tegwick
d7b2ea49ce
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a0cffe-206f-7323-89d3-b20ca4cf4bf9
55 lines
3.3 KiB
Markdown
55 lines
3.3 KiB
Markdown
# Recovery walkthrough review
|
|
|
|
Codex editorial review, 2026-09-25. Frozen inputs: repository `96d1143`, with
|
|
per-file and prompt hashes in the review runs. One separate model was asked to
|
|
challenge both cases through llm-connect. This is not independent human review or
|
|
an empirical comparison. The revised second prompt explicitly corrected errors in
|
|
the first response; this is not a blinded evaluation.
|
|
|
|
## Execution and disposition
|
|
|
|
[Attempt 01](recovery-review-01/receipt.json) exceeded its 2,500-token response cap.
|
|
The incomplete text is quarantined, never counted as a completed review. It confused
|
|
omniscient trace descriptions with client knowledge and treated intended idempotent
|
|
replay as problematic. Do not apply its proposed change from a write producing v12
|
|
to a write against v12: that changes the scenario incorrectly.
|
|
|
|
[Attempt 02](recovery-review-02/receipt.json) completed with a stricter prompt limiting
|
|
findings and total words. [Full response](recovery-review-02/response.md) is retained.
|
|
Across both attempts: two service calls, 10,605 reported tokens. No direct provider
|
|
calls, credential retrieval, or unrecorded retries.
|
|
|
|
1. Reject the proposed VC-01 freshness correction. An obsolete read cannot confirm
|
|
that a later write superseded it. Allowing it to update freshness markers would
|
|
weaken the intended invariant. Discard here means not applying obsolete data.
|
|
2. Reject the proposed VC-02 retry correction as a defect finding. The trace retries
|
|
the same immutable opC under an explicit deduplication assumption. Changed payload
|
|
would be a different proposal; it must not be smuggled into that retry. A new ID
|
|
while the original outcome is unresolved risks an extra transition. The response's
|
|
conditional same-payload clause is already covered by the trace's contract.
|
|
|
|
Two model findings reviewed, zero adopted. Its statement that baseline usefulness
|
|
is unknown is retained. This negative result is evidence about this review attempt,
|
|
not evidence that the walkthroughs are correct or that model reviews never help.
|
|
|
|
## Editorial corrections supported by local reasoning
|
|
|
|
E01: VC-02 steps 6/8 previously left opA's lifecycle unspecified. Block it on detected
|
|
conflict, atomically supersede it when opC is queued, and require the receiver to
|
|
reject stale delayed operations. Local queue retirement alone cannot stop an in-flight
|
|
write. Delayed opA receipts affect history only. These are proposed contracts, not
|
|
product guarantees.
|
|
|
|
E02: VC-01 step 9 lacked an operational rule for discarding obsolete reads. Add local
|
|
read generations plus an explicit read-after-write/server-version requirement.
|
|
Generation orders local requests, not opaque server revisions or replica freshness.
|
|
|
|
E03: Add operation-specific evidence handling: a late error cannot reverse confirmed
|
|
acceptance, and a previous operation's receipt cannot clear newer typing. Define
|
|
composer-to-pending handoff separately from storage durability, motivated by the
|
|
[pinned frontend code](FrontendRecoveryImplementations.md).
|
|
|
|
These are Codex editorial changes, not adopted model findings. They sharpen the
|
|
contract but remain synthetic reasoning. No new tests of frontend runtime behavior
|
|
were performed. Independent review, usability, crash recovery and full-pattern
|
|
recurrence remain open under FEP-WP-0002 T02/T03.
|