plan: size the complete candidate repair and proof

[yihanzhu]

Tracks #327.

Align the candidate-preparation plan with the size-only spec accepted in #399. Update its spec-blob link and existing numeric allocations to the accepted 4,400–5,200 added-plus-removed implementation allowance. Every other plan byte is unchanged: high risk, seven paths, fixed dependency hashes, implementation sequence, safety boundaries and all nine proof rows remain binding.

The source allocations sum to 2,431–2,651 lines, proof allocations to 1,896–2,106 and documentation/manifest entries to 154. Together they match the spec's 4,481–4,911 forecast, leaving 289 lines below its ceiling. The existing row groups divide that planning allowance; they do not add work or reduce required evidence. Shared fixtures, real byte/mode oracles and existing fault controls remain the design.

Implementation #396 remains paused at 59e3a31 before round-1 edits under its retained claim. This separate plan amendment grants no implementation acceptance. Fresh independent Plan-verdict: ACCEPT, required quick CI, protected merge and the manager's exact-tuple reconciliation must precede resumption on that same implementation branch.

Reconciled the deterministic plan branch with merged prior PR #380 at 5a14221. Its remote branch was absent and its missing registered worktree retained an index identical to that head. Recovered only that tracked index at the original path, preserving metadata and history. Missing untracked or unstaged historical bytes were not inferred. A normal merge of b038742 produced exactly main's tree before the plan-only amendment. No prune, reset, force push, implementation changes or activation occurred.

Validation: canonical comparison permits only the spec hash and eight numeric sizing lines; all other bytes are identical. Forecast arithmetic, artifact hash links, clean worktree, exact merge topology, plan-only non-merge history, structure manifest, rename gate and git diff --check pass. No implementation test or CI pass is claimed here.

review_size: standard. This artifact diff is 9 additions and 9 deletions in work/candidate-content-preparation/plan.md.

[yihanzhu]

Independent high-risk plan amendment review — PR 400, round 0

Plan-verdict: ACCEPT

No Important findings in Bugs, Security or Compliance. This verdict accepts the size-only plan amendment against the already accepted G2 spec. It does not accept implementation PR 396, waive any prior finding or proof, or independently authorize implementation before protected plan merge and manager reconciliation.

Exact tuple and independence

• Repository: yihanzhu/ystack.
• PR: plan: size the complete candidate repair and proof #400.
• Branch: ystack/plan/candidate-content-preparation.
• Head: b712812.
• Base/main: b038742.
• Worktree: /private/tmp/ystack-codex-resume-20260921/wt-candidate-plan; clean before and after inspection.
• Plan blob: ab4653254e7431cfa9a62d4a8740451f2b5b7f00.
• Accepted spec blob: e5530e70a4d1247c54255b8426bd86bdf3f88d0d; plan spec-blob matches.
• Intent blob: fd10d967e2c6ee1fea4a80b560e861856d3ed507; spec intent-blob matches.
• Risk: high in both spec and plan.
• Artifact author: /root/candidate_size_spec_author, separate from implementation author /root/candidate_impl_sol (requested Sol/medium).
• Independent reviewer: /root/candidate_readonly_preflight, requested gpt-6-astra/high; actual runtime model identity is not exposed.
• Manager: directly dispatching Roadmap session 01a09ae7-9bd4-77f3-8c15-966143bebff4 under the current direct handback and continuing program authorization.

Fresh remote reads before and after review returned the identical head/base/branch tuple, OPEN state and empty label list. Thus merge-ready was absent. Final local head/status and artifact hashes also remained unchanged.

Material inspected

Read the complete actual 241-line plan, exact base-to-head diff, author handoff and canonical/recovery records, actual commit topology and changed paths, the accepted spec sizing section and current artifact links. The complete accepted spec was read during my independent G2 review; its verified e5530e70a4d1247c54255b8426bd86bdf3f88d0d blob is unchanged here. Re-read the complete raw G3 round-0 report review-396-r0.md, including its nine-row assertion audit and all Important findings. Applicable current AGENTS.md, REVIEW.md, Roadmap authorization and minimum-CI rules were read in this continuing independent review session.

Direct comparison found exactly nine changed lines: 2, 39 and 45–51. These are one spec hash and eight numeric sizing lines. All remaining bytes are unchanged, including the seven implementation paths, fixed dependency closure, implementation sequence, security boundaries, complete nine proof rows and validation requirements. The total diff is one plan file, 9 additions and 9 deletions. No implementation or spec/intent change appears in the branch diff.

Pass 1 — Bugs

No Important finding.

The three component allocations sum to 2,431–2,651 lines; the two proof allocations sum to 1,896–2,106; documentation/manifest allocation is 154. Their total is 4,481–4,911, matching the accepted spec exactly and leaving 289 lines below the 5,200 ceiling. The allowance remains 4,400–5,200 added plus removed lines for the same concern. These allocations guide completion of existing work; they do not demonstrate repaired behavior or guarantee the eventual implementation fits.

All ten actual dependency SHA-256 values match the unchanged plan table, including protocol, selector, registry and seven selected-generation files. The unchanged real fixture builder blob is 6e68f390c532b54cdf775ab4065251698797f424. No moved dependency requires a new design in this amendment. Normal selector/registry use remains mandatory; the G3 hardcoded-generation finding is not waived.

Pass 2 — Security

No Important finding.

No executable code, limit, authority boundary, credential/network scope, installation, activation or target permission changes. The existing descriptor, content-integrity, streaming/accounting, publication, lifecycle and restoration requirements remain binding. In particular the complete G3 source findings and missing proof still require implementation repair and fresh evidence; a larger allowance is not their resolution.

Pass 3 — Compliance

No Important finding.

The current Roadmap delegation permits this reasonable in-scope size amendment while preserving stage order and independent acceptance. G2 spec amendment #399 landed first. A separate artifact author updates only the plan while the original implementation remains paused; I independently verified implementation HEAD 59e3a31 and clean status. The same implementation attempt must continue under its existing claim/round after the manager completes the gate sequence.

The deterministic plan branch preserves its prior history. Refresh merge 82a6244 has exactly two parents: prior plan head 5a14221, then current base b038742. Its tree equals the base tree, 025413f8618275dfd5c1163bd524039c008afdff. The amendment head b712812 has only that refresh as parent and changes only plan.md. Both non-merge commits unreachable from the current base—b712812a76b852181c01b784be6f065ac3835650 and historical 879a780—touch only the plan path. There is no code-then-revert history.

The recovery record states the original remote branch was absent and the missing registered worktree retained an index matching the prior merged plan head. It records restoration of tracked index content at that same path, preserving metadata; missing untracked/unstaged historical bytes are not claimed restored. The actual topology, current clean state and exact tree comparisons corroborate the preserved branch result. This review performs no recovery mutation.

PR text uses Tracks #327 and one review_size token. The historical inspected-base sentence is unchanged provenance, not the current acceptance tuple; this report and the manager's eventual plan-base record bind the current tuple. No new framework, proof reduction, concern or path is introduced. No simplification change is needed for this minimal hash/numeric amendment.

CI, hashes and limits

Final remote check reports quick workflow 35685004725: checks SUCCESS and required aggregate ci SUCCESS. The automatic test job is SKIPPED under the accepted minimum-CI policy; Cloudflare Pages is successful. This does not establish complete Linux or Darwin implementation proof. No source, imports, tests or generated product commands were executed by this reviewer.

Before/after SHA-256 values:

• Plan: 5a4fc52bbd1db1e334542472012597d2a06d092536390c453487f516f55a06c5.
• Spec: 1d54351de379d5d5f260c5c4cdc2cd04f45c8925dca2075b4e9119191f798cee.
• Intent: 160f579f3f098dc2e8792cc8bb2d610a43ab6ad7286536fcc2dbd6d224cb640f.

Only this requested raw report was written; no repository source, Git state, cache or forge mutation occurred. Before protected merge the manager must reverify the exact head/base and required CI, read this complete verdict, then record the containing merged plan-base. The preserved implementation must adopt current main through normal history and recheck the accepted artifact/dependency tuple before the original Sol author resumes. Any changed plan meaning or base movement invalidates this exact-tuple review and requires fresh independent acceptance. All G3 repairs and complete relevant proof remain outstanding.