carlos / platform Public

Reviewed 3b6f3588.

| Round 14 finding | Disposition | Assessment | |---|---|---| | R13-2: malformed hostexec identity causes participation to be forgotten | Resolved | recordIsMine uses hostexec’s validated reader; tests cover missing identity fields, restart, repair and cleanup. | | 1: prepared manifest inherits the source sequence | Resolved | Prepared sequence is 0; source sequence is separate provenance. Stage B assigns exact-digest consumption and publication from sequence 1. | | 2: recovery skips a retired local installation | Resolved | EnsureLocal verifies and restores unopened P’s installation. Stateful tests and production integration obligations are added. | | 3: ordinary source wakes lack integration | Resolved | R1 and the Stage B checklist now require source wakes in starting and releasing, with fence and authority refusals. |

1. P2 — Task 6, Step 3 / Task 8c contracts: a missing receipt after P opens does not cause stuck.

Participant.Step, line 7604 skips local verification once PreparedOpened is true, then counts and invokes another probe. The Stage B checklist requires verification before first admission and prohibits later reinstall, but assigns no receipt-loss check afterward.

Spec §5.8, line 847 explicitly requires stuck when the receipt is missing after admission. Preventing reinstall alone does not enforce that refusal.

Fix: separate receipt verification from restoration. Before subsequent admissions, verify the installation’s durable receipt and binding; a missing receipt must mark the operation stuck without reinstalling. Add a test that opens P, loses the receipt, restarts and refuses another admission. Its counterpart should preserve legitimate changes to files, environment and timers.

1. P2 — Task 7, Step 4: the lifecycle property repairs cleanup faults during its restart event.

lifeWorld.restart, line 9560 calls recoverCleanup, which unblocks cleanup and clears cleanErr, then invokes the old controllers’ Close hooks in background goroutines.

Consequently, it cannot exercise an abrupt restart while cleanup remains continuously blocked or failing: the old process is allowed to finish cleanup after the simulated restart. This omits the persistent-failure restart sequence expressly required by the Stage B checklist at line 11011.

Fix: separate process restart from fault recovery. Add an abrupt-crash event that preserves durable records and external cleanup failures without completing the dead controller’s hooks. Assert that restart retains participation and update denial until a later explicit recovery permits cleanup and clearing.

I accept rulings 1–24. These findings concern missing enforcement and test coverage.

All 12 embedded patches pass git apply --check; all 43 complete Go blocks parse with gofmt. Compilation and tests were not reproduced in this read-only session.

---

FIRST PROMPT: “Follow the review brief docs/superpowers/plans/CODEX-PLAN-REGION-HA-1BN-BRIEF-15.md. Review the plan at commit 3b6f3588.”

WHAT: Review Stage A readiness and Stage B contracts.

STATUS: Four earlier findings resolved; two new P2 findings.

NEEDED: Nothing.

RECOMMENDED: Add post-admission receipt-loss handling and persistent-failure crash coverage before building.

SESSION: Safe to close — no files changed or processes left running.

Verdict: not ready.