carlos / platform Public

Download this file

1	Reviewed `d93c94d0`. **P** below refers to the [implementation plan](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-1b-next/docs/superpowers/plans/2026-10-07-region-ha-1b-next-relocation.md). **6b** refers to the declared plan on `origin/design-replica-ownership`.
2
3	All 11 embedded patches pass `git apply --check`. Compilation and tests were not reproduced in this read-only sandbox.
4
5	| Prior finding | Disposition | Assessment against rev 3 |
6	|---|---|---|
7	| R1-2 — build authority | Resolved | Each builder write now checks claim and installation identity; lease loss cancels the build. |
8	| R1-4 — former writer’s loss evidence | Resolved | Retained evidence includes the former writer’s last admission and its consequences. |
9	| R1-5 — immutable files pin | **Partly** | Copying uses retained bytes, but `PreparedFromInstallManifest.Verify` still reads the mutable source manifest at **P:7825–7834**. A late PUT still prevents progress. Verify against the retained control-bucket copy too. |
10	| R1-9 — release replay after restart | **Partly** | **P:7103** restores the old controller identity without setting `Recover`. 6b’s stop coordinator rejects that identity mismatch before replay (**6b:11975–11976**). Use its authenticated recovery path and preserve the recorded owner’s directory revision. |
11	| R1-13 — later empty probe | Resolved | Later attempts handle `genselect.ErrEmpty` and use ordinary empty-generation authority. |
12	| R1-14 — row-case adapter test | Resolved | The incorrect deletion/status expectations are corrected. The replacement test has a separate compilation defect below. |
13	| R1-16 — exhaustion before selection | Resolved | Both paths check exhaustion before choosing a spare. A different exhaustion boundary fails below. |
14	| R2-N1 — prepared retry ordering | Resolved | Inherited flags are reset; ordinary retries leave `Prepared` false. |
15	| R2-N2 — forbidden deletion expectation | Resolved | Existing unexplained rows are retained; assertions use `hold_op`. |
16	| R2-N3 — descriptor privileges | Resolved as a gated contract | Agent capture is process-local; R3 explicitly requires root’s complete scan. |
17	| R2-N4 — completed target remains held | **Not resolved** | The clear at **P:8537–8542** is inside the write callback. Before reaching it, serving `Policy.Check` rejects any nonempty hold ([wakepolicy.go:63](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-1b-next/internal/hostbox/wakepolicy.go:63)). Provide narrowly scoped authority to clear an obsolete hold before that rejection. |
18	| R2-N5 — retained controller lifetime | **Partly** | Sweeping is added, but a timed-out close loses the reference needed to finish cleanup; see new finding 2. |
19	| R2-N6 — three-attempt limit | Resolved | The claim durably counts attempts before invoking R1’s single-attempt probe contract. |
20	| R2-N7 — discovery completion | Resolved | Qualified discharge now uses `CompleteObligation` semantics. |
21
22	New findings, ranked:
23
24	1. **P1 — Task 9, Steps 1 and 4: identifiers are missing from the declared upstream.**
25	**P:8529** uses `observed.Claim` at the insertion after `write(owner)`. In 6b, `observed` is declared only inside the earlier `sql.ErrNoRows` block (**6b:7891–7902**), so it is undefined at that insertion. **P:8373** also calls `adapterFixture`, attributed to a 6b fixture that the declared plan does not supply.
26	**Fix:** read and validate the claim under captured authority at the insertion point, and include the actual test fixture and its methods.
27
28	2. **P2 — Task 7, Step 4: `Finish` forgets a controller before closing it successfully.**
29	**P:6933–6942** removes the map entry before calling `Close(ctx)`. Main explicitly retains the lifetime lock when closing times out and requires another `Close` call ([controller.go:478](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-1b-next/internal/hostexec/controller.go:478)). If the pass expires during cleanup, later sweeps cannot find that controller; another relocation cannot acquire the host’s lock.
30	**Fix:** retain the entry until closing completes, then conditionally remove that same controller. Test cancellation followed by a successful later sweep and another relocation.
31
32	3. **P2 — Tasks 3/9/10: production construction never supplies the new policy and fence observer.**
33	`Policy.Relocation` is mandatory for relocation actions (**P:3221–3238**), but its assignments are confined to tests. 6b constructs the policy with only `Inputs`, `Moves` and `Held` (**6b:10887**), then captures `a.Policy.Check` (**6b:10520**). Task 10 supplies neither the relocation policy nor `Reconciler.FenceClosed`, whose default is false (**P:8499**). Executor reconciliation and execution therefore remain refused, and source-fence closure is invisible to row decisions.
34	**Fix:** define and wire both providers before assembly construction captures the policy, gated on the feature flags. Test production assembly with HA enabled and disabled.
35
36	4. **P2 — Task 9, Step 3: a fenced source cannot write its required hold while it remains executor.**
37	**P:8485** chooses `holdOnly` only when `op.exec != box`. During `releasing`, the source remains executor after its admission fence closes. It therefore takes the guarded installation path, where the active fence or receipt prevents the callback ([guard.go:144](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-1b-next/internal/hostguard/guard.go:144)). This contradicts the `WithLocal` behavior promised by **P:8363**.
38	**Fix:** use the conditional hold-only path for a source whose admission fence is closed, even while it remains executor. Test with a real durable fence.
39
40	5. **P2 — Tasks 1/5, Step 3: exhaustion cannot stop a terminated target after local installation.**
41	After two replacements, let the final target journal `local_install` in `installed`, then terminate before probing. **P:5197–5198** calls `MarkStuck`, but **P:1968–1969** refuses precisely that state. Every pass repeats the refusal; the dead target cannot probe, and its fence is never consumed.
42	**Fix:** define a fence-consuming terminal transition that retains loss evidence, revokes the dead installation’s authority and reaches a safe stuck state without selecting a third replacement. Extend the exhaustion test beyond `starting`.
43
44	6. **P2 — Task 1, Step 3 / Task 5, Step 3: replacement acknowledgement is skipped when leaving `releasing`.**
45	If the target terminates after the source journals its release, replacement adds a new participant while retaining `releasing` (**P:1891–1892, 1935–1936**). The next worker pass calls `PinAfterRelease`, which advances to `pinning` without checking acknowledgements (**P:1543–1556**). Spec §5.8 requires the replacement to acknowledge before leaving that phase.
46	**Fix:** require the acknowledgement barrier in the `releasing → pinning` CAS. Test a replacement with its acknowledgement withheld after source release publication.
47
48	I accept the author’s remaining rulings as scoped choices. Rulings **5/21, 9, 17 and 20** remain incompletely implemented for the reasons above. R3’s privilege split and R5’s retained consequences address the earlier requests; the missing production policy wiring needs an explicit implementation or upstream request.
49
50	No files changed. **Verdict: not ready.**