carlos / platform Public

Reviewed 64a0a793.

| Round 1 finding | Disposition | Assessment | |---|---|---| | 1. One-box create recovery | Resolved | Baseline selection and cancellation behavior are preserved; interruption and seed-trace comparisons are added. | | 2. Stuck source admissions | Resolved | Both admission paths refuse stuck operations; a targeted wake test covers the source. | | 3. Sole-box eligibility | Resolved | The shortcut is restricted to the original non-HA shape. Five HA eligibility refusals are tested. | | 4. Acknowledgement fidelity | Resolved for the reported defects | Durable acknowledgements replace current leases, and the missing installed/probing barriers are added. A separate failover barrier is still missing below. | | 5. Fence timing | Resolved | Retained observation times govern pin delays and dead-target deadlines, with targeted tests. | | 6. Exact-phase termination | Resolved | The matrix asserts the exact phase and live topology before injection and includes target loss in probe-failed. | | 7. Mutation-sensitive evidence | Resolved in the plan | All five guards now have discriminating direct tests. | | 8. Claim §11 coverage | Partly resolved | The move, record-race and cleanup cases are added. The crash test still misses marker published, replication not yet open: it holds the marker PUT before publication or waits until replication has opened. Add an explicit yield at the intervening boundary and crash there. |

The coverage table’s remaining mappings to 1b-next adapter tests are acceptable under claim §11.

1. P2 — Tasks 2–3, Step 1: failover selects its pin before the required acknowledgement. startFailover enters pinning without a target. relocPinning journals the pin before naming a target or checking acknowledgements. Accepted 1b-next rev 19’s PinFailover instead requires participant acknowledgements before entering pinning.

Hold the target controller unavailable and land a newer files manifest during that delay: the model can already have frozen an earlier pin, while 1b-next must wait. Ruling 4’s phase collapse therefore moves a guard, and removing production’s PinFailover barrier has no model counterpart.

Fix: preserve failover starting, or an equivalent guard before pin selection. Add a test that delays acknowledgement while a newer manifest lands.

1. P2 — Task 5, Step 1: the two-box adverse-volume test does not prove execution recovery. TestL18AdverseVolume completes a drain before terminating the former executor. It verifies retained local chores, but the current executor never fails. Claim §11 requires recovery to proceed while those chores remain open; the one-box case alone does not establish this in both shapes.

Fix: terminate the current executor with DeleteOnTermination=false, await serving on its peer, and assert the dead box’s local chore remains open before operator cleanup runs.

Sequential patches and Go parsing were checked in memory. Compilation, runtime tests and mutation results were not independently reproduced in this read-only workspace. No files changed or sweeps ran.

---

FIRST PROMPT: Review the plan at 64a0a793 using review brief 2.

WHAT: Check prior dispositions and report new findings.

STATUS: Seven resolved, one partly resolved; two new P2 findings.

NEEDED: Nothing for this review.

RECOMMENDED: Correct the failover barrier and complete the adverse-volume and crash-boundary tests.

SESSION: Safe to close — no files changed or processes left running.

Verdict: not ready.