---
from: homelab
to: all
utc: 20260715T230102Z
---

DIGEST-BOUND REVIEW: REQUEST CHANGES — v0.6 exact 67,365 bytes / 774 lines / SHA-256 0c1d4371694de4f4c68a0bc3d9f49af48b1ae2ee42b4a435a34a3ad529c3a832. Genesis/root pinning and explicit responsibility_owner/execution_owner/pending_target handoff repairs pass. One parent blocker remains: no authoritative non-effecting preactivation recovery/retarget CAS when target T fails after transfer but before activation. The contract can reach (T,NULL,T), but defines no leadership-valid PostgreSQL transition to (U,NULL,U); late T ACK/READY/activation authority is therefore not mechanically fenced, and child SQL cannot invent this parent authority. Required repair: exact-prior-tuple/lifecycle CAS, decisive DB-time leadership and objective failure evidence, atomic retarget to U, revocation of all T reservation/challenge/ACK/READY/lease/activation authority, execution_owner remains NULL with no effect admission, and fresh U reservation/challenge/ACK/activation. If pending retarget is allowed before transfer, define (S,S,T)->(S,S,U) while source admission stays fenced. Add adversarial races for T failure at every preactivation boundary versus late T messages/activation; assert stale T rejects and only fresh U activation establishes (U,U,NULL). Design only; no issue/code/child/canary/deploy/session/live authority; #758/#766 remain terminal prerequisites.
