| 1 | Reviewed `418daf58`. **P** refers to the [implementation plan](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-1b-next/docs/superpowers/plans/2026-10-07-region-ha-1b-next-relocation.md); **6b** refers to the declared plan on `origin/design-replica-ownership`. |
| 2 | |
| 3 | | Round 3 finding or partial | Disposition | Assessment against rev 4 | |
| 4 | |---|---|---| |
| 5 | | R1-5 — immutable files pin | Resolved | **P:8221–8234** verifies against the retained manifest and its digest. | |
| 6 | | R1-9 — release replay after restart | **Partly** | Recovery mode and recorded identity are supplied, but the initial request omits `Region` (**P:7470–7472**) while recovery adds it (**P:7752**). Region participates in 6b’s fence identity and receipt validation, preventing exact replay. Populate it initially and preserve it on recovery. | |
| 7 | | R2-N4 — completed target remains held | Resolved | Serving reconcile can pass an obsolete hold and reach its clear. The new flag-off regression is reported below. | |
| 8 | | R2-N5 — retained controller lifetime | Resolved for the reported timeout | The entry survives a cancelled close. Durable record clearing remains a separate omission below. | |
| 9 | | N1 — missing adapter identifiers | **Partly, P1 remains** | `observed` and the fixture are supplied, but **P:9012** calls `f.withExistingRow()` without the string required at **P:8961**. **P:8887** also sets `EmptyInstallationCensus.Guard`, which the declared type does not contain (**6b:8380–8392**). Fix both and populate the census’s actual dependencies. | |
| 10 | | N2 — premature controller removal | Resolved | **P:7317–7322** deletes the entry only after successful close. | |
| 11 | | N3 — production provider wiring | **Partly** | **P:9301** captures `a.Reconcile.Box` before 6b initializes it. `OpenProductionClaimAssembly` returns an adapter with an empty box; `Build` sets it later (**6b:11471**). Bind the policy after actor verification and before policy capture. The fence observer also has the new deadlock below. | |
| 12 | | N4 — fenced source’s hold | Resolved at the decision level | **P:9061–9066** selects the hold-only path for a fenced executor. That path is affected by the new deadlock below. | |
| 13 | | N5 — exhausted target after local installation | Resolved | The worker uses the fence-consuming terminal transition without selecting another replacement. | |
| 14 | | N6 — replacement acknowledgement | Resolved | **P:1651–1655** requires acknowledgements before leaving `releasing`. | |
| 15 | |
| 16 | New findings, ranked: |
| 17 | |
| 18 | 1. **P1 — Tasks 3/9/10: the fence observer deadlocks reconciliation.** |
| 19 | **P:3517** makes `AdmissionFenced` acquire the host lock. Task 9 calls that observer from `Reconciler.check` (**P:9042**), which also runs inside `Guard.Activate` through `activationReader.Read`. The outer operation already holds the same lock. Task 10 supplies `context.Background()` (**P:9308**), so cancellation cannot end the inner wait. `holdOnly` repeats the problem inside `WithLocal` at **P:9091**. |
| 20 | **Fix:** expose the fence observation within the existing locked operation, without reacquiring the lock. Propagate the caller’s context and errors. Test both activation and hold-only reconciliation with the real observer and bounded deadlines. |
| 21 | |
| 22 | 2. **P2 — Task 3, Step 4: the production policy refuses target probes.** |
| 23 | **P:3490–3491** sends every `spawn`, `seed`, and `writer` action to `WakePhase(c, box, false)`. A target in `probing` requires `probe=true`. The declared 6b runtime selects `"spawn"` work for preparation, while [`Selection`](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-1b-next/internal/hostbox/work.go:16) carries no probe authority. R1’s runtime dispatch therefore cannot satisfy this later policy check. |
| 24 | **Fix:** extend R1 to propagate explicitly scoped probe authority through selected work and the policy. Test a complete target probe through the production policy while ordinary target spawns remain refused. |
| 25 | |
| 26 | 3. **P2 — Task 8c, Step 3: a fresh target lacks the directory that restore requires.** |
| 27 | **P:8451–8454** creates the relocation journal directory, then restores into `cfg.FilesDir(host)`. [`hostfiles.Restore`](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-1b-next/internal/hostfiles/restore.go:88) opens an existing directory. Reconcile supplies the row and inventory; 6b’s state-directory preparation occurs during the later probe. A fresh spare with a nonempty files manifest therefore fails before `local_install`. |
| 28 | **Fix:** create and inventory the destination directories under the installation’s authority before restoring. Test a target with no existing host directory; an untracked `MkdirAll` would conflict with 6b’s inventory checks. |
| 29 | |
| 30 | 4. **P2 — Task 8c, Step 3: held release staging has no usable root relay.** |
| 31 | **P:8490–8492** returns every `MaterializeHeld` error. Moves Plan 1, Task 7b explicitly returns `ErrStageBlocked` under the production edge service’s filesystem restrictions and requires root staging. Its declared relay authorizer accepts only `moving` and `landing`, using a move source report, so it cannot authorize this relocation. |
| 32 | **Fix:** add or request relocation-aware root staging, bound to the operation, executor, installation stamp and release. Verify staging before recording the install receipt, and test with production filesystem restrictions. |
| 33 | |
| 34 | 5. **P2 — Task 7, Step 4: completed relocations leave durable controller records that block platform updates.** |
| 35 | **P:7310–7326** closes the controller and deletes its in-memory entry. [`Controller.Close`](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-1b-next/internal/hostexec/controller.go:480) leaves the durable record in `lost`; [`ClearStale`](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-1b-next/internal/hostexec/controller.go:554) removes it separately. Neither this plan nor 6b calls that clearing operation. Under spec §5.10, even a `lost` record blocks executable updates. |
| 36 | **Fix:** preserve cleanup results, clear the exact discharged record after successful cleanup, and retain retry state across restarts. Add a disk-backed completion test that checks update eligibility. A subsequent nil `Close` is insufficient evidence: repeated calls return nil even after an earlier cleanup error. |
| 37 | |
| 38 | 6. **P2 — Task 3, Step 4: obsolete-hold clearing changes behavior with HA disabled.** |
| 39 | The bypass at **P:3431–3438** is unconditional. A serving reconcile with an obsolete hold now passes even when `Policy.Relocation` is nil—the HA-off configuration. Previously it returned `ErrChanged`. Task 10’s flag-gated wiring cannot prevent this change. |
| 40 | **Fix:** gate the bypass on an explicit HA-enabled capability and test the same held serving row with the flag both on and off. |
| 41 | |
| 42 | I accept rulings 1–23 as scoped decisions. Ruling 20’s lifecycle remains incompletely implemented. R1 needs the probe-authority contract above; R8 needs an insertion point where the verified box identity is available. |
| 43 | |
| 44 | All 11 embedded patches pass `git apply --check`. Compilation and test execution were not reproduced in this read-only sandbox. No files changed. |
| 45 | |
| 46 | **Verdict: not ready.** |
amadan