tests excluded, all 9 cluster tests passing separately, no compile warnings, no

hidden skips, and 83.14% line coverage before merging cluster coverage. Keep

that result as historical evidence, but rerun the complete gate for each

candidate. Gate 0 remains blocked until the missing JavaScript suite exists and

runs.

candidate. The implementation status below supersedes the historical blockers.

### Gate 0 implementation status

  fails when browser-side voice behavior regresses.

- Removed the remaining test-compilation warnings and made

  `mix test --warnings-as-errors` part of `mix precommit`.

- Replaced Ra's captured session-query functions with stable

  module-function-argument descriptors. The cluster suite now runs under

  coverage without a peer crashing on an instrumented function identity.

- Merged the default and cluster coverage exports locally. The combined result

  is 83.37%; the exact-SHA receipt and enforced floor remain pending.

Gate 0 still requires the merged default and cluster coverage report, release

startup proof against a disposable database, and an exact-SHA gate receipt.

Gate 0 still requires an enforced coverage floor, release startup proof against

a disposable database, and an exact-SHA gate receipt.

Do not use the current green suite as evidence for untested code. The updated

coverage audit records strong Issues and Projects coverage and the defects it

`assets/package.json` provides `npm test`, and `mix precommit` runs the suite

through `mix assets.test`.

The first merged coverage attempt also exposed an instrumented anonymous Ra

query that crashed on a peer with `badfun`. Session-registry queries now use

stable module-function-argument descriptors, and all 9 cluster tests complete

under coverage. The merged default and cluster result is 83.37%.

## A2. Blocker: staging is not isolated from production today

Gate 12 lists staging isolation as a requirement and Gate 15 calls for failure

  # ── query builders (used with :ra.consistent_query) ────────────────────────

  @doc "A linearizable query function returning the entry for `id` (or nil)."

  def lookup(id), do: fn %{sessions: sessions} -> Map.get(sessions, id) end

  @doc "A linearizable query descriptor returning the entry for `id` (or nil)."

  def lookup(id), do: {__MODULE__, :lookup_query, [id]}

  @doc "A linearizable query function returning all session ids owned by `node`."

  def owned_by(owner) do

    fn %{sessions: sessions} ->

      for {id, %{owner: ^owner, status: :claimed}} <- sessions, do: id

    end

  @doc "A linearizable query descriptor returning all session IDs owned by `node`."

  def owned_by(owner), do: {__MODULE__, :owned_by_query, [owner]}

  @doc false

  def lookup_query(id, %{sessions: sessions}), do: Map.get(sessions, id)

  @doc false

  def owned_by_query(owner, %{sessions: sessions}) do

    for {id, %{owner: ^owner, status: :claimed}} <- sessions, do: id

  end

  # ── internal ───────────────────────────────────────────────────────────────

               "command #{inspect(command)} on #{inspect(s)} => #{inspect(reply)}, expected #{inspect(expected)}"

        # The committed generation in the machine never goes backwards.

        if entry = Reg.lookup(id).(new_machine) do

        if entry = query(Reg.lookup(id), new_machine) do

          assert entry.generation >= s.gen

        end

  # Before any claim (gen 0) the session has no entry, so the fence replies nil.

  defp fence_gen(0), do: nil

  defp fence_gen(gen), do: gen

  defp query({module, function, arguments}, state),

    do: Kernel.apply(module, function, arguments ++ [state])

end

  defp run(cmd, state), do: Kernel.apply(Reg, :apply, [%{}, cmd, state])

  defp query({module, function, arguments}, state),

    do: Kernel.apply(module, function, arguments ++ [state])

  test "claim bumps the generation monotonically and records the owner" do

    s0 = Reg.init(%{})

    assert {s1, {:ok, 1}} = run({:claim, "j1", :delegation, :a@h}, s0)

    assert Reg.lookup("j1").(s1) == %{

    assert query(Reg.lookup("j1"), s1) == %{

             kind: :delegation,

             generation: 1,

             owner: :a@h,

    # A re-claim (handoff to another node) bumps the generation and re-owns.

    assert {s2, {:ok, 2}} = run({:claim, "j1", :delegation, :b@h}, s1)

    assert Reg.lookup("j1").(s2).owner == :b@h

    assert Reg.lookup("j1").(s2).generation == 2

    assert query(Reg.lookup("j1"), s2).owner == :b@h

    assert query(Reg.lookup("j1"), s2).generation == 2

  end

  test "checkpoint is accepted for the current generation and fenced for a stale one" do

    # The new owner (gen 2) checkpoints successfully.

    assert {s3, :ok} = run({:checkpoint, "j1", 2, %{step: 5}}, s2)

    assert Reg.lookup("j1").(s3).checkpoint == %{step: 5}

    assert query(Reg.lookup("j1"), s3).checkpoint == %{step: 5}

    # The superseded zombie (gen 1) is fenced — its checkpoint is rejected and

    # the committed state is untouched.

    assert {^s3, {:fenced, 2}} = run({:checkpoint, "j1", 1, %{step: 99}}, s3)

    assert Reg.lookup("j1").(s3).checkpoint == %{step: 5}

    assert query(Reg.lookup("j1"), s3).checkpoint == %{step: 5}

  end

  test "finish is fenced for a stale generation; a zombie cannot terminal-commit" do

    # Zombie (gen 1) tries to finish — fenced, state unchanged.

    assert {^s2, {:fenced, 2}} = run({:finish, "j1", 1}, s2)

    assert Reg.lookup("j1").(s2).status == :claimed

    assert query(Reg.lookup("j1"), s2).status == :claimed

    # Live owner (gen 2) finishes.

    assert {s3, :ok} = run({:finish, "j1", 2}, s2)

    assert Reg.lookup("j1").(s3).status == :terminal

    assert query(Reg.lookup("j1"), s3).status == :terminal

  end

  test "a terminal session is never re-claimed" do

    {s3, _} = run({:claim, "j3", :job, :b@h}, s2)

    {s4, :ok} = run({:finish, "j1", 1}, s3)

    assert Enum.sort(Reg.owned_by(:a@h).(s4)) == ["j2"]

    assert Reg.owned_by(:b@h).(s4) == ["j3"]

    assert Enum.sort(query(Reg.owned_by(:a@h), s4)) == ["j2"]

    assert query(Reg.owned_by(:b@h), s4) == ["j3"]

  end

end