carlos / platform Public

Reviewed eb5e9051. Below, P means the implementation plan. The embedded patches pass git apply --check. I could not reproduce compilation or test execution in this read-only sandbox.

1. P1 — Task 8, Step 3: several dependencies are absent from the declared upstream interfaces. moves.SealedObject{… Level: …, MinTXID: …, MaxTXID: …} at P:5054 does not match moves Plan 2’s declared {Key, VersionID, Size}. Now: a.now at P:5057 references no field or method in 6b’s ClaimAssembly. att.writersInputs, withRelocationInstall, relocationInstallJournal, materializeHeld, ProbeAdmission and moves.ReadInstallManifest are also not supplied by the cited plans. In particular, 6b explicitly refuses probes in ClaimWakeAssembly.Build. Fix: make the missing adapters explicit implementation tasks, use the actual shared types, and name the additional probe integration dependency. These are not merely names to bind after 6b merges.

1. P1 — Tasks 5 and 8: pinning and remote construction omit the required leases and guarded authority. StorePinner.Pin selects and creates its pin without acquiring the location lease (P:3947–3987). relocationBuild calls the builder and CopyManifest directly, without activating/capturing the installation, checking fresh phase authority under the host guard, or holding the replica lease (P:5031–5062). The moves builder’s declared contract does not acquire that lease for callers. This leaves pin selection exposed to retirement and lets delayed installation work continue after authority changes. Fix: implement the lease and captured-authority boundaries explicitly, including protection through pin publication. Add parking-versus-pinning and delayed-build-after-phase-change tests.

1. P1 — Task 8, Step 3: release does not flush the final wake state or environment. relocationFlushFiles calls only hostfiles.Publish (P:5019–5024). That function expressly excludes platform items (internal/hostfiles/contract.go:119), including wake state and the environment. A drain can therefore claim released coverage while restoring old timer bookkeeping or omitting recent registrations. Fix: export and stage the final wake state and required platform items alongside the directory scan, then commit one final manifest. Test a timer/environment change immediately before release.

1. P1 — Task 1, Step 3: completing relocation discards automatic-loss evidence before the console can persist it. fenceBox retains the fence and discharge verdict only in Op.Journal (P:893–902); CompleteRelocation replaces that entire operation (P:1399). It creates no durable host loss identity or retained reporting payload. Claim §7.3 D4 explicitly requires those consequences to survive operation release and holder replacement. Deferring console materialization does not defer this retention requirement. Fix: retain the fence reference, original observation, loss identity, consequences and reporting state outside the replaceable operation before recovery proceeds. Test completion while the console remains unavailable.

1. P1 — Task 8, Step 3: the files pin’s digest is never enforced. FilesPin.SHA256 is recorded, but relocationBuild checks only the enclosing pin object’s digest and then rereads the mutable source manifest through CopyManifest (P:5042–5061). CopyManifest checks sequence, not that digest. A later manifest revision blocks recovery; different bytes at the same sequence are accepted. Passing nil origins also rejects manifests containing unchanged objects inherited from earlier generations. Fix: preserve and consume the exact admitted manifest bytes or version, validate its digest, and carry its authorized origin chain. Test a late source-manifest update and a second relocation retaining earlier-generation objects.

1. P2 — Task 8, Step 3: the build receives the pin ordinal as its database TXID. PinObject.N is assigned the pin counter n (P:3974), but the builder receives N: pin.N (P:5056). The first pin of a database at TXID 41 therefore requests a build at TXID 1. ToInstalled subsequently expects 41 and refuses it. The same mistake makes the zero-position branch unreachable. Fix: separate PinNumber from the required database position; pass pin.DB.MaxTXID. Exercise the real adapter with a position other than 1.

1. P2 — Task 8, Step 3: installed can precede completion of the prepared files manifest. The build writes the database install manifest before copying files (P:5056–5061). PreparedFromInstallManifest.Verify inspects only the database manifest (P:5125–5130). A crash between those writes lets the worker enter installed; the participant then attempts local restore, while the no-rebuild boundary prevents completing the missing remote files manifest. The proposed verifier test checks only an unconfigured provider. Fix: require verified database and files authority before ToInstalled, including the files manifest’s identity and installation binding. Inject a crash immediately before its publication.

1. P2 — Task 7, Step 4: release checks for stopped writers without actually stopping them. releaseDrain.DrainClaim calls WritersStopped before any producer drain (P:4796–4810). Task 8 supplies only an observation through att.writersInputs; it supplies no operation that settles spawns, drains timer deliveries and stops application processes while retaining the replicator. 6b’s later ClaimProducers.DrainClaim cancels all registered producers, including replication. Fix: add a distinct writers-only stop operation before the observation, then flush, then close the remaining producers. Test with a live process and an in-flight timer rather than pre-set drained booleans.

1. P2 — Task 7, Step 4: a lost receipt response permanently blocks a completed release. The final TXID and manifest sequence exist only in releaseDrain memory. If root completes its durable receipt and the response is lost—or the process crashes before JournalRelease—root replays the receipt without rerunning the drain (internal/host/claimstop.go:207). The next call deliberately returns ErrClaimStopReceipt forever (P:4776–4779). The proposed test pins that refusal rather than recovery. Fix: durably journal the flushed positions against the exact stopped installation/session before completing stop evidence. Reconstruct the release from that journal and the replayed receipt.

1. P2 — Tasks 6–8 and 10: the pass cancels the execution controller it just acknowledged. Acknowledge opens the controller with its caller’s context (P:4740). Task 10 passes the per-pass context, then cancels it after the scan (P:5337–5358). hostexec.Open derives the controller lifetime from that context. Later participant steps see exec_ack and never reopen/check a controller (P:4267). Fix: retain controllers under the agent lifetime, validate current readiness before effects, and implement restart recovery independently of the historical acknowledgement. Test across two passes and an agent restart.

1. P2 — Task 5, Step 4: an unjournaled pin can permanently poison its create-only key. The pinner writes pin-1.json before JournalPin. If the journal CAS loses to a target-fence/replacement CAS, pins remains unchanged. The replacement adds a later fence observation, but retries always reuse the old object (P:3952–3962); JournalPin then rejects its timestamp indefinitely (P:1178–1182). A pin rejected for falling short of a release similarly occupies the key permanently. Fix: bind pin attempts to the exact recovery round and evidence, validate release bounds before publication, and provide a durable way to supersede an unaccepted candidate without rewriting it.

1. P2 — Task 5, Step 3: Worker.Start never verifies target eligibility or supported host shape. The start checks roster membership, region, fences and update reservations (P:3638–3669), but never consults Choose or the edges eligibility predicate. CheckBoxStart does not check freshness, secrets, draining status or HA capability. Nor does this path refuse non-relocatable unit/socket-backed hosts. Fix: validate the authoritative host shape and the complete eligible target set before registration and the start CAS. Test stale edges, missing capability/secrets, draining targets and unsupported route shapes.

1. P2 — Tasks 5 and 8: evidenced empty bootstrap is not implemented. StorePinner propagates genselect.ErrEmpty (P:3966–3968), while genselect.Select returns that error when no restore files exist (internal/genselect/select.go:414). The release adapter also refuses an absent admitted replicator, and the prepared verifier always requires a database install manifest. Thus the documented never-written-host path cannot complete, even after fixing the ordinal/TXID confusion. Fix: implement an explicitly evidenced empty path through release, pinning, files preparation and first admission. Do not treat arbitrary missing or unreadable storage as empty.

1. P2 — Task 9, Step 3: changing rowAllowed does not enable held participant rows. Reconciler.Install still calls Guard.Activate(..., nil) (internal/hostbox/reconcile.go:106), which refuses a non-executor participant (internal/hostguard/guard.go:179). The subsequent selected action is "reconcile", which the proposed relocation policy switch does not admit. The test calls only rowAllowed, bypassing both failures. Fix: implement narrowly scoped held-row authority through activation and the write policy, preserving the execution restriction. Test the actual ReconcileAdapter.Install path for source and target in every phase.

1. P2 — Tasks 2 and 10: create selection changes behavior with HA disabled. Task 2 unconditionally adds SelectExecutor to Controller.Attempt; Task 10 unconditionally installs the HA chooser (P:2079–2120, 5372–5376). That chooser requires region-ha-1, while boxes advertise it only with HA enabled (internal/host/edgesfile.go:158). Claim-enabled, HA-disabled deployments therefore lose their existing create path, including one-box regions. Fix: gate the changed selection behavior and preserve the existing disabled-mode path. Test a complete create with claim enabled and HA disabled.

1. P2 — Tasks 1 and 5: stuck handling misses required exits. After two live-target replacements, PinAfterRelease returns ErrReplacementsExceeded directly from the probe-failed arm (P:3752–3760), bypassing stuckOn. Persistent release failures also have no transition to stuck. Separately, relocationAdmission returns early for starting/releasing before checking journal.stuck (P:1562–1573), contradicting ruling 9’s terminal behavior. Fix: handle exhaustion from both replacement paths, define the failed-release stopping policy, and enforce stuck-state admission refusal consistently. Add live-target exhaustion and stuck-source admission tests.

I accept rulings 1–4, 6–8 and 10–13 as design choices. Ruling 5 needs the exact-files enforcement in finding 5. Ruling 9 is reasonable as a journal representation, but its promised behavior is incomplete.

No files were changed. Verdict: not ready.