carlos / platform Public

Download this file

1	Reviewed HEAD `1297aa7547fa51f41a14d866b7faef2e6943c4b9` read-only. No builds or tests run; working tree unchanged. Findings concern the proposed implementation.
2
3	| Open round-3 item | Status | Assessment |
4	|---|---|---|
5	| Unresolved group reference overwrites legacy status | **Closed** | `groupStatusTick` publishes nothing until resolution succeeds and retries on subsequent ticks, independently of both flags. |
6	| Historical reports exhaust the 200-key cap | **Closed** | `ListMod` pages the listing; old entries are filtered before GETs and the cap. Content-freshness checks remain. |
7	| Remove redundant freshness pre-checks | **Closed** | Both removed; the bound store remains the write enforcement point. |
8	| Stop/start versus reboot verification | **Partly** | Explicit activation gate retained; the dev observation remains outstanding. This alone does not block implementation. |
9
10	The deadline actually starts at **describe start**, which is stricter than your summary and permitted by spec rev 18.
11
12	New findings:
13
14	1. **P2 — A successful return after the deadline bypasses unknown-outcome recovery.**
15	[`inFlight`, plan line 3224](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-2b/docs/superpowers/plans/2026-10-17-region-ha-2b-joining.md:3224) checks cancellation only when the underlying operation returns an error. A context-ignoring store such as `DirStore` can begin its roster write before the deadline, finish afterward, and return `nil`. Enrolment then succeeds without recording an unknown outcome or scheduling the fresh describe.
16
17	This contradicts the stated requirement that a commit not confirmed before the deadline enters recovery. Check the bound after the operation, including successful returns. Add a test whose `Put` completes successfully after expiry; the current in-flight test always returns `ctx.Err()`.
18
19	2. **P2 — Read-back accepts a stale describe as fresh.**
20	[`readBack`, plan line 4745](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-2b/docs/superpowers/plans/2026-10-17-region-ha-2b-joining.md:4745) calls `confirmMembership` directly and never calls `c.fresh`. That helper validates membership fields but does not enforce elapsed time.
21
22	If the group read succeeds and the subsequent instance read stalls beyond 60 seconds, read-back accepts the old membership answer, logs “a fresh read confirms membership,” and deletes the recovery entry. Apply the freshness check before settling the entry; stale answers should retain it for retry. Test a successful describe taking exactly 60 seconds.
23
24	3. **P2 — Failed paging permanently discards the only automatic escalation.**
25	[`readBack`, plan line 4753](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-2b/docs/superpowers/plans/2026-10-17-region-ha-2b-joining.md:4753) deletes the recovery entry unconditionally after `pageNotMember`. That function only logs delivery errors.
26
27	A temporary alert-sink failure therefore leaves a detached, running instance enrolled indefinitely without delivering the required page. Subsequent passes skip its existing roster entry. Preserve pending notification state and retry with backoff; suppress further sends after success. Add a failed-delivery-then-success test.
28
29	4. **P2 — The host.env directory check does not establish a protected write path.**
30	[`runHostEnv`, plan line 1415](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-2b/docs/superpowers/plans/2026-10-17-region-ha-2b-joining.md:1415) checks only the immediate directory’s ownership and type. It accepts a root-owned directory writable by other users, follows symlinked ancestors, and subsequently reopens the pathname in `hostfloor.Durable`.
31
32	With `--out` beneath a writable ancestor, another user can replace or redirect the checked directory before the write. A writable destination directory also permits replacement of the resulting configuration despite its `0600` mode. Anchor the write to a validated directory descriptor and reject writable or symlinked path components. The current test covers only an immediate-parent symlink.
33
34	The allowlist, value validation, roster cross-check, and trigger-content independence are represented. The directory issue above leaves the checked-write condition incomplete.
35
36	---
37
38	**FIRST PROMPT:**
39	Round 4 review of region HA 2b at `1297aa75`.
40
41	**WHAT:**
42	Reviewed round-3 dispositions and the revised safety paths.
43
44	**STATUS:**
45	Prior status defects closed; four new P2 findings. **Verdict: not ready to build.**
46
47	**NEEDED:**
48	Nothing for this review.
49
50	**RECOMMENDED:**
51	Fix the four gaps and add the boundary tests described above.
52
53	**SESSION:**
54	Safe to close. No files changed or processes started.