carlos / platform Public

Clone
git clone https://amadan.net/carlos/platform

Plain git — no account needed to clone.

Download

Download this file

Astra: review of stage B Task 10b (the source's row held at its fence's close)

Review the "### Task 10b" section of docs/superpowers/plans/2026-10-10-region-ha-1b-next-stage-b.md (commit ef847864). R5-3 deferred this task, and you accepted that in round 6 on one condition: it lands before relocation is switched on anywhere (ruling 79, checklist item 18). Stage B is otherwise built and final-reviewed at 08df87e4. The code in this section was compiled and tested in a throwaway copy of that tree, and was mutation-checked there.

The design decisions:

  1. The fence. "Fence closed" is read from the host guard's durable record, which root writes with BeginFence when it stops the source for the release. It is not read from the activator's in-memory fence: a restart wipes that one, so its absence would read as open.
  2. The hold write. It reuses SetHoldIf(host, "relocating", op, ""), which sets the status and hold_op together under the hold_op guard. It does not use SetClaimHold, which sets only hold_op and leaves the row "ready".
  3. Releasing the hold. Nothing releases the source's hold. The completion queues the source's park-local, which deletes the row. A failover's fenced source is never held.
  4. The stage-requested marker is not touched.
  5. The flag. The hooks follow CARLOS_REGION_HA alone. They are wired in every assembly mode, but only the provision pass calls them.

Judge:

  1. Is "the guard's fence is closed" the right trigger? Can the row be held before the source has stopped, or not held while it serves nothing?
  2. Can the hold ever take a row another op holds, or hold a row from another installation in a way that matters?
  3. With nothing releasing the hold, can a host be left unserved for good? Consider these cases: - a converted landing whose park-local waits on M2; - an operator abort; - a stuck op.
  4. Is absence ever taken as evidence, for example an unreadable guard, row or claim?
  5. Do the six tests fail without the code?
  6. Is anything new introduced, including against the activation record?

Give findings as P1/P2/P3 with file:line, then a verdict: ready to build, or not.