carlos / platform Public

Verdict: ACCEPT

Round-1 findings

1. ADDRESSED — internal/release/materializeheld.go:126 skips digestless entries on channels carrying digests and continues looking for evidence. The regression at internal/release/heldauth_test.go:381 checks refusal and no downloads with the flag both off and on.
2. ADDRESSED — internal/release/materializeheld.go:107 calls Admit before checking whether the pointer names the requested version, following R15. Naming-pointer retry behavior remains intact; ratchet.go:168 remembers observations before persistence. The two-pass replay regression is at internal/release/heldauth_test.go:418.
3. ADDRESSED — internal/edge/storedoor.go:451 grants only the exact five-segment promotion-record shape for the owning account, validating app and version. Listing, writes, and deletes remain denied. internal/edge/fleetapi_e2e_test.go:628 exercises record-only authorization and digest-mismatch refusal through the actual door and fleet client.
4. ADDRESSED — internal/updatewords/words_authorize.go:43 now reports an unconfirmed write and advises retrying, without claiming nothing was signed.

New findings

None. No new Critical or Important problem found in the fix diff.

Out of scope

None.

Read-only source review of 98e3f164..2c3f0ad8. Reviewed the reported test and mutation evidence; did not rerun tests or modify files.