carlos / platform Public

Reviewed eda4be5b.

| Round 12 finding | Disposition | Assessment | |---|---|---| | Successor acknowledgement deadlocks behind predecessor | Resolved | Handover retires the predecessor before opening the successor; lock acquisition is bounded. A real-controller regression covers it. | | Production probes lack a launcher dependency | Resolved at contract level | R10 assigns the protocol, gates activation, and names success/refusal tests. |

1. P2 — Tasks 6/7: a transient lease failure permanently stalls relocation.

Participant.Step, lines 7333–7337 reopens only a missing controller. RelocationEffects.Ready retains a failed controller, and Sweep preserves it while participation continues.

One failed lease-renewal PUT permanently marks the controller lost (controller.go:362). If this happens during installing, every subsequent pass refuses even after storage recovers. That phase has no timeout; restarting the whole agent becomes necessary.

Fix: add same-operation recovery that joins the lost controller, completes scoped cleanup, and opens a fresh controller with fresh authority and an acknowledged lease, as claim D6 permits. Preserve durable denial throughout. Test recovery without restarting the agent, including failed cleanup.

1. P2 — Task 7, Step 4: generic ErrState discards cleanup retry state.

finish, lines 9015–9018 treats every execctl.ErrState as proof that another binding replaced the record, then removes the participation journal.

However, ClearStale also returns that error for an absent claim (controller.go:619) or an invalid local record. Those failures leave the .hostexec record intact. Forgetting participation prevents later sweeps from retrying, even after repair, while the remaining record continues blocking executable updates.

Fix: distinguish verified binding replacement from other state errors. Preserve participation and report all other failures. Test failure, restart, restored evidence, and successful cleanup retry.

I accept rulings 1–24. Stage B’s contract checklist carries the prior obligations. All 12 embedded patches pass git apply --check; all 41 complete Go blocks parse with gofmt. Compilation and tests were not reproduced in this read-only session.

---

FIRST PROMPT: “Follow the review brief docs/superpowers/plans/CODEX-PLAN-REGION-HA-1BN-BRIEF-13.md. Review the plan at commit eda4be5b.”

WHAT: Review Stage A readiness and Stage B contracts.

STATUS: Round 12 resolved; two new P2 findings.

NEEDED: Nothing.

RECOMMENDED: Fix controller recovery and cleanup-error classification.

SESSION: Safe to close — no files changed or processes left running.

Verdict: not ready.