carlos / platform Public

Reviewed ed992c46. P below refers to the implementation plan. All 11 embedded diff blocks pass git apply --check. Compilation and tests were not reproduced in this read-only sandbox.

| Round 1 | Disposition | Assessment against rev 2 | |---|---|---| | 1 | Resolved | Missing interfaces are now explicit implementations or named upstream requests. | | 2 | Partly | Location leases are added. Remote construction still lacks captured host-guard authority and checks authority only before the entire multi-write builder, rather than throughout it (P:7027–7060). | | 3 | Resolved | The final manifest includes files, wake state and environment. | | 4 | Partly | Evidence survives operation replacement, but a fenced former writer loses its session/generation when another box is already Holder.WriterBox (P:1180–1181). Retain the box’s last admission and incarnation, including the reporting consequences. | | 5 | Partly | Digests and origins are enforced, but immutable manifest bytes/version are not retained. A late source PUT still makes an admitted pin permanently unusable (P:5195–5220, 7104–7109). | | 6 | Resolved | The builder receives pin.DB.MaxTXID. | | 7 | Resolved | Installation requires both manifests; files publication precedes database completion. | | 8 | Resolved | R2 explicitly supplies the missing writers-only stop, with integration gated on it. | | 9 | Partly | Same-process lost-response replay works. After restart, the request uses the new controller identity while the durable positions require the old one; no recovery path pairs the old receipt and positions (P:6317–6320, 6536–6563). | | 10 | Resolved | Controllers use the agent lifetime, and readiness is checked before effects. Completion cleanup has a separate new defect below. | | 11 | Resolved | Generation-qualified keys and pre-publication bounds address poisoned pin attempts. | | 12 | Resolved | Start now checks target eligibility and host shape. | | 13 | Partly | The first evidenced-empty path is covered. A later empty probe attempt still returns genselect.ErrEmpty without a recovery branch (P:7484–7488). | | 14 | Partly | Held-row authority is addressed, but the replacement adapter test contradicts the required row behavior; see new finding 2. | | 15 | Resolved | HA-disabled create retains the existing selection path. | | 16 | Partly | Both replacement paths choose another box before checking exhaustion. After two replacements with no spare left, ErrNoEligible bypasses stuckOn indefinitely (P:4802–4804, 4930–4947). Check exhaustion first. |

New findings, ranked:

1. P1 — Task 8c, Step 4: ordinary probe retries use prepared-generation publication ordering. in.Prepared = true at P:7493 also applies to the retry branch, which selects a fresh generation at P:7484–7491. Claim 6b publishes prepared generation markers before replication (6b:13619–13623); ordinary generation markers follow the durable root (6b:13659–13665). A retry can therefore publish authority for a generation that has no acknowledged root. Fix: reserve Prepared for an admission opening an actually prepared generation, and explicitly reset inherited flags in every branch. Test a second probe attempt crashing before its initial replication.

1. P1 — Task 9, Step 1: the proposed adapter test requires forbidden deletion. The probing/zzz case expects no row (P:7620), but the fixture creates an existing row for every non-starting phase (P:7625–7626). The implementation correctly retains unexplained rows, so the assertion at P:7632–7633 fails. Held cases also equate holding with Status != "ready", although 6b’s SetClaimHold changes hold_op, not status. Fix: separate “no row to mint” from “existing unexplained row to retain.” Assert the hold’s routing effect rather than a status change the implementation does not make.

1. P2 — Tasks 4/7/8a: descriptor inspection runs with insufficient privileges. ProcessDescriptors scans all processes before filtering to its own PID (P:3410–3417). Agent-side releaseDrain independently calls the same global scan through WritersStopped (P:6590). The agent runs as carlos, with only CAP_NET_BIND_SERVICE (service:28); unreadable root-owned descriptor tables cause ErrIncomplete. CollectClaimStop does not move this callback into root—it executes the drain locally. Fix: restrict descriptor capture to the agent’s own process, and provide an authenticated root-side writers-stopped observation before flushing. Keep unreadable global scans fail-closed. Test under the production UID and capabilities.

1. P2 — Task 9, Step 4: successful relocation leaves the target held. After completion, RowReady gives want="", but an existing HoldOp="rel-1" fails every condition at P:7749. The ordinary upsert preserves the hold, so the serving target remains unavailable. Fix: conditionally clear the completed relocation’s hold under verified serving ownership. Test the full installing → probing → serving → reconcile sequence.

1. P2 — Tasks 7/10: completed controllers retain the host’s lifetime lock. Controllers close only at agent shutdown (P:7918), while the pass skips completed operations (P:7884). hostexec rejects a serving claim, marks its controller lost, and deliberately retains the lifetime lock; only Close releases it (controller.go:232, controller.go:505). The next relocation cannot open its controller. Fix: reconcile retained controllers after participation ends, join cleanup, close and remove them. Define the ownership transfer so cleanup cannot stop the successful serving writer. Test two successive relocations without restarting the agent.

1. P2 — Tasks 1/6/8c: the three-attempt probe limit is absent. Spec §5.8 requires at most three attempts, then probe-failed (spec:892). The participant retries unsuccessful probes without a durable count (P:5560–5563). MaxStarts: 5 at P:7540 is not the required admission bound. Fix: durably count attempts per target installation and refuse the fourth, including across restarts and lost responses. Transition to probe-failed on exhaustion.

1. P2 — Task 1, Step 3: qualified discharge bypasses discovery completion. fenceBox removes park-local obligations by filtering the slice (P:1153–1160). CompleteObligation additionally marks discovery complete when its final chore finishes (delete.go:92). Discharging an adopted host’s final discovery chore therefore leaves discovery permanently incomplete. Fix: apply the exact obligation-completion semantics in the fence CAS. Test discharge of the final discovery chore. Ruling 3’s production restriction postpones exposure but does not correct this transition.

I accept rulings 1–4, 6–8 and 10–17 as scoped design choices. Rulings 5, 9 and 18 remain incompletely implemented, as recorded above. The explicit upstream requests are appropriate; R3 needs the privilege boundary described in finding 3, and R5 needs complete retained loss consequences.

No files changed. Verdict: not ready.