| 1 | | Earlier finding | Disposition | |
| 2 | |---|---| |
| 3 | | R1.1 — Manual purge omits settlement | Fixed: Task 7 settles before purge prerequisites and teardown. | |
| 4 | | R1.2 — Destructive handlers retain pre-lock decisions | Fixed: existence and protection are rechecked under the lock. | |
| 5 | | R1.3 — `ErrNotTrashed` tests bypass recovery | Fixed: the hook removes the marker between reads and asserts recovery runs. | |
| 6 | | R1.4 — Static-instance test accepts unrelated failures | Fixed: requires 201 and verifies the stored record. | |
| 7 | | R1.5 — Empty `--ttl` selects ordinary deployment | Fixed: explicit flag presence is checked and tested. | |
| 8 | | R2.1 — Required implementation file omitted from commit | Fixed: Task 5 stages `internal/console/svcprincipal.go`. | |
| 9 | | R2.2 — Settlement breaks trash retries | Fixed: an existing marker permits the ordinary idempotent success path. | |
| 10 | | R2.3 — Refusal wording breaks existing assertions | Fixed: API trash and purge reuse their existing refusal wording. | |
| 11 | |
| 12 | Reviewed `c3bb6fba`. Static review only; no files changed or tests run. |
| 13 | |
| 14 | 1. **P1 — Task 10, Step 3: the browser delete confirmation still promises 30 days.** |
| 15 | Task 10 changes the success flash but omits the confirmation template from its [file list](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/temporary-sites/docs/superpowers/plans/2026-09-26-temporary-static-sites.md:4804). That template still renders `{{trashCooloffDays}}` at [app_settings.html:492](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/temporary-sites/internal/console/templates/app_settings.html:492), whose helper always returns 30 at `internal/console/server.go:73`. A user deleting a temporary app therefore confirms against a promised 30-day restore window, although purge occurs after three days. Spec §5 explicitly includes this confirmation in the consistent-deadline requirement. |
| 16 | **Fix:** make the confirmation’s restore window lifecycle-aware, include its copy in Task 0, and test that temporary and permanent apps display three and 30 days respectively before deletion. |
| 17 | |
| 18 | 2. **P2 — Task 9, Step 1: the trashed-app refusal test fails before checking the status.** |
| 19 | At [plan:4418](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/temporary-sites/docs/superpowers/plans/2026-09-26-temporary-static-sites.md:4418), `TestTTLAndKeepRefuseWhatTheyCannotChange` uses `postJSON` for requests expected to receive the live-app gate’s plain-text 404. That helper calls `doJSON`, which unconditionally decodes a nonempty body and calls `t.Fatalf` on decode failure at [authcli_test.go:62](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/temporary-sites/internal/console/authcli_test.go:62). Correct handler behavior thus fails Task 9’s required test run. |
| 20 | **Fix:** use `postRaw` or `rawReq` for both expected-404 requests; assert the canonical 404 response and unchanged lifecycle row. |
| 21 | |
| 22 | **Verdict: revise.** |
| 23 | |
| 24 | --- |
| 25 | |
| 26 | **FIRST PROMPT:** |
| 27 | Review the temporary-sites plan at `c3bb6fba`, round 3, dispositioning earlier findings first. |
| 28 | |
| 29 | **WHAT:** |
| 30 | Check implementation-plan fidelity, correctness and tests. |
| 31 | |
| 32 | **STATUS:** |
| 33 | Review complete: two new findings; earlier findings addressed. |
| 34 | |
| 35 | **NEEDED:** |
| 36 | Nothing. |
| 37 | |
| 38 | **RECOMMENDED:** |
| 39 | Revise Task 10’s confirmation display and Task 9’s refusal test. |
| 40 | |
| 41 | **SESSION:** |
| 42 | Safe to close. No processes started or files changed; existing untracked files remain. |
amadan