carlos / platform Public

Reviewed 222ff1c6. P refers to the implementation plan.

| Round 5 finding or partial | Disposition | Assessment against rev 6 | |---|---|---| | R4-5 — durable controller cleanup | Resolved | Participation is journaled before opening. Every clear requires successful scoped cleanup in that call, including retries and restart recovery. Stage B retains these obligations. | | 1 — replacement on a box owing park-local | Resolved | Selection excludes these boxes; replaceTargetSlot independently refuses them inside the CAS. Tests cover replacement phases and choosing a clean spare. | | 2 — regional chores remain assigned to a dead box | Resolved | fenceBox reassigns both regional chore kinds, preserves their identities and records the reassignment. Tests cover both discharge outcomes. | | 3 — reconcile changes with HA disabled | Resolved | Task 9a preserves the original serving-only check when both callbacks are nil. Tests check refusal and unchanged claim/local state. | | 4 — interrupted journal write hides recovery work | Resolved | Temporary files are ignored; damaged committed entries produce errors without hiding readable entries. Sweep reports those errors. | | 5 — deleted environment file remains published | Resolved | Flush stages an explicit deletion on ENOENT. Tests cover publication followed by removal; Stage B requires removing the destination file too. |

New finding:

1. P1 — Task 4, Step 3: an unshared thread’s database descriptor can pass as the replicator’s.

At P4292–4300, scanOne treats matching descriptor numbers and paths as proof that a thread shares the leader’s descriptors, then deduplicates them.

A thread can unshare its descriptor table, close descriptor 5 and independently reopen the same database as descriptor 5. The scan represents that independent holder as the leader’s allowed replicator descriptor. WritersStopped consequently succeeds, permitting the final flush while another writer still holds the database. Process-start verification does not distinguish threads within that process.

This violates claim §6.1’s requirement for positively identified replicator descriptors. Existing tests cover differing descriptor numbers or a missing leader descriptor, but not independent descriptors with matching numbers and paths.

Fix: require positive kernel evidence that the thread shares the leader’s descriptor table; fail closed when that identity cannot be established. Add shared-versus-unshared tests where both tables contain the same database descriptor number, including an independently reopened descriptor.

I accept rulings 1–24. Stage B’s re-plan carries the earlier integration obligations; the new finding concerns Stage A’s observation mechanism.

All 12 embedded patches pass git apply --check. Compilation and tests were not reproduced in this read-only sandbox. No files changed.

Verdict: not ready.