| 1 | Reviewed `222ff1c6`. **P** refers to the [implementation plan](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-1b-next/docs/superpowers/plans/2026-10-07-region-ha-1b-next-relocation.md). |
| 2 | |
| 3 | | Round 5 finding or partial | Disposition | Assessment against rev 6 | |
| 4 | |---|---|---| |
| 5 | | R4-5 — durable controller cleanup | Resolved | Participation is journaled before opening. Every clear requires successful scoped cleanup in that call, including retries and restart recovery. Stage B retains these obligations. | |
| 6 | | 1 — replacement on a box owing `park-local` | Resolved | Selection excludes these boxes; `replaceTargetSlot` independently refuses them inside the CAS. Tests cover replacement phases and choosing a clean spare. | |
| 7 | | 2 — regional chores remain assigned to a dead box | Resolved | `fenceBox` reassigns both regional chore kinds, preserves their identities and records the reassignment. Tests cover both discharge outcomes. | |
| 8 | | 3 — reconcile changes with HA disabled | Resolved | Task 9a preserves the original serving-only check when both callbacks are nil. Tests check refusal and unchanged claim/local state. | |
| 9 | | 4 — interrupted journal write hides recovery work | Resolved | Temporary files are ignored; damaged committed entries produce errors without hiding readable entries. `Sweep` reports those errors. | |
| 10 | | 5 — deleted environment file remains published | Resolved | Flush stages an explicit deletion on `ENOENT`. Tests cover publication followed by removal; Stage B requires removing the destination file too. | |
| 11 | |
| 12 | **New finding:** |
| 13 | |
| 14 | 1. **P1 — Task 4, Step 3: an unshared thread’s database descriptor can pass as the replicator’s.** |
| 15 | |
| 16 | At [P4292–4300](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-1b-next/docs/superpowers/plans/2026-10-07-region-ha-1b-next-relocation.md:4292), `scanOne` treats matching descriptor numbers and paths as proof that a thread shares the leader’s descriptors, then deduplicates them. |
| 17 | |
| 18 | A thread can unshare its descriptor table, close descriptor 5 and independently reopen the same database as descriptor 5. The scan represents that independent holder as the leader’s allowed replicator descriptor. `WritersStopped` consequently succeeds, permitting the final flush while another writer still holds the database. Process-start verification does not distinguish threads within that process. |
| 19 | |
| 20 | This violates claim §6.1’s requirement for positively identified replicator descriptors. Existing tests cover differing descriptor numbers or a missing leader descriptor, but not independent descriptors with matching numbers and paths. |
| 21 | |
| 22 | **Fix:** require positive kernel evidence that the thread shares the leader’s descriptor table; fail closed when that identity cannot be established. Add shared-versus-unshared tests where both tables contain the same database descriptor number, including an independently reopened descriptor. |
| 23 | |
| 24 | I accept rulings 1–24. Stage B’s re-plan carries the earlier integration obligations; the new finding concerns Stage A’s observation mechanism. |
| 25 | |
| 26 | All **12 embedded patches pass `git apply --check`**. Compilation and tests were not reproduced in this read-only sandbox. No files changed. |
| 27 | |
| 28 | **Verdict: not ready.** |
amadan