| 1 | **PLAN 1: NOT READY TO BUILD.** |
| 2 | |
| 3 | Reviewed `d09077470019` against fetched `origin/main` **`1c43c2ce82f6`**, moves spec rev 7.20, claim rev 6.28 at `4ffe8a0d`, and all three prior reviews. No fetch, modifications, host access, or tests performed. |
| 4 | |
| 5 | 1. **P1 — Task 4’s target-selection integration is not buildable as written.** |
| 6 | [Plan 1:1166](/home/paulca/amadan.net/carlos/platform-moves-design/docs/superpowers/plans/2026-10-06-moves-phase1-1-copy-and-staging.md:1166) calls undefined `snapshotFor` and passes three arguments to `eligibleBoxes`, which takes seven on main. The correction at line 1267 says to reuse the create door’s verified identities and load inputs, but **main has no production caller of either `eligibleBoxes` or `chooseBox`**—only tests. Moreover, `chooseBox` has no host argument for the prescribed host-dependent hash, and the supplied `moveTargetBox` body still selects lexically. Specify the actual snapshot, identity verification, load collection, function signatures, and fixtures within Task 4. Reusing an integration that has not landed does not establish claim independence. |
| 7 | |
| 8 | 2. **P1 — Task 7b consumes `moves.Check` before Task 11 creates it.** |
| 9 | [Plan 1:2420](/home/paulca/amadan.net/carlos/platform-moves-design/docs/superpowers/plans/2026-10-06-moves-phase1-1-copy-and-staging.md:2420) exports `NextSpawnStrict(host) moves.Check`; `Check` first appears at line 3036. Task 7b cannot pass its commit gate. Move the shared type earlier. Its proposed fake `Cgroups` also needs an explicit seam: main’s field is concrete `*cgroup.Manager`, so an arbitrary fake cannot replace it. |
| 10 | |
| 11 | 3. **P1 — Signing still uses a later timestamp than the lease check.** |
| 12 | [Plan 1:1516](/home/paulca/amadan.net/carlos/platform-moves-design/docs/superpowers/plans/2026-10-06-moves-phase1-1-copy-and-staging.md:1516) specifies `signingTime = Clock()` after `Guarded.Before` checks its own clock. A pause between those reads allows a fresh signature after lease expiry. “Two statements apart” does not bound a VM freeze. This contradicts spec §7.3’s explicit requirement to sign with **the check’s timestamp**. Pass that captured timestamp into the signer. Test a pause across expiry between checking and signing; the current signing test never invokes `Guarded.Before`. |
| 13 | |
| 14 | 4. **P1 — The generation-source prefix is wrong for valid main claims.** |
| 15 | [Plan 1:3347](/home/paulca/amadan.net/carlos/platform-moves-design/docs/superpowers/plans/2026-10-06-moves-phase1-1-copy-and-staging.md:3347) constructs `h.Location + "g-" + generation + "/"`. Main’s `Claim.Validate` requires locations **without a trailing slash**. A valid location therefore becomes `instances/h/<inc>g-cur/`, yielding an empty source listing. Main’s `genselect.requestLocation` explicitly adds the separator first. Normalize the boundary and test with a claim accepted by `hostclaim.Update`. |
| 16 | |
| 17 | 5. **P1 — The floor does not cover the actual recovery entry points.** |
| 18 | [Plan 1:3250](/home/paulca/amadan.net/carlos/platform-moves-design/docs/superpowers/plans/2026-10-06-moves-phase1-1-copy-and-staging.md:3250) adds checks inside the new applier. On main, both `carlos-system-recover.service:17` and `carlos-system-update.service:25` directly execute **`carlos.prev` when an update journal exists**. An older `.prev` runs its own unguarded recovery and never reaches the newly added checks. Cover the unit-level selection before executing `.prev`; a test calling the new `restoreFiles` directly cannot prove this requirement. |
| 19 | |
| 20 | 6. **P1 — T7’s materialization cannot run under the production agent’s permissions.** |
| 21 | [Plan 1:2419](/home/paulca/amadan.net/carlos/platform-moves-design/docs/superpowers/plans/2026-10-06-moves-phase1-1-copy-and-staging.md:2419) stages and points live directly under `optDir`; Task 11 invokes it from the agent. Main’s edge unit uses `ProtectSystem=strict` and permits writes only under `/data` and `/run/carlos`. Existing `materializeHook` explicitly uses `OnStageBlocked(stageRequester(...))` to relay `/opt/carlos` writes to root. No equivalent pinned-version, held-row relay is planned, so T7 remains failed on hardened boxes. Task 13’s hourly agent write to `<optDir>/moves-floor.json` has the same permissions problem. Define and test both paths through the appropriate privileged writer. |
| 22 | |
| 23 | 7. **P2 — Default-off does not preserve the real legacy mirror path.** |
| 24 | [Plan 1:1492](/home/paulca/amadan.net/carlos/platform-moves-design/docs/superpowers/plans/2026-10-06-moves-phase1-1-copy-and-staging.md:1492) makes ordinary `s3Mirror` implement `VersionedCopier`. Consequently, the legacy worker’s existing `NewS3Mirror` enters the new receipt-required mode even with the switch off. Preserving plain *fake* mirrors does not preserve this production path. An unversioned destination cannot supply the required version receipt and repeatedly recopies unchanged objects. Make version collection explicitly opt-in for Phase 1. Task 13 also specifies unconditional console-record publication and floor processing without defining their dormant boundary. |
| 25 | |
| 26 | 8. **P2 — The new archive verifier rejects valid archives.** |
| 27 | [Plan 1:2201](/home/paulca/amadan.net/carlos/platform-moves-design/docs/superpowers/plans/2026-10-06-moves-phase1-1-copy-and-staging.md:2201) hashes the decrypted **compressed** stream before zstd decoding. `Build` hashes the **uncompressed tar** through `capWriter` at line 2043. The assertion at line 2255 that these are the same bytes is incorrect; the good-archive test remains red. Hash the decoded tar, consume its complete hashed representation, and propagate the sealer’s terminal authentication result. The current verifier also neither checks `Manifest.Sealed` nor explicitly waits for `Open` to finish. |
| 28 | |
| 29 | 9. **P2 — Correct implementations still fail the supplied fixtures.** |
| 30 | [Plan 1:1589](/home/paulca/amadan.net/carlos/platform-moves-design/docs/superpowers/plans/2026-10-06-moves-phase1-1-copy-and-staging.md:1589) omits `bucket.AddBucket("data-uk")`. After fixing that, main’s `leasetest.NewS3Server` returns `501 NotImplemented` for the ordinary PUTs this test sends; it supports create-only PUTs. The R3 fixture defect therefore remains. Separately, [Plan 1:1020](/home/paulca/amadan.net/carlos/platform-moves-design/docs/superpowers/plans/2026-10-06-moves-phase1-1-copy-and-staging.md:1020) instructs `writeServingClaim` to use a trailing-slash location, which real claim validation rejects. Extend the HTTP fixture deliberately and build claims through valid main primitives. |
| 31 | |
| 32 | 10. **P2 — Task 9 still misstates the flat spawn environment, and its positive test fails.** |
| 33 | [Plan 1:2858](/home/paulca/amadan.net/carlos/platform-moves-design/docs/superpowers/plans/2026-10-06-moves-phase1-1-copy-and-staging.md:2858) equates flat control availability with `b.Control != nil`. On main, `Control` is the **nested root-control client**; flat `startChild` independently calls `edge.ListenControl`. Also, `CompareEnv(..., true)` now requires both layout variables, although main omits `CARLOS_PURGE` when `Cache == nil`. The passing example at line 2628 omits `CARLOS_PURGE` and therefore fails the proposed implementation. Represent the actual per-variable availability and correct the fixtures. |
| 34 | |
| 35 | 11. **P2 — S1 can pass without reaching or waking the source process.** |
| 36 | [Plan 1:2957](/home/paulca/amadan.net/carlos/platform-moves-design/docs/superpowers/plans/2026-10-06-moves-phase1-1-copy-and-staging.md:2957) probes through the ordinary edge. Main’s `edge.go:1651–1663` serves cached GET responses **before invoking the activator**. A cached 200 can certify a source that cannot wake, violating S1’s “from its own process” requirement. Task 14 instead describes direct socket dialing, which cannot wake a sleeping instance. Define one wake-and-probe path that bypasses cache and test a cached success beside a failing wake. |
| 37 | |
| 38 | 12. **P2 — The readiness input versions lack concrete producers.** |
| 39 | [Plan 1:2418](/home/paulca/amadan.net/carlos/platform-moves-design/docs/superpowers/plans/2026-10-06-moves-phase1-1-copy-and-staging.md:2418) requires `RenderHeld.BundleETags` while using main’s `LoadMergedHost`, which returns only the merged manifest and **instance-overlay ETag**; `LoadMerged` discards the bundle ETags. Add a loader returning the exact bytes and versions used in rendering—later independent reads would not establish that association. Likewise, Task 11 says archive reads use versions named by the source report, but [its `SourceReport`:3054](/home/paulca/amadan.net/carlos/platform-moves-design/docs/superpowers/plans/2026-10-06-moves-phase1-1-copy-and-staging.md:3054) has only `FilesPlain`; the archive versions remain in the source-only ledger. Specify their publication. |
| 40 | |
| 41 | 13. **P2 — The private-storage refusal checks a creation policy instead of the instance’s binding.** |
| 42 | [Plan 1:1146](/home/paulca/amadan.net/carlos/platform-moves-design/docs/superpowers/plans/2026-10-06-moves-phase1-1-copy-and-staging.md:1146) checks `Manifest.PrivateStorage`. On main this is a mutable **create-time policy**; disabling it does not remove existing instances’ environment stores. Those instances would pass this check, contrary to §7.1. Both manifest reads also silently bypass their refusals on errors. Inspect the actual environment binding, fail closed on unreadable required policy, and specify the corresponding worker recheck. |
| 43 | |
| 44 | 14. **P2 — Task 15’s pinned inventory rejects the current copy record.** |
| 45 | [Plan 1:3372](/home/paulca/amadan.net/carlos/platform-moves-design/docs/superpowers/plans/2026-10-06-moves-phase1-1-copy-and-staging.md:3372) inventories `M-C1` through `M-C20` and rejects unexpected IDs. The reviewed record already contains **M-C21 and M-C22** at lines 36–37. Update the inventory and explicitly carry the record into the implementation branch; it is absent from `origin/main`. |
| 46 | |
| 47 | 15. **P3 — The index and task instructions still contradict the accepted compatibility rule.** |
| 48 | [Index D9:158](/home/paulca/amadan.net/carlos/platform-moves-design/docs/superpowers/plans/2026-10-06-moves-phase1-0-index.md:158) still replaces `MoveRequest` in Plan 1 and deletes staging-wins in Plan 2, contrary to D13. Task 2’s file list and commit text retain those obsolete instructions. [Task 14:3348](/home/paulca/amadan.net/carlos/platform-moves-design/docs/superpowers/plans/2026-10-06-moves-phase1-1-copy-and-staging.md:3348) still names unguarded `MovePromoteReady`/`MoveMarkCutting`, despite requiring guarded variants immediately above. Remove these competing implementation directions. |
| 49 | |
| 50 | The task-by-task assessment is: |
| 51 | |
| 52 | | Task | Main interfaces, prerequisites, and tests | |
| 53 | |---|---| |
| 54 | | 0 — Switch | New types are straightforward. Actual console environment wiring is in `cmd/console/main.go`, not `server.go`. The supplied test covers parsing, not that wiring. | |
| 55 | | 1 — IDs | Self-contained new functions; meaningful positive and negative assertions. No blocker found. | |
| 56 | | 2 — Journal | Main APIs exist; retaining legacy transitions fixes the previous deleted-consumer problem. New guard tests are meaningful. Stale replacement instructions remain. | |
| 57 | | 3 — Claim transitions | `StartGuard`, `RequireOp`, kinds, fields and `union` exist. Renamed fixture avoids the previous collision. Direct fixture tests bypass real claim validation. | |
| 58 | | 4 — Door | Blocked by selection integration and invalid claim fixture; refusal coverage is incomplete. | |
| 59 | | 5 — Version receipts | Main mirror/receipt interfaces match. Version tests are useful, but plain-fake coverage misses the changed legacy S3 path. | |
| 60 | | 6 — Lease/signing | `acquireTTL`, `SafeUntil` and the pinned SigV4 signer exist. Timestamp contract and HTTP fixture remain defective. | |
| 61 | | 7 — Archive | Crypto signatures match main. Positive verification fails; round-trip, tamper and mode tests otherwise target relevant behavior. | |
| 62 | | 7b — Held helpers/strict spawn | `LoadMergedHost`, `ensureStaged`, `PrepareStrict` exist; main already has `release.PointLive`. Forward type dependency, version provenance, mock seam and root relay need correction. | |
| 63 | | 8 — Timers | Main timer fields match. Digest and registration round-trip tests are meaningful. No blocker found. | |
| 64 | | 9 — Environment | Spawn-composition helpers exist. Proposed availability rule and test expectations disagree. `execBackendFixture` is also a placeholder, not an existing helper. | |
| 65 | | 10 — Budget | Referenced model exists at `9c417aaa`; porting it creates the required code. Arithmetic and expected examples align. | |
| 66 | | 11 — Readiness | Pure dependencies exist by this task. Freshness/refusal tests are meaningful; host implementation is explicitly deferred to Task 14. Integration requirements above remain unresolved. | |
| 67 | | 12 — Holds | Registry APIs and `openTestRegistry` exist. Conditional hold tests and the specified negative deletion test are appropriate. | |
| 68 | | 13 — Floor | Applier interfaces exist. Actual recovery entry points, privileged persistence and dormant behavior are not covered by the proposed tests. | |
| 69 | | 14 — Integration | Main worker and harness exist. Prefix selection, readiness integration and conflicting instructions prevent completion as specified. | |
| 70 | | 15 — Copy gate | `DefaultEnabled` now has an earlier producer. Inventory and implementation-branch record are unresolved. | |
| 71 | | 16 — Final gate | Cannot pass the preceding tasks as written. No gate was run during this review. | |
| 72 | |
| 73 | **Claim dependency conclusion:** No direct Plan 1 import or call into unmerged `hostops`, `hostbox`, `hostwrite`, `hostexec`, `hostfence`, or `hostquarantine` was found. However, Task 4 assumes nonexistent production selection wiring. The plan must specify a complete adapter using merged primitives or declare its dependency. Claimless-host refusal pending C5 adoption is already explicit and is not itself a build blocker. |
| 74 | |
| 75 | **Import/identifier conclusion:** No new package import cycle or duplicate top-level identifier was found in the intended additions. The concrete build failures are missing integration symbols and task ordering. **Main is not demonstrably shippable after every task**, and the default-off legacy contract remains broken by Task 5. |
| 76 | |
| 77 | --- |
| 78 | |
| 79 | **FIRST PROMPT:** |
| 80 | Focused read-only review of moves Phase 1 Plan 1 and its index. |
| 81 | |
| 82 | **WHAT:** |
| 83 | Check buildability, claim independence, dormant behavior, tests and spec coverage. |
| 84 | |
| 85 | **STATUS:** |
| 86 | Review complete. PLAN 1: NOT READY TO BUILD. |
| 87 | |
| 88 | **NEEDED:** |
| 89 | Nothing for this review. |
| 90 | |
| 91 | **RECOMMENDED:** |
| 92 | Resolve the findings, reconcile the task instructions, then repeat the focused review. |
| 93 | |
| 94 | **SESSION:** |
| 95 | Safe to close. Repository unchanged; nothing started; no handoff file written. |
amadan