PR Review Summary

Status: Approve+Follow-Up

🪜 Strategic-Fit Decision

• Decision: Approve+Follow-Up
• Rationale: The mechanism is correct and I verified it on live containers rather than reasoning about it. The one durable finding is that the JSDoc and the field name claim more territory than os.hostname() covers — it discriminates container identity, not boot, and on a host-run orchestrator it discriminates nothing. That is a precision gap in a claim, not a defect in the behaviour, and it matters because host-edge is a live posture in this repo (#16229).

Peer-Review Opening: Phoebe — the ordering is the part worth naming. Putting the cross-boot clause before the epoch/pid checks is what makes this work, because the whole defect is that pid liveness is vacuous in a container; any layering that reached isPidAlive first would have inherited the same vacuity. And the second spec — "a same-boot lease with a live holder is NOT staled by the clause" — is a positive control, not a formality: without it, a clause that staled everything would pass every other test you wrote. That is the test I look for and it is often the one missing.

🧭 Patch-Blind Premise Snapshot

• Inputs Read Before Patch: #16262 in full; the #16210 intake V-B-A it cites; heavyMaintenanceLeasePrimitives.mjs on current dev (isLeaseStale, buildLeasePayload, isPidAlive); the #16208 window specimen it references; and the live container state on this machine.
• Expected Solution Shape: an epoch discriminator that does not depend on pid equality, evaluated before any liveness probe, sourced from something that provably changes across a container recreate; additive to the payload so pre-field leases are unaffected; injectable for tests. Must not: widen staleness for same-boot live holders, or treat an absent discriminator as evidence of staleness.
• Patch Verdict: Matches. Cross-boot clause first, bootId additive, seam injected, absent-field behaviour explicitly preserved.
• Premise Coherence: Coheres. The ticket correctly separates the already-merged epoch guard (ff7f624, pid-equality case) from the cross-pid gap this closes, and does not claim the merged guard covers it.

🕸️ Context & Graph Linking

• Target Issue: Resolves #16262
• Related Graph Nodes: #16210 (the intake that surfaced it), #16220 (isLeaseStale's original epoch check), #16208 (the window specimen), #16229 (host-edge posture — the case the finding below concerns)
• Origin Session ID: 713db0da-2239-44ea-ba5b-931be90d34fc

🔬 Depth Floor

Verified live, not assumed — the mechanism holds. The load-bearing premise is that os.hostname() differs across container recreates. On this machine right now:

orchestrator   hostname=917c768358cb   containerID=917c768358cb
mc-server      hostname=37be8b97d07d   containerID=37be8b97d07d

Exact match, and no compose in ai/deploy/ pins a hostname: — I grepped for it specifically, because a pinned hostname would make the discriminator constant across recreates and the fix silently vacuous. It does not. The container ID changes on recreate, so bootId changes with it. This is the check I most wanted to fail and it passes.

Finding (non-blocking, durable): the discriminator is container identity, not boot — and the JSDoc says otherwise.

The clause's comment reads "a lease written by a different boot (container recreate, machine restart)", and the field is named bootId. For a container recreate that is exactly right. For a machine restart on a host-run orchestrator it is wrong: os.hostname() is a persistent configured name, unchanged by rebooting. On this host it is 9fbfd6e9-…fritz.box and will be the same string after the next reboot.

So on the host-edge posture, a lease surviving a machine restart has an identical bootId, the new clause never fires, and discrimination falls back to exactly what exists today — the pid-equality epoch check plus isPidAlive. That is not a regression and not a blocker: host pid liveness is not vacuous the way container pid 1 is, and the TTL still backstops. But it is strictly less coverage than the sentence promises, and the name bootId reinforces the wrong mental model for the next reader.

Two options, your call and follow-up scope: narrow the comment to name the container case honestly ("a different container epoch; on a host this is constant and the epoch/pid checks below discriminate"), or make the value genuinely boot-scoped where that is cheap (a boot-time random written once per process tree, or /proc/sys/kernel/random/boot_id on Linux — though that reintroduces a platform branch this primitive currently avoids, which may not be worth it). I lean to the first: the mechanism is right for the case that hurts, and the doc should simply stop claiming the case it does not cover.

Also verified:

• The absent-field guard is typeof lease.bootId === 'string' && lease.bootId.length > 0 — so undefined, null, and '' all skip the clause. An empty-string bootId cannot stale a lease by accident, which is the right call given os.hostname() can theoretically return ''.
• buildLeasePayload defaults bootId = os.hostname() and honours injection — spec'd.
• Ordering: the clause returns before toTimestamp is called on anything, so a malformed acquiredAt on a foreign-boot lease still classifies stale rather than throwing.

Rhetorical-Drift Audit:

• Ticket claims spot-verified at source: isLeaseStale's pid-equality condition and the isPidAlive fall-through are as described.
• The ticket's own live evidence re-checked: docker exec … grep -c CURRENT_PROCESS_STARTED_AT returning 0 is consistent with what I measured independently today — the running image is c2304ea118, 15 merged PRs behind dev.
• No [RETROSPECTIVE] tag needed.

Findings: Pass, with the naming/doc follow-up above.

🧠 Graph Ingestion Notes

• [KB_GAP]: none.
• [TOOLING_GAP]: Memory Core semantic recall is degraded (mid-restore), so my prior-art sweep returned unrelated rows rather than absence. Substituted direct source reads, git grep, and live docker inspect; naming the instrument because an empty sweep is not clearance this week.
• [RETROSPECTIVE]: the reusable shape is "liveness probes inherit the namespace they run in." isPidAlive is not wrong; it is correct about a question that stops being meaningful inside a container, where pid 1 always exists. Any liveness check crossing an isolation boundary needs an identity for the boundary itself before the probe means anything.

🎯 Close-Target Audit

• Close-target: Resolves #16262
• #16262 is not epic-labeled
• Scope matches the ticket — the merged pid-equality guard is untouched

Findings: Pass.

📑 Contract Completeness Audit

• The payload gains one additive field, documented on buildLeasePayload with its rationale and its backward-compatibility guarantee.
• isLeaseStale's JSDoc states the layering order explicitly, which is the property a future editor would otherwise break by moving the clause down.

Findings: Pass, modulo the doc precision noted above.

🪜 Evidence Audit

• The recreate specimen (pid-1, different boot, probe reports alive) fails on pre-fix dev — it is the defect, not a restatement of the fix.
• Positive control present: same-boot live holder is not staled. This is what makes the other tests meaningful.
• Backward compatibility pinned: pre-bootId payload classifies exactly as before.
• Emit path covered: default from os.hostname(), plus injection.
• CI CLEAN (11 checks) at review time.
• No L2→L3 promotion. Worth stating: this cannot be validated on the live plane today — the running image predates even the merged epoch guard, so a live readback would exercise neither. Do not let a "prove it on the running orchestrator" request block merge; that is gated on the rebuild, not on this PR.

Verified against the PR head with CI CLEAN. Approving; the doc/naming follow-up is yours to fold in or file.

📋 Required Actions

No required actions — eligible for human merge.

The bootId-is-really-container-identity finding in Depth Floor is a follow-up, not a gate: the mechanism is correct for the case that hurts (container recreate, verified live), and the host case is unchanged from today rather than regressed. Phoebe's call whether to narrow the comment or rename the field.

📊 Evaluation Metrics

Verdict weights: 30% premise / right thing, 30% architecture + placement, 30% diff correctness, 10% AC/audit sanity.

• [ARCH_ALIGNMENT]: 95 - Correct placement in the Neo/Base-free primitive alongside the existing discriminators, with the clause layered most-external-first so it cannot inherit the vacuity it exists to fix. Seam injected rather than reaching for os at the call site, consistent with the module's existing seam discipline.
• [CONTENT_COMPLETENESS]: 88 - JSDoc states the layering order (the property a future editor would break) and the additive guarantee. -12: the comment claims "machine restart", which os.hostname() does not detect.
• [EXECUTION_QUALITY]: 95 - Guard is typeof === 'string' && length > 0, so empty-string can never stale a lease by accident; the clause returns before any toTimestamp call, so a malformed acquiredAt on a foreign-boot lease classifies rather than throws.
• [PRODUCTIVITY]: 100 - Filed and closed same-day off the #16208 window specimen and the #16210 intake.
• [IMPACT]: 90 - Without it, a dead epoch's pid-1 lease reads live indefinitely across every container recreate and blocks heavy maintenance until an operator manually removes the file — which is exactly what the window specimen did today.
• [COMPLEXITY]: 40 - One clause, one payload field, one import; the reasoning is subtle but the change is not.
• [EFFORT_PROFILE]: Quick Win - 25 production lines closing a class of vacuous-liveness bug.

Approving. Verified on live containers: hostname == container ID, and no compose pins a hostname: — the check that would have made this silently vacuous.