amadan

carlos / platform Public

db-region-forward: review brief for round 4

Lists findings 1 to 18 with rev 4's answer, asks for the disposition
table, a check of invariants J1 to J5 with the long-request timeouts
first, then only new findings.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
claude 010d29f632ee9c7040154d09e85e8f921b0b3d02 parent c07629e
1 file changed, +71 −48
  • docs/superpowers/specs/CODEX-REVIEW-BRIEF-DB-REGION-FORWARD.md +71 −48

CI passed — run details

CI log 
=== gate ===
.amadan/test-gate.sh
=== launchctx (0 s)
ok  	amadan.net/carlos/platform.git/launchctx	0.014s
?   	amadan.net/carlos/platform.git/launchctx/controlname	[no test files]
?   	amadan.net/carlos/platform.git/launchctx/wireid	[no test files]
=== vet (1 s)
=== gofmt (0 s)
gofmt -l .: clean
=== rest (143 s)
?   	github.com/carlosframework/platform/cmd/changelog	[no test files]
ok  	github.com/carlosframework/platform/cmd/console	3.869s
ok  	github.com/carlosframework/platform/cmd/moveprobe	11.952s
ok  	github.com/carlosframework/platform/cmd/zddprobe	0.760s
ok  	github.com/carlosframework/platform/internal/activator	59.980s
ok  	github.com/carlosframework/platform/internal/agentsock	0.030s
ok  	github.com/carlosframework/platform/internal/alerting	0.006s
ok  	github.com/carlosframework/platform/internal/analytics	0.045s
ok  	github.com/carlosframework/platform/internal/appconfig	3.076s
ok  	github.com/carlosframework/platform/internal/apperr	0.208s
ok  	github.com/carlosframework/platform/internal/applog	0.462s
ok  	github.com/carlosframework/platform/internal/awsinv	0.008s
ok  	github.com/carlosframework/platform/internal/boxchoice	0.008s
ok  	github.com/carlosframework/platform/internal/boxid	1.069s
?   	github.com/carlosframework/platform/internal/boxid/boxidtest	[no test files]
?   	github.com/carlosframework/platform/internal/boxid/internal/signtest	[no test files]
ok  	github.com/carlosframework/platform/internal/boxvolumes	0.011s
ok  	github.com/carlosframework/platform/internal/caps	0.013s
ok  	github.com/carlosframework/platform/internal/certwarm	0.004s
ok  	github.com/carlosframework/platform/internal/cgroup	0.778s
ok  	github.com/carlosframework/platform/internal/changelog	0.531s
ok  	github.com/carlosframework/platform/internal/claimactivation	1.419s
ok  	github.com/carlosframework/platform/internal/clamd	0.069s
?   	github.com/carlosframework/platform/internal/cliflag	[no test files]
?   	github.com/carlosframework/platform/internal/controlname	[no test files]
?   	github.com/carlosframework/platform/internal/controlsock	[no test files]
ok  	github.com/carlosframework/platform/internal/dbdoor	6.214s
ok  	github.com/carlosframework/platform/internal/dbdoor/dbdoortest	0.013s
ok  	github.com/carlosframework/platform/internal/dbverify	0.010s
ok  	github.com/carlosframework/platform/internal/dnsrec	0.003s
ok  	github.com/carlosframework/platform/internal/docsite	0.009s
ok  	github.com/carlosframework/platform/internal/domains	3.210s
ok  	github.com/carlosframework/platform/internal/doorkey	0.008s
ok  	github.com/carlosframework/platform/internal/economics	0.006s
ok  	github.com/carlosframework/platform/internal/edge	45.635s
?   	github.com/carlosframework/platform/internal/edgeproof	[no test files]
ok  	github.com/carlosframework/platform/internal/edgesfile	0.009s
ok  	github.com/carlosframework/platform/internal/fleetapi	0.167s
ok  	github.com/carlosframework/platform/internal/gate	1.901s
ok  	github.com/carlosframework/platform/internal/genselect	0.041s
ok  	github.com/carlosframework/platform/internal/geo	0.012s
ok  	github.com/carlosframework/platform/internal/geoip	0.037s
ok  	github.com/carlosframework/platform/internal/historyreadback	0.279s
ok  	github.com/carlosframework/platform/internal/host	140.456s
ok  	github.com/carlosframework/platform/internal/hostactors	6.537s
ok  	github.com/carlosframework/platform/internal/hostactors/awsmembership	0.007s
ok  	github.com/carlosframework/platform/internal/hostbox	3.458s
ok  	github.com/carlosframework/platform/internal/hostclaim	0.912s
ok  	github.com/carlosframework/platform/internal/hostenv	0.005s
ok  	github.com/carlosframework/platform/internal/hostevidence	0.008s
ok  	github.com/carlosframework/platform/internal/hostexec	5.812s
ok  	github.com/carlosframework/platform/internal/hostfence	0.045s
ok  	github.com/carlosframework/platform/internal/hostfiles	10.279s
ok  	github.com/carlosframework/platform/internal/hostfloor	0.031s
ok  	github.com/carlosframework/platform/internal/hostguard	1.056s
ok  	github.com/carlosframework/platform/internal/hostops	2.438s
?   	github.com/carlosframework/platform/internal/hostops/fencerelease	[no test files]
ok  	github.com/carlosframework/platform/internal/hostops/internal/fencerelease	0.002s
ok  	github.com/carlosframework/platform/internal/hostquarantine	0.004s
ok  	github.com/carlosframework/platform/internal/hostrelocate	0.652s
ok  	github.com/carlosframework/platform/internal/hostresolve	0.245s
ok  	github.com/carlosframework/platform/internal/hostwrite	0.015s
ok  	github.com/carlosframework/platform/internal/infraview	0.017s
ok  	github.com/carlosframework/platform/internal/instancectl	5.271s
ok  	github.com/carlosframework/platform/internal/instanceexec	2.831s
ok  	github.com/carlosframework/platform/internal/instancefs	0.005s
ok  	github.com/carlosframework/platform/internal/instancekey	0.003s
ok  	github.com/carlosframework/platform/internal/instanceupdates	0.009s
ok  	github.com/carlosframework/platform/internal/layout	2.034s
ok  	github.com/carlosframework/platform/internal/lbhealth	0.004s
ok  	github.com/carlosframework/platform/internal/lease	10.265s
ok  	github.com/carlosframework/platform/internal/lease/leasetest	0.630s
ok  	github.com/carlosframework/platform/internal/ledger	0.029s
ok  	github.com/carlosframework/platform/internal/mail	0.243s
ok  	github.com/carlosframework/platform/internal/maintenance	0.081s
ok  	github.com/carlosframework/platform/internal/maintenanceexec	5.606s
ok  	github.com/carlosframework/platform/internal/maintenanceguard	0.141s
ok  	github.com/carlosframework/platform/internal/metrics	0.008s
ok  	github.com/carlosframework/platform/internal/moves	21.816s
ok  	github.com/carlosframework/platform/internal/moves/archive	1.129s
ok  	github.com/carlosframework/platform/internal/objstore	0.318s
ok  	github.com/carlosframework/platform/internal/ops	0.267s
ok  	github.com/carlosframework/platform/internal/park	0.308s
ok  	github.com/carlosframework/platform/internal/plans	0.007s
ok  	github.com/carlosframework/platform/internal/privatefile	0.007s
ok  	github.com/carlosframework/platform/internal/provision	14.135s
ok  	github.com/carlosframework/platform/internal/publicrelease	0.009s
?   	github.com/carlosframework/platform/internal/regionname	[no test files]
ok  	github.com/carlosframework/platform/internal/registry	5.762s
ok  	github.com/carlosframework/platform/internal/relay	7.236s
ok  	github.com/carlosframework/platform/internal/release	25.649s
ok  	github.com/carlosframework/platform/internal/rollout	3.892s
ok  	github.com/carlosframework/platform/internal/rolloutwords	0.007s
ok  	github.com/carlosframework/platform/internal/rootaws	0.008s
ok  	github.com/carlosframework/platform/internal/rootparticipation	0.065s
ok  	github.com/carlosframework/platform/internal/rootstate	0.031s
ok  	github.com/carlosframework/platform/internal/runs	0.581s
ok  	github.com/carlosframework/platform/internal/s3compat	0.006s
ok  	github.com/carlosframework/platform/internal/safefile	0.006s
ok  	github.com/carlosframework/platform/internal/schedule	2.810s
ok  	github.com/carlosframework/platform/internal/seeds	0.017s
ok  	github.com/carlosframework/platform/internal/sim/engines	2.971s
ok  	github.com/carlosframework/platform/internal/sim/hostlife	11.668s
ok  	github.com/carlosframework/platform/internal/sim/litestreamfacts	3.509s
ok  	github.com/carlosframework/platform/internal/status	0.082s
ok  	github.com/carlosframework/platform/internal/steering	0.008s
ok  	github.com/carlosframework/platform/internal/stopevidence	0.262s
ok  	github.com/carlosframework/platform/internal/svcrole	0.004s
ok  	github.com/carlosframework/platform/internal/telemetry	0.005s
ok  	github.com/carlosframework/platform/internal/termfence	0.004s
ok  	github.com/carlosframework/platform/internal/tunnelclient	0.005s
ok  	github.com/carlosframework/platform/internal/unixdial	0.006s
ok  	github.com/carlosframework/platform/internal/updatewords	0.006s
ok  	github.com/carlosframework/platform/internal/usage	0.008s
ok  	github.com/carlosframework/platform/internal/version	0.002s
ok  	github.com/carlosframework/platform/internal/vet	1.691s
=== internal_console@0 (86 s)
ok  	github.com/carlosframework/platform/internal/console	83.835s
=== internal_console@1 (35 s)
ok  	github.com/carlosframework/platform/internal/console	32.786s
=== internal_console@2 (41 s)
ok  	github.com/carlosframework/platform/internal/console	39.679s
=== internal_console@3 (36 s)
ok  	github.com/carlosframework/platform/internal/console	34.678s
=== internal_console@4 (39 s)
ok  	github.com/carlosframework/platform/internal/console	36.600s
=== internal_console@5 (40 s)
ok  	github.com/carlosframework/platform/internal/console	37.876s
=== internal_console@6 (42 s)
ok  	github.com/carlosframework/platform/internal/console	39.949s
=== internal_console@7 (42 s)
ok  	github.com/carlosframework/platform/internal/console	40.439s
=== root@0 (33 s)
ok  	github.com/carlosframework/platform	31.004s
=== root@1 (45 s)
ok  	github.com/carlosframework/platform	42.755s
=== root@2 (42 s)
ok  	github.com/carlosframework/platform	40.535s
=== cross ===
--- shard 0 of 5 ---
cross-compiling darwin/arm64
--- shard 1 of 5 ---
cross-compiling darwin/amd64
--- shard 2 of 5 ---
cross-compiling linux/arm64
linux/arm64 carlos binary: 50069666 bytes (ceiling 52000000)
--- shard 3 of 5 ---
cross-compiling windows/amd64
--- shard 4 of 5 ---
cross-compiling windows/arm64
=== minio-contract ===
minio contract: arm64, minio RELEASE.2025-09-07T16-13-09Z, mc RELEASE.2025-08-13T08-35-41Z
  minio: cached, digest verified
  mc: cached, digest verified
  minio healthy on 127.0.0.1:20999
Added `local` successfully.
Bucket created successfully `local/contract-bucket`.
Bucket created successfully `local/denied-bucket`.
Created policy `contract-only` successfully.
Added user `scopeduser` successfully.
Attached Policies: [contract-only]
To User: scopeduser
  buckets and scoped user ready
=== RUN   TestDeliveredContractMinio
=== RUN   TestDeliveredContractMinio/put
=== RUN   TestDeliveredContractMinio/get_round-trips_the_body
=== RUN   TestDeliveredContractMinio/list_shows_the_key
=== RUN   TestDeliveredContractMinio/head_and_list_agree_on_the_version
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_its_own_object
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/not_by_PutObjectTagging
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/and_not_by_x-amz-tagging_on_upload
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CreateMultipartUpload
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CopyObject_with_a_REPLACE_tagging_directive
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/but_multipart_itself_is_allowed
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_copy_itself_is_allowed
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/a_POST-policy_forged_tag_with_a_matching_version_is_still_not_a_verdict
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_an_ordinary_tagged-with-something-else_upload_is_allowed
=== RUN   TestDeliveredContractMinio/delete_removes_it
=== RUN   TestDeliveredContractMinio/cross-bucket_denial
--- PASS: TestDeliveredContractMinio (0.02s)
    --- PASS: TestDeliveredContractMinio/put (0.00s)
    --- PASS: TestDeliveredContractMinio/get_round-trips_the_body (0.00s)
    --- PASS: TestDeliveredContractMinio/list_shows_the_key (0.00s)
    --- PASS: TestDeliveredContractMinio/head_and_list_agree_on_the_version (0.00s)
    --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/not_by_PutObjectTagging (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/and_not_by_x-amz-tagging_on_upload (0.00s)
    --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route (0.01s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CreateMultipartUpload (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CopyObject_with_a_REPLACE_tagging_directive (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/but_multipart_itself_is_allowed (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_copy_itself_is_allowed (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/a_POST-policy_forged_tag_with_a_matching_version_is_still_not_a_verdict (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_an_ordinary_tagged-with-something-else_upload_is_allowed (0.00s)
    --- PASS: TestDeliveredContractMinio/delete_removes_it (0.00s)
    --- PASS: TestDeliveredContractMinio/cross-bucket_denial (0.00s)
PASS
ok  	github.com/carlosframework/platform/internal/objstore	0.027s
=== RUN   TestT4StorageProbeMinio
2026/10/22 11:54:07 moves: T4: STORE: list: operation error S3: ListObjectsV2, https response error StatusCode: 403, RequestID: 18E0D7E902DF71D8, HostID: 7c420053e0fbcd7f41653fdd92ffa2802c903d05303b1aa15adc2e8bb65d183f, api error SignatureDoesNotMatch: The request signature we calculated does not match the signature you provided. Check your key and signing method.
--- PASS: TestT4StorageProbeMinio (0.01s)
PASS
ok  	github.com/carlosframework/platform/internal/host	0.023s
minio contract: PASS
diff --git a/docs/superpowers/specs/CODEX-REVIEW-BRIEF-DB-REGION-FORWARD.md b/docs/superpowers/specs/CODEX-REVIEW-BRIEF-DB-REGION-FORWARD.md
index e3d48cc88..e96d36109 100644
--- a/docs/superpowers/specs/CODEX-REVIEW-BRIEF-DB-REGION-FORWARD.md
+++ b/docs/superpowers/specs/CODEX-REVIEW-BRIEF-DB-REGION-FORWARD.md
@@ -7,39 +7,46 @@ yet; you are reviewing the design against the code on `main`.
**Spec:** `docs/superpowers/specs/2026-10-22-db-region-forward-design.md`,
at the commit named in the prompt. Read `AGENTS.md` first.
-## Round 3
-
-This is round 3. Rev 3 of the spec answers your round 2 findings,
-`docs/superpowers/specs/CODEX-FINDINGS-DB-REGION-FORWARD-R2.md` (reviewed
-at `8c118ae7`). Your round 1 findings are in
-`CODEX-FINDINGS-DB-REGION-FORWARD.md`. Each change is marked
-**(codex N)** where it lands, and §18 records what was declined.
-
-Rounds 1 and 2 kept finding defects in one area: which object ends a read,
-and who deletes what when. Rev 3 does not patch those cases one by one. It
-states the lifecycle as seven invariants (§5.2, I1 to I7) and builds the
-simplest mechanism that keeps them: every protocol object is a create-only
-write under `db-reads/`, nothing in the protocol replaces or deletes
-anything, one create-only `result.json` decides how a read ended, and a
-bucket lifecycle rule expires everything.
-
-| # | Finding | Round 2 said | Rev 3's answer |
+## Round 4
+
+This is round 4. Rev 4 of the spec answers your round 3 findings,
+`docs/superpowers/specs/CODEX-FINDINGS-DB-REGION-FORWARD-R3.md` (reviewed
+at `20524df4`). Rounds 1 and 2 are in `CODEX-FINDINGS-DB-REGION-FORWARD.md`
+and `-R2.md`. Each change is marked **(codex N)** where it lands, and §18
+records what was declined.
+
+Every round so far found defects from one source: a read was a durable,
+resumable object with its own lifecycle (follow, cancel, lazy expiry,
+console-written `lost` and `expired`, admission that outlived the
+request). Rev 4 removes that lifecycle. **A forwarded read is one
+synchronous HTTP request** (§5.2): the CLI's request stays open for the
+whole read, the console waits on the box's objects inside it and streams
+them back as newline-delimited JSON, and when the request ends the read is
+over for everyone. There is no follow route, no cancel route, no
+console-written `picked`, `lost` or `expired`, and the store's lifecycle
+rule is the only deletion. Rev 3's seven invariants are replaced by five,
+J1 to J5 (§5.3).
+
+| # | Finding | Round 3 said | Rev 4's answer |
|---|---|---|---|
-| 1 | incarnation check does not cover the replica reads | fixed; pinning decline agreed | unchanged, §8.2 |
-| 2 | `Accept=yes` does not put the connection on stdin | fixed | unchanged, §8.3 |
-| 3 | progress ack indistinguishable from the final ack | fixed | superseded: no acks at all (I1, I4), §5.2, §9.1 |
-| 4 | late writes after `lost` | partly | I4 and I5: `lost` is a conditional create of `result.json`, so storage decides between it and a late box result; late chunks are never accepted, §5.2, §5.8 |
-| 5 | cleanup reopens the election | fixed | `picked` is never deleted by the protocol (I1, I2) |
-| 6 | the CLI cannot promise it showed none | fixed | unchanged, §5.5 |
-| 7 | the window does not bound stored ciphertext | partly | I1 and I2: no deletes; the lifecycle rule expires current and noncurrent versions; the bound is restated as at most the output cap per read for at most two days, §5.7. This invalidates the bound in provisional ruling 1, which §16 flags for re-confirmation |
-| 8 | disk reservations | partly | the two-minute escape is gone; a reservation is released only when the worker unit has stopped; the agent admits nothing while an orphan worker unit is active; the worker cancels its work on EOF, §5.7, §8.3 |
-| 9 | worker readiness | partly | `MaxConnections=3`: two reads and one connection kept for the probe; a blocked probe is skipped, not failed, §7.1, §8.3 |
-| 10 | incomplete snapshot evidence | partly | incomplete evidence (either flag false) is checked first and admits; DBF-1 and DBF-2 both need `Complete` and `BoxesComplete`, §7.1 |
-| 11 | separate store endpoints | decline agreed | unchanged, §12, §18 |
-| 12 | census classifications | fixed | unchanged apart from the new sites, §13 |
-| 13 | completion deletes the evidence that a read ended | new | I1 and I4: nothing is deleted on completion; the result stays until expiry, §5.2 |
-| 14 | cleanup removes the identity needed to follow | new | I1, I2 and I6: the request lives as long as every other object of the read, §5.2, §5.3 |
-| 15 | the full db gate on follow routes hides `record-changed` | new | two gates: only create reads the current record; follow and cancel check membership and the signed request, §9.1 |
+| 1 | incarnation check | fixed; pinning decline agreed | unchanged, §8.2 |
+| 2 | socket on stdin | fixed | unchanged, §8.3 |
+| 3 | progress versus completion ack | fixed | removed by the synchronous design |
+| 4 | late writes after `lost` | fixed | removed by the synchronous design: the console never writes `lost` |
+| 5 | cleanup reopens the election | fixed | J2, J4 |
+| 6 | "showed none" | fixed | unchanged; a response that ends without a result also prints nothing, §5.5 |
+| 7 | stored-ciphertext bound | partly | J4 with an honest timing statement and no hard bound, §5.7; ruling 1's bound flagged for Paul, §16 |
+| 8 | disk reservations | fixed | unchanged, and `CheckDBContext` named, §8.3 |
+| 9 | worker readiness | fixed | unchanged |
+| 10 | snapshot evidence | fixed | unchanged |
+| 11 | separate store endpoints | decline agreed | unchanged |
+| 12 | census | fixed | updated for one route and no delete site, §13 |
+| 13 | completion deletes terminal evidence | partly | removed by the synchronous design: nothing needs the evidence after the request ends |
+| 14 | cleanup removes follow identity | partly | removed by the synchronous design: there is no follow |
+| 15 | full db gate on follow routes | fixed | removed by the synchronous design: one route, one gate at the start, `record-changed` in the same response |
+| 16 | lazy expiry strands a read | new | removed by the synchronous design (the console writes no `picked` or result); J3's read-back for a box's ambiguous `picked`, §5.4 |
+| 17 | abandoned reads hold admission | new | J5: the console's counts are released by the handler's return, §5.7 |
+| 18 | the forgery claim contradicts sealing | new | withdrawn; §5.6 states the trust boundary plainly |
The provisional rulings in §16 await Paul. Do not argue them; report only
a mechanism that fails to honour one. Ruling 1's bound is flagged by the
@@ -47,24 +54,29 @@ spec itself; you need not report it again.
**Your answer has three parts, in this order.**
-1. **A disposition table** for findings 1 to 15: fixed, declined with an
+1. **A disposition table** for findings 1 to 18: fixed, declined with an
acceptable reason, or not fixed. Check each answer against the code, not
against the spec's summary of it.
-2. **An invariant check.** For each of I1 to I7 in §5.2: does every
- mechanism in the spec keep it (name any write, delete, route or timer
- that breaks it, with the section), and does the "closed by" table in
- §5.2 hold, finding by finding? Look in particular for:
- - any protocol path that still deletes or replaces an object, including
- the housekeeping pass and its boundary with the protocol;
- - any way two parties both believe they own a read or ended it;
- - whether `expired` and `lost` created lazily on follow calls can be
- missed, doubled or created against a read that is still being picked;
- - whether conditional creates behave as the spec needs on S3 and on
- MinIO, including a create whose answer is lost, and the box's
- read-back rule in §5.3;
- - whether the queue under `db-reads/queue/<region>/<hour>/` can make a
- box miss a read across an hour boundary or a clock skew;
- - whether the storage bound in §5.7 is now true on a versioned bucket.
+2. **An invariant check.** For each of J1 to J5 in §5.3: does every
+ mechanism in the spec keep it (name any write, route, timer or state
+ that breaks it, with the section), and does the mapping table in §5.3
+ hold, finding by finding? Look in particular for:
+ - **the long request.** §5.2 claims that nothing on the real path (the
+ edge's public listeners and reverse proxies, the console's
+ `http.Server` with its 5-minute `ReadTimeout`, the CLI's clients)
+ cuts a request of up to 22 minutes, and that the console can lift its
+ read deadline per request as the import door does. Check each number
+ and line it cites, and Go's actual `ReadTimeout` behaviour once a
+ handler has read its body. Name any timeout the spec missed;
+ - anything on the console side that outlives the request (J1), or an
+ admission count released anywhere but the handler's return (J5);
+ - any protocol delete or replacing write (J2, J4);
+ - the box's `picked` read-back rule (J3) against a create whose answer is
+ lost on S3 and on MinIO;
+ - whether a box that keeps running after the console gave up can harm a
+ later read, a later request with the same envelope, or the disk;
+ - whether the storage statement in §5.7 is now true, without a hard
+ bound it cannot keep.
3. **Only new findings.** Do not repeat an earlier finding unless its fix
is wrong or incomplete; then say so in the table and give the new
evidence.
@@ -120,6 +132,17 @@ for every claim about existing code. These are the places that matter.
precedent;
- `internal/appconfig/crypto.go`: the sealing construction the spec reuses.
+**The long request (round 4):**
+
+- `internal/edge/edge.go`: the public listeners (around lines 3188 and
+ 3354) and `unixProxy` and `tcpProxy` (around line 2377);
+- `cmd/console/main.go`: the console's `http.Server` (around line 586);
+- `internal/console/apiinstanceimport.go`: the per-request read deadline
+ (around line 479);
+- `auth.go` (the CLI's 30 s console client) and `apimode.go` (`shipTimeout`);
+- `internal/console/apidb.go`: `handleAPIDBGet` and `dbStream`, the
+ streaming precedent.
+
**Boxes, capability and sandbox:**
- `internal/host/edgesfile.go` (capabilities), `movesoffline.go` and