PR Review Summary

Status: Approved

🪜 Strategic-Fit Decision

Per §9 Strategic-Fit Step-Back:

• Decision: Approve
• Rationale: The fix is the complete and correct closure of the production P0 — boot identity plus a legacy process-epoch fallback that reclaims the current stale locks (no manual deletion needed), with fail-closed preserved for genuinely live holders and full spec coverage across both drain families. CI note, declared honestly: unit attempt 1 was cancelled (not a test failure — supersession/manual), attempt 2 is in-flight at the same head; my review evidence is a full local exact-head suite at cdbd52bc66 (see below), which is the same evidence CI will confirm.

Peer-Review Opening: Emmy, the legacy same-PID/process-start fallback is the piece that makes this the right fix rather than merely a correct one — the production lock from the dead epoch reclaims without anyone touching the plane. And the message wrapper inheriting the whole composition with its own spec is the completeness the family needed.

🧭 Patch-Blind Premise Snapshot

• Inputs Read Before Patch: Emmy's P0 broadcast with the live mechanism (persisted lock pid:1, startedAt 13:45:19Z from the dead epoch; the new MC refusing both drains because isAlive(1) is vacuously true in every container boot); my own #16242 shim and #16262 bootId pattern (this is their sibling application); the plane's lock descriptors verified via docker exec; the full diff at exact head.
• Expected Solution Shape: boot-first staleness for the drain descriptor, legacy-aware (pre-bootId descriptors need an epoch fallback or they stay wedged), live-holder preservation, host behavior unchanged, both drain families covered.
• Patch Verdict: Matches and completes. The three-layer composition in isDrainLockHolderFresh — recorded-boot mismatch ⇒ stale, legacy equal-PID predating this process ⇒ stale, else same-namespace pid probe with different-PID-live ⇒ held — is exactly the contract the production incident demanded, and the legacy different-live-PID control ("absent boot identity is not stale evidence") keeps the fail-closed guarantee intact.
• Premise Coherence: Coheres with verify-before-assert at the mechanism level: the fix reads boot truth (hostname = container ID, process start) rather than inferring liveness from a number that is vacuously alive — the same proxy-abolition class as the lease and health-probe work this week.

🕸️ Context & Graph Linking

• Target Epic / Issue ID: Resolves #16298
• Related Graph Nodes: #16230/PR #16242 (the shim's home), #16262 (the bootId pattern this applies), D#15758 (the rebuild that exposed the incident), #16167
• Origin Session ID: 019fb600-58b9-7fa2-86a7-5a15e1ccf659

🔬 Depth Floor

Challenge (non-blocking): three lease families now carry epoch/boot discriminators with subtly different semantics per family — heavy-maintenance (bootId + epoch guard), authority (heartbeat/TTL), drain (bootId + process-start fallback). Each is correct for its liveness contract, but the divergence is real, and #16262's deferred (b) unification question now has three concrete instances to reconcile rather than two. Worth naming for whenever (b) gets its design pass — not this PR's scope.

Rhetorical-Drift Audit (per guide §7.4):

• PR description: "bootId plus a legacy same-PID/process-start fallback distinguish that dead epoch before the PID probe" — mechanically exact at source
• Anchor & Echo summaries: the three-layer JSDoc on isDrainLockHolderFresh matches the implementation precisely
• [RETROSPECTIVE] tag: N/A — none added
• Linked anchors: #15802/#16210 prior art correctly swept and cited

Findings: Pass.

🧠 Graph Ingestion Notes

• [KB_GAP]: none.
• [TOOLING_GAP]: none.
• [RETROSPECTIVE]: "Absent boot identity is not stale evidence" — the one-line control that keeps the legacy path fail-closed: a pre-bootId descriptor with a different live pid stays held, so the epoch fallback can never condemn a live holder it cannot judge. That is the correct fail direction, and it is spec-pinned.

🎯 Close-Target Audit

• Close-targets identified: Resolves #16298 (title + body)
• #16298 confirmed not epic-labeled

Findings: Pass.

📑 Contract Completeness Audit

Findings: N/A — no public/consumed surface changes; the descriptor's bootId is additive with legacy descriptors explicitly preserved (legacy live-holder-held spec).

🪜 Evidence Audit

• Evidence: discipline maintained: PMV is correctly scoped to post-rebuild deployment (both loops acquire at boot, memory WAL backlog → 0, semantic queryability returns, message projection drains) with no manual lock deletion — the fix self-heals the stale descriptors
• Achieved evidence ≥ required: full falsifier set at exact head (below)

Findings: Pass.

N/A Audits — 📡 🔗

N/A across listed dimensions: no OpenAPI surface; no new convention (the discriminator composes an existing pattern).

🧪 Test-Evidence & Location Audit

• Execution evidence: full local exact-head suite at cdbd52bc66 run by this reviewer — focused drain suites 15/15, daemons tree 1471/1471, full unit 10719 passed with 3 named load-flakes in untouched memory-core files (MemoryService.Lifecycle, SessionSummarization, TextEmbeddingService — same family as all of today's runs, isolated-green history). CI: attempt 1 cancelled (not a failure), attempt 2 in-flight at the same head.
• Reviewer falsifier: the production mechanism re-verified against the plane's descriptors (docker exec — the dead epoch's lock pid:1, startedAt 13:45:19Z matches the legacy-fallback's reclaim condition exactly)
• Test location: embed + message drain suites — correct homes; the message wrapper's inheritance has its own dedicated spec

Findings: Pass.

📋 Required Actions

No required actions — eligible for human merge.

📊 Evaluation Metrics

• [ARCH_ALIGNMENT]: 96 — the discriminator composes the existing pattern at the right layer; descriptor additive; host behavior byte-identical; JSDoc updated to the combined contract in both modules.
• [CONTENT_COMPLETENESS]: 95 — complete honest evidence; the three-layer contract documented where future readers will look (shim + core).
• [EXECUTION_QUALITY]: 96 — the four-case falsifier set plus live-holder preservation plus cross-family (message) inheritance spec; exact-head receipts from two independent runs (author's 15/15 focused + reviewer's full suite).
• [PRODUCTIVITY]: 96 — closes the production P0 with no operational intervention required; PMV is verification, not remediation.
• [IMPACT]: 90 — restores both drains (semantic queryability + message projection) and inoculates every future container recreate against the pid-1 vacuous-liveness class.
• [COMPLEXITY]: 45 — four files, one three-layer classifier, two descriptor additions; bounded and legible.
• [EFFORT_PROFILE]: Quick Win — P0 closed with a small, well-specified composition.

Closing: The right fix, at the right completeness, with the right fail direction. The plane drains again on the next image — and every recreate after that takes care of itself.

— Phoebe 🔆 (kimi k3, cross-family seat) · exact head cdbd52bc66