carlos / platform Public

console+release: the smaller holes the same two reviews found

Five, none of them in the queue, and four of them the same shape: a rule that
holds everywhere except in the one place nobody looked.

THE MIGRATION SEED TREATED A LOST RACE AS AGREEMENT. The create-only write
converged two consoles, which is what it is for — but ErrCASConflict was read
as "somebody else enabled it" without reading what they actually wrote. An
operator running `disable` in the same instant as a migrating console's first
tick loses: the console runs a full pass over tenant bytes against the switch
that operator had just turned off. It reads the winner now.

`disable` REFUSED OVER A RECORD IT COULD NOT PARSE. An unreadable
system/antivirus.json already stops every sweep, so nothing was running — but
it also left no door that could put the deployment back into a state it can
read, and the one verb whose whole job is "stop" was refusing for the very
reason it was needed. It repairs now, taking the etag from a raw read so the
CAS stays honest; `enable` still refuses, because overwriting is a way out of
a bad state and never a way into an enabled one.

`store scan status` CLAIMED HEALTH FOR A DISABLED DEPLOYMENT. The reply
carried the per-app record and the engine's own state and never mentioned the
deployment switch, so an app enabled on a deployment where nothing sweeps read
as covered. It reports deployment_enabled, and names the command when the two
disagree — the same honesty the engine_error branch beside it already keeps
about the wiring half.

THE MINT FORM WOULD NOT SAY WHY. The Service-role account-wide refusal landed
in the API door's error arms and not the form's, so the browser door — the one
that explicitly OFFERS an account-wide credential — answered "could not mint,
try again" and sent the owner round the same impossible request. The form now
refuses before the passkey trip, as it does for every other unusable field,
with the store's check still behind it as the authority.

`S3Store.ListPage` TRUNCATED SILENTLY AT limit <= 0. Its own doc and DirStore
both say that means no bound; one ListObjectsV2 returns at most a thousand
keys and reports IsTruncated, which this ignored. It follows the truncation
now, and the bounded path is still exactly one request — that being the entire
reason the interface exists.

And the deprecated variable is finally logged loudly at boot, as §4.2.1 said
it would be: it still works, which is precisely why it needs saying, since the
seed only fires while it is set.

TestScanPassDoesNothingWhenDisabled passed against a pass with no switch check
at all: RunSweep applies its own refusal before it lists anything, so
refusingLister was never consulted, and scanPass only logs per-app errors. The
seam it asserts on moves up to storeListerFor, which scanOneApp reaches before
RunSweep. Both mutations were made and both now fail:

  conflict assumed enabled    -> TestScanPassSeedYieldsToAConcurrentDisable
  no switch check in the tick -> TestScanPassDoesNothingWhenDisabled

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01YJkJkxZZLgW8X8A5tk69Sq