carlos / platform Public

Download this file

1	Reviewed `6b791017`.
2
3	| Prior verdict / model finding | Disposition | Assessment |
4	|---|---|---|
5	| R16: lost receipt after P opens | Resolved | Receipt verification and stuck handling remain intact. |
6	| R16: crash simulation repairs cleanup faults | Resolved | Crashes preserve faults and durable records; recovery remains separate. |
7	| F2: files pin can lose `instance.key` | Partly | Missing manifests are refused, but an existing empty manifest bypasses the guard. |
8	| F1: failed probe waits indefinitely without a spare | Partly | The deadline works while the target remains alive; termination bypasses it. |
9	| F3: abandoned prepared generation leaks | Partly | Replacement during `installing` is covered; replacement from `probe-failed` can forget P. |
10
11	1. **P1 — An existing empty manifest still permits key loss.** Task 5, Step 4: [`filesPin`, line 7183](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-1b-next/docs/superpowers/plans/2026-10-07-region-ha-1b-next-relocation.md:7183) returns an existing manifest before checking positive evidence. Stage B explicitly requires a manifest copy before app startup. That copy can lack `instance.key`: the app then mints its key, replicates dependent database data, and terminates before publishing the key. Recovery still installs a database without its key.
12
13	**Fix:** Refuse recovery without evidence for the required files, including when a manifest exists. Test an empty manifest with an admitted writer and nonempty database. Ruling 25 also needs an upstream durability contract: the continuous-sync window does not make that database recoverable.
14
15	2. **P2 — Target termination bypasses the no-spare deadline.** Task 5, Step 3: [`Step`, line 6737](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-1b-next/docs/superpowers/plans/2026-10-07-region-ha-1b-next-relocation.md:6737) dispatches a target fence to `replace` before reaching the phase deadline. When replacements remain, `replace` returns the chooser’s error indefinitely. Terminating the target after its journaled release therefore leaves the host unserved without marking the operation stuck.
16
17	**Fix:** Add a bounded, fence-consuming transition for a terminated target with no spare. Extend the deadline test by terminating the target after release.
18
19	3. **P2 — Replacement from `probe-failed` can discard an unopened P without recording it.** Task 1, Step 3: [`ReplaceTarget`, line 2616](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-1b-next/docs/superpowers/plans/2026-10-07-region-ha-1b-next-relocation.md:2616) deletes `prepared` in its default branch. This includes a target whose probe deadline expired before any admission, followed by termination. The later `install` cannot record the forgotten P, so completion queues no retirement.
20
21	**Fix:** Record unopened P before every transition that discards it. Test probe timeout before admission, target termination, replacement, and successful completion.
22
23	Rulings 1–24 remain accepted. Ruling 26’s operator-only recovery is reasonable with its stated availability cost. Rulings 25 and 27 need the corrections above. Prior Stage B contracts remain present; the new F2 contract is insufficient.
24
25	All 12 embedded patches pass `git apply --check`; all 47 Go blocks parse with `gofmt`. Compilation, runtime tests and mutations were not independently reproduced.
26
27	---
28
29	**FIRST PROMPT:**
30	“Follow the review brief docs/superpowers/plans/CODEX-PLAN-REGION-HA-1BN-BRIEF-17.md. Review the plan at commit 6b791017.”
31
32	**WHAT:**
33	Review Stage A readiness and Stage B contracts.
34
35	**STATUS:**
36	Three findings: one P1 and two P2s.
37
38	**NEEDED:**
39	Nothing.
40
41	**RECOMMENDED:**
42	Correct the three paths and add the missing regression cases.
43
44	**SESSION:**
45	Safe to close — no files changed or processes left running.
46
47	**Verdict: not ready.**