{
  "prior_design": "2214be15c9768dc3ba57dbcd33861c7e388a4909",
  "prior_review": "REQUEST CHANGES, claude-fable-5-1, session5a362663-1e97-49c5-8199-753d93684ec6",
  "status": "Unapproved revised design; no runtime changes",
  "resolved_findings": {
    "1": "Explicit closed-checkpoint no-writer handoff admits absent sidecars; narrowly proposed mode=ro&immutable=1 exception",
    "2": "SHM always absent and OS writes denied; no readmark allowance",
    "3": "Purpose-bound pending/inbox handoff ciphertext scans added",
    "4": "Exact bounded256MiB main SHA256 pre/post with retained descriptor, no duplicate-open lock hazard"
  },
  "nonblocking": "Platform integrity receipt replaces duplicate integrity_check; no other policy changes",
  "source_addition": {
    "file": "handoff/store.go",
    "sha256": "a834c7c7ddbaabb59d40f81935e266bec09cbb76e53ea956b6d4334b8f36ad07",
    "line": 343,
    "end_line": 364,
    "excerpt": "\ttoken, e := s.sealer.Open(\"handoff.token.\"+handleHash, sealedToken)\n\tif e != nil {\n\t\treturn zero, \"\", ErrRefused\n\t}\n\tclaims, e := s.verifier.Verify(string(token), now)\n\tif e != nil {\n\t\treturn zero, \"\", ErrRefused\n\t}\n\tif subtle.ConstantTimeCompare([]byte(nonceHash), []byte(digest(claims.Nonce))) != 1 || existingSubject != \"\" && existingSubject != claims.Subject {\n\t\treturn zero, \"\", ErrRefused\n\t}\n\tpath, e := s.sealer.Open(\"handoff.path.\"+secretHash, sealedPath)\n\tif e != nil {\n\t\treturn zero, \"\", ErrRefused\n\t}\n\tfresh := strings.HasPrefix(string(path), freshPathPrefix)\n\tif fresh {\n\t\tpath = path[len(freshPathPrefix):]\n\t}\n\tif !SafePath(string(path)) {\n\t\treturn zero, \"\", ErrRefused\n\t}"
  },
  "revision3": {
    "previous": "6d6d9e2ba3f203f9304e0c3b35b42d46f506da44",
    "review": "REQUEST CHANGES session8d564824-07f0-4dfa-8449-8ed487b59c8e actualFable5.1; priorfourblockersresolved",
    "correction": "Fixed Litestream two-table profile and bounded rows, plus integrity ordering/readonly fd delta/temp memory/cross-runtime labels/result origin/citation provenance",
    "source": {
      "path": "/home/paulca/go/pkg/mod/github.com/benbjohnson/litestream@v0.5.14/db.go",
      "sha256": "0356b86220a60bdeb38584a21f8d6d371454ef5b56bec9fd79adad021c8bd4b9",
      "line": 1025,
      "end_line": 1034,
      "excerpt": "\t// Create a table to force writes to the WAL when empty.\n\t// There should only ever be one row with id=1.\n\tif _, err := db.db.ExecContext(ctx, `CREATE TABLE IF NOT EXISTS _litestream_seq (id INTEGER PRIMARY KEY, seq INTEGER);`); err != nil {\n\t\treturn fmt.Errorf(\"create _litestream_seq table: %w\", err)\n\t}\n\n\t// Create a lock table to force write locks during sync.\n\t// The sync write transaction always rolls back so no data should be in this table.\n\tif _, err := db.db.ExecContext(ctx, `CREATE TABLE IF NOT EXISTS _litestream_lock (id INTEGER);`); err != nil {\n\t\treturn fmt.Errorf(\"create _litestream_lock table: %w\", err)"
    }
  },
  "revision4": {
    "prior": "f0eff21224625d6ca9a271de369d752639c68ce7",
    "review": "REQUEST CHANGES session1d0462b9 actualFable5.1; R2blockerresolved",
    "change": "Pre-checker pinned ordinary nonpersistent integrity/TRUNCATE/lastclose before sidecarabsence; post-checker verification retained; localactualHeld/libraryproof; schema set keys/spill enforcement clarified",
    "protocol_coordination": "/root/home_review_fix confirms additive app/worker-preparation dependency after approval/fence, not side-effect-freepreflight; no wire/state change"
  }
}