{
  "feature_name": "ha-term-safety",
  "created_at": "2026-06-21T09:34:18Z",
  "updated_at": "2026-07-17T11:00:00Z",
  "language": "en",
  "phase": "implementation-complete",
  "approvals": {
    "requirements": {
      "generated": true,
      "approved": true
    },
    "design": {
      "generated": true,
      "approved": true
    },
    "tasks": {
      "generated": true,
      "approved": true
    }
  },
  "ready_for_implementation": true,
  "updated_at_tasks": "2026-06-21T18:00:00Z",
  "blocked_on": [],
  "validate_impl": {
    "decision": "GO",
    "validated_at": "2026-07-17T11:00:00Z",
    "note": "First post-implementation validation run -- all 19 tasks (1.1-5.5) were already [x] with no prior validate_impl record. Full suite 9/9 green, 46/46 requirement acceptance criteria mapped, fresh 6-round live chaotic-multi-kill soak PASS (zero committed divergence/job loss), boundary/dependency direction clean (src/lib/raft untouched across all 35 tagged commits).",
    "known_limitations": [
      "design.md's 'Commit-source switch' section describes the originally-planned architecture (library commit_index replacing the term-blind safe-commit); as shipped (commit 83fbed2, reviewer-approved with a RED->GREEN Figure-8 safety proof), the durable-majority barrier + own-term WAL_NOOP gate remain authoritative and raft_commit_index is purely advisory (commit.c:154). Design doc not updated to match; behavior is correct and safety-proven, this is a documentation-drift note only.",
      "design.md's AppendEntries send-side architecture (on_send_append_entries/raft_send_append_entries, task 2.3) is dormant in production per a later cross-spec comment (raft-ha-core-safety task 6.2, ha.c:2530-2536) -- the live send path is the pre-existing repl_broadcast, patched by task 3.4 to carry entry.term/prev_log_term. The receive side IS live and correctly processes these entries -- live-verified safe, just not what the design.md diagram depicts. Documentation-drift note only. RESOLVED 2026-07-29: raft-adapter-conformance has now formally documented and regression-guarded this exact drift -- see src/controller/CLAUDE.md's TLA+ Action-to-Code Mapping table (the dormant nextIndex-driven sender row) and that spec's design.md 'Decision: dormant AppendEntries sender resolution' section for the authoritative disposition; a future reader should land there instead of re-discovering this drift.",
      "ha.c:1844 has a stale 'TODO(ha-term-safety task 2.x): REPLACE these stubs' header comment whose own body lines each say '-- IMPLEMENTED'; a companion stale doc-comment sits in ha_convergence.c ~357-360 describing retired behavior. Cosmetic only, self-flagged in tasks.md's own 5.5 cleanup list, never executed."
    ]
  }
}