorded in the create intent); the §5.3 row |
| 42 | cases; the pin object; `stuck` handling. |
| 43 | 4. Races: a crash or a lost response at every step of the worker and |
| 44 | participants; two workers; a box terminated mid-relocation (nested |
| 45 | failover); a stale edges file; a late PUT after termination. |
| 46 | 5. Dormancy: anything that changes behaviour with CARLOS_REGION_HA off, or |
| 47 | on a one-box region. |
| 48 | 6. Task boundaries and the gated tasks' interface assumptions against 6b's |
| 49 | and Plan 5's declared interfaces. |
| 50 | 7. The author's rulings (in the plan): accept each one, or say why it is wrong. |
| 51 | |
| 52 | ## Output |
| 53 | |
| 54 | Findings ranked P1 (would not compile, a test fails, or unsafe), P2 (wrong |
| 55 | or missing), P3 (clarity). Each gives the task and step, the problem, the |
| 56 | evidence (file:line, or the plan's own line), and a concrete fix. End with a |
| 57 | verdict: ready to build, or not ready. |
| 58 | |
| 59 | ## Round 2 notes |
| 60 | |
| 61 | - Rev 2 adds rulings 14-18 and a "Requests to the claim and moves |
| 62 | sessions" section (R1-R7). A request listed there is the right answer |
| 63 | for a missing upstream interface; judge whether each one is necessary and |
| 64 | sufficient, not whether the plan should have invented it. |
| 65 | - The un-gated tasks are now 1-7; the gated ones are 8a, 8b, 8c, 9 and 10. |
| 66 | - Rev 3 adds rulings 19-22. R3 now has an agent half and a root half; R5 |
| 67 | names the complete retained consequences. |
| 68 | - Rev 4 adds ruling 23 and request R8 (a 6b insertion point between |
| 69 | OpenProductionClaimAssembly and Build). |
| 70 | |
| 71 | ## Round 5: two-stage scope (controller ruling 24, fixed) |
| 72 | |
| 73 | Claim Plan 6b is unmerged and still changing, so the plan is split: |
| 74 | |
| 75 | - **Stage A** (Tasks 1-7 and 9a) is to be built now. Judge it fully: it must |
| 76 | compile on main, its tests must pin their claims, and it must be correct |
| 77 | and dormant. Its findings decide "ready to build". |
| 78 | - **Stage B** (8a, 8b, 8c, 9, 10) keeps design and contracts only. Its code |
| 79 | is rewritten against 6b's real code after 6b merges, and reviewed again |
| 80 | then. Judge stage B only on its contracts: is each obligation stated, |
| 81 | is it assigned to this plan or to a named upstream request (R1-R9), and |
| 82 | is it backed by a named test? Do not report compile-level or |
| 83 | line-level defects in stage B code. Do check that the "Stage B re-plan" |
| 84 | step carries every stage B obligation from rounds 1-16. |
| 85 | |
| 86 | Verdict: "stage A ready to build" (with stage B contracts complete), or |
| 87 | not ready. |
| 88 | |
| 89 | ## Round 14 note |
| 90 | |
| 91 | Rev 14 adds a seeded property test over the real hostexec controllers |
| 92 | (Task 7), asserting five lifecycle invariants after every step. Judge |
| 93 | whether its event set and invariants cover the controller lifecycle |
| 94 | (acknowledge, lease loss, recovery, finish, sweep, successor handover, |
| 95 | restart). A controller interleaving it could not generate is a finding |
| 96 | against the test, not only against the code. |
| 97 | |
| 98 | ## Round 17: findings from the two-box joint model |
| 99 | |
| 100 | After round 16 accepted rev 16, the two-box joint model |
| 101 | (`git show origin/region-ha-hostlife-two-box:docs/superpowers/plans/2026-10-07-region-ha-hostlife-two-box.md`, |
| 102 | findings F1-F3, model rulings 14, 16, 17) reproduced three gaps. Rev 17 |
| 103 | answers them with rulings 25 (F2, empty pin needs positive evidence), 26 |
| 104 | (F1, failed probe with no spare goes stuck) and 27 (F3, unopened P parked |
| 105 | at completion). Judge whether each ruling closes its gap without opening |
| 106 | another, and say plainly if a ruling hides something the spec should fix |
| 107 | instead (especially 25's window between the app minting instance.key and |
| 108 | its first manifest, and 26's leaving a drained host unserved). |
| 109 | |
amadan