| 1 | Reviewed `2a9165d4` against claim `98b45332`, moves `a4711728`, and the referenced code. Rulings H1–H16 are treated as fixed. |
| 2 | |
| 3 | 1. **P1 — Probe retries can discard replicated writes and suppress their loss declaration.** |
| 4 | **§5.8, lines 707–728 and 746–751.** Every restarted attempt restores from the original prepared generation `P`. Attempt one opens `P`; attempt two opens `Q` and replicates newer writes; attempt three restores `P` again, losing `Q`’s durable writes. `PublishGeneration` may also have queued `P` for retirement. The operation-wide `released` coverage can incorrectly suppress loss for a failed probe using the original source’s receipt. Claim §6.4a item 3 and moves §7.7 instead require the failed attempt’s remote baseline, including unfinished-run selection. |
| 5 | **Fix:** Use prepared authority only for the first opening. For subsequent admissions, select the current predecessor through `genselect.Select` and determine coverage separately for that predecessor’s session. |
| 6 | |
| 7 | 2. **P1 — Replacing an `installed` target skips installation on the replacement machine.** |
| 8 | **§5.8, replacement table, line 777.** Box B completes installation and terminates before admission. The replacement CAS names C but remains at `installed`, allowing C to open `P`. C has never imported the files, credentials, timers or `NextDue` installed on B. The probe’s database restore and held-config rendering do not perform those missing steps. The no-reinstall rule forbids returning to `installing`. |
| 9 | **Fix:** Separate completion of the immutable remote build from completion of each box’s local installation. Require an enrollment-and-stamp-bound local installation receipt on C before probing, while preserving `P`’s opened-once rule. |
| 10 | |
| 11 | 3. **P1 — Operator volume changes leave a window for a false destroyed-disk fence.** |
| 12 | **§5.9 and §6, particularly lines 1046–1049.** A valid record shows all volumes deleted on termination. An exempt operator changes one flag to `false`; the instance terminates before the required refresh. The previous record remains within two hours, so automatic fencing incorrectly discharges local retirement. Detaching a volume is worse: refreshing the remaining mappings can produce another all-true record while the detached disk survives. |
| 13 | **Fix:** Durably invalidate automatic disk-destruction evidence **before** an exempt mutation. Re-enable it only after reconciliation accounts for removed volumes and proves destruction or retirement of their relevant artifacts. Record freshness alone cannot establish H10’s property. |
| 14 | |
| 15 | 4. **P1 — The proposed IAM guard does not establish protection against every non-operator.** |
| 16 | **§6, lines 1034–1044; §8’s gate.** The deny depends on the mutable `carlos:role` tag, but no rule protects that tag. A principal with tagging and volume permissions can remove it, change a deletion flag, and leave a fresh all-true volume record behind. The non-Organizations fallback also explicitly leaves unmanaged principals unrestricted, without disabling automatic fencing. AWS documents both [tag removal](https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteTags.html) and [SCP coverage limits](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html). |
| 17 | **Fix:** Protect the guard’s identifying tags, verify protection covers enrolled instances and applicable principals, and refuse automatic fencing wherever that coverage cannot be established. A warning is insufficient for the fence’s proof. |
| 18 | |
| 19 | 5. **P1 — Execution-lease loss removes the update exclusion before participation ends.** |
| 20 | **§5.10, lines 994–1015.** Root checks only `pending` and `active` records. Claim D6 also defines `lost`: renewal failure durably latches that state before cleanup, and cleanup may fail. During relocation probing or release, a controller can become `lost` while processes remain. Root then ignores its record and begins an executable update although the claim operation still names the box. |
| 21 | **Fix:** Retain update exclusion through `lost` and incomplete cleanup. Clear it only after the claim and cleanup conditions permit ending participation; unreadable or malformed controller state must also refuse the update. |
| 22 | |
| 23 | 6. **P2 — Source termination during `starting` has no recovery transition.** |
| 24 | **§5.8, lines 606 and 772–782.** A drain starts, then `from` terminates before acknowledging its execution lease. The initial barrier requires both participants. The replacement table handles target termination, while conversion of a dead source to failover is defined only for `releasing`. The operation cannot reach that phase or start another operation from `serving`. |
| 25 | **Fix:** Define a fenced source-loss transition from `starting`: preserve the operation’s history, remove the dead participant, record failover evidence, and retain the surviving target’s acknowledgement requirement. |
| 26 | |
| 27 | 7. **P2 — L5 does not remove the dead console from the claim’s required-actor census.** |
| 28 | **§5.9, §7 and §9 L5.** L5 excludes a fenced **box**. Claim §10.1 D7 separately requires every console serving the namespace, represented by distinct console enrollments and reports. When the console’s box terminates and its console report becomes stale, excluding the box alone leaves the console census unsatisfied. No binding or exclusion rule connects that console enrollment to the box’s termination fence. |
| 29 | **Fix:** Add the authenticated console-to-compute binding and the precise fence-based console exclusion, or another explicit D7 amendment that permits the promised console-independent relocation. |
| 30 | |
| 31 | 8. **P2 — Automatic enrollment cannot bootstrap a region after its last worker dies.** |
| 32 | **§5.1, lines 287–297; §7, line 1092.** The one-box failure case says its replacement enrolls and then becomes a regional worker. Enrollment first requires confirmation from a regional worker, which §2 defines as an already-active enrolled box in that region. After the sole box terminates, no such confirmer exists—even if the console remains available elsewhere. |
| 33 | **Fix:** Specify a concrete bootstrap confirmation path consistent with H16, or require an independently surviving enrolled confirmer and correct the automatic-recovery claim for regions without one. |
| 34 | |
| 35 | 9. **P3 — Several code citations point to unrelated code.** |
| 36 | **§1, §4, §5.5 and §5.7.** Following the current anchors leads a planner to the wrong implementation points. Corrections include: |
| 37 | - Scope predicate/call: `reconcile.go:348` / `:820`, replacing `:335` / `:799`. |
| 38 | - `everywhereClass`: `reconcile.go:215`, replacing `:202`. |
| 39 | - Warm-cache comment: `activator.go:1164`, replacing `:1127`. |
| 40 | - Ordinary `NextDue` capture: `activator.go:2204`, replacing `:2019–2030`. |
| 41 | - Fleet fallback: `edge.go:2466`, replacing `:2432`. |
| 42 | |
| 43 | **Fix:** Refresh the active citations against the reviewed tree; distinguish historical disposition-table anchors where retained. |
| 44 | |
| 45 | No files were changed or tests run. |
| 46 | |
| 47 | **Verdict: not ready for plan.** |
amadan