carlos / platform Public

plan: draft 3 — close plan review 2

Four blockers, and one of them is this project repeating itself.

Task 5 breaks roughly twenty-five existing tests and named two. Draft 2
caught exactly that omission for task 4 — every fixture arming a scanner
with no deployment record fails once the doors read one — and then made
the same omission in the task it added to fix it. enableScanning and
scanArmed now write the record, the affected tests are listed, and the
plan says where the check goes in RunSweep, because putting it before
the Enabled early return changes what an existing test means.

My "RGW-gated" fix was wrong in a way that would have cost coverage.
store_rgw_test.go is not env-gated at all; it stands up an in-process
httptest fake, which is precisely the seam I claimed did not exist.
Gating the PageLister test would have left the drain's StartAfter and
MaxKeys path unexercised in CI — the one path that matters.

The queue core was ordered before the result object, so DrainApp would
have landed with nowhere to put an unrecorded verdict: the §5.2.1 bug
the result object exists to prevent, delivered by the plan meant to
prevent it. Result object moves to task 9, and the drain's two duties
around it get named tests.

Enqueue had been dropped from the queue task's Produces while the test
that needs it stayed, so nothing produced it.

Also: DrainApp had no described return and QueueIndex no enumeration or
depth, which would have had console reaching back for the mutex the
split exists to hide. The trash test was named "Skips" after the
sweep's behaviour when the drain must delete, and a test named skips
gets implemented as skips. And task 15's idempotence test could not have
passed: appconfig.Seal uses a fresh ephemeral key and nonce every call,
so the ciphertext always differs — rotation compares a recorded key id
instead.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>