carlos / platform Public

Plan 4 of 5 of the tenant email sender work, and the first half of what discussion #148 needs: a third config bundle layer scoped to one instance, resolved after the named environment, plus the ack that proves a credential reached the instance it was written for.

Eleven tasks, each reviewed, then a whole-branch pass. Nothing here sends email and nothing is member-facing. The layer is written only by the platform, and step 5 is its first caller, so every behaviour change it makes to existing routes is risk with no offsetting benefit until that lands. That is why the standard for every task was: a route with no overlay resolves to the same bytes and does not restart.

Five claims the plan rests on, all true of the final state and four pinned by tests that fail under mutation: a route with no overlay resolves byte-identically and does not restart; an overlay standing alone converges rather than reading as a removal; removing an overlay converges back to the bundles; writing the layer moves the app's generation and not the route fingerprint; an unresolved overlay leaves the file alone on both sweeps. The fifth, byte-identity across the roll boundary, was proven by a cross-binary harness that is not in the tree.

Two defects worth knowing about, both caught by review rather than by tests. One task narrowed the #344 account-mis-stamp hold so an overlay bypassed it, which would have replaced a delivered config file and bounced the route onto it; that guard is back at full strength with a test. And one task copied another's pre-fix logging pattern, so both swallowed per-host failures behind a per-app dedup; both now report per host.

Roll note in README names the new failure mode: a box that cannot list the instances-config prefix freezes every route of that app on its last-good file until the listing recovers. In-repo policies grant ListBucket with no prefix condition, so platform boxes are fine.

Plan 2 landed as ce24be04. Plan 5, instance senders and the doors, is written and not built.