carlos / platform Public

ACCEPT WITH FIXES

Finding verdicts

1. ADDRESSED — Ratchet read errors fail closed. internal/release/ratchet.go:118 now distinguishes absence from read errors and invalid file types; Admit refuses unknown state at line 100. Fresh-instance tests cover unreadable own and also directories at internal/release/ratchet_test.go:212.

1. ADDRESSED — Resign requires channel authority. internal/console/apidigests.go:121 checks deploy scope, stable, pipeline passkey and approval requirements. The authorization runs inside WithAppMutation through internal/release/claim_app_writes.go:59 and internal/release/resign.go:107. The legacy-head substitution regression is covered at internal/console/apidigests_test.go:300.

1. ADDRESSED — History-target refusals survive marker removal. The checks at internal/release/release.go:810 and :1273 no longer require the marker. Emission remains marker-dependent. Ordinary and approval-path rollback tests appear at internal/release/writers_test.go:390 and :405.

1. ADDRESSED — Incomplete reports cannot announce readiness. Failed channel reads produce explicit errors at internal/release/digests.go:183. Both consumers propagate them into account errors (internal/console/apidigests.go:243, channels_digests.go:312), suppressing readiness through channels_digests.go:235.

1. ADDRESSED — Ratchet paths no longer collide. internal/release/ratchet.go:77 encodes each channel into one flat filename. Regular-file checks appear at lines 133 and 160. Both collision orders and restart behavior are covered at internal/release/ratchet_test.go:159.

1. NOT ADDRESSED — Production integration coverage remains incomplete (Minor). Replay and require-flag coverage now uses fastPassOpts and the production-configured static handler (internal/host/pointerdigests_test.go:151, internal/edge/staticdigest_test.go:153). However: - Failed-persistence coverage still constructs options manually at internal/host/pointerdigests_test.go:60. - The new static-handler tests at internal/edge/staticdigest_test.go:241 and :281 never exercise failed persistence. - The host replay test at internal/host/pointerdigests_test.go:165 checks the live version, without substituting bytes or asserting that staging never occurred.

Complete those cases through the existing production test fixtures, including assertions that refusal prevents staging/extraction and that a later digestless replay remains refused.

1. ADDRESSED — Draft-dependent assertions removed. channels_digests_test.go:117 derives the header from its constant; lines 343 and 357 derive status expectations from constants and actual timestamp/error values. The unsafe literal-length slice is gone.

1. ADDRESSED — Existing responses are shared. internal/console/apicli.go:1222 and :1243 centralize the shipped responses, reused by the digest handlers. The moved wording is outside this review.

New breakage

No new Critical or Important breakage found in bb343ec3..d04e7634.

git diff --check passes. Tests and builds were not rerun because they create files; the fix report’s execution results remain independently unverified. No files changed.

Out-of-scope observations

Non-blocking: the documented stable-resign example now requires the direct-store operator path. The controller explicitly accepted that restriction; documentation reconciliation remains with the pending copy review.