carlos / platform Public

ACCEPT WITH FIXES for a DORMANT merge; this does not authorize enabling CARLOS_SWAP.

Round-1 findings

1. ADDRESSED — internal/appconfig/syncexec.go:1253,1397: policy-only empty renders leave absent files absent. Adding the first variable still writes, delivers and acknowledges config; removing the last variable empties the existing file and delivers the new revision. Instance overlays and held renders bypass the skip.
2. ADDRESSED — deploywatch.go:279,290,305,684: discovery requests and retry waits share one deadline; legacy fallback receives the remaining duration.
3. ADDRESSED — deploywatch.go:474,490: later reports reclassify URL-completed hosts, and explicit installation of another build invalidates successful completion. Missing observations preserve state.
4. NOT ADDRESSED — deploywatch.go:107–109: 5xx/network failures and incomplete joins now behave conservatively, but 401/403 still cause URL polling. An expired credential or denied list request says nothing about whether targeted instances report rollouts; polling can wake them. The controller’s broad 4xx exception is therefore unacceptable evidence. Smallest fix: fail on authentication/authorization errors and restrict compatibility fallback to explicitly supported absence responses.
5. PARKED-ACCEPTABLE — internal/host/restart.go:852 still accepts unsigned retries; docs/superpowers/plans/2026-10-07-zero-downtime-deploys-6-roll-notes.md:89 explicitly records the flag-on blocker. Acceptable only for this dormant merge.
6. ADDRESSED — internal/console/apiinstances.go:461,480, internal/console/apiretry.go:51, internal/console/instancepage.go:245: list, page and retry share the account-filtered fleet loader. The completeness scope needs the correction below.
7. ADDRESSED — deploywatch.go:413: truncation no longer blocks legacy fallback when every target is present and unreported; deploywatch_test.go:717 compares output and errors with the legacy watch.
8. ADDRESSED — internal/console/instancepage.go:44, internal/console/swapcopy.go:78,90, internal/rolloutwords/words.go:61: down-state wording is explicit, retry no longer promises fallback, and swapping wording covers hold mode and workers.
9. ADDRESSED — apps_swap.go:35,59, internal/console/apiswap.go:30, internal/console/templates/app_settings.html:380: the identified app-specific strings have draft markers, and the rate-limit sentence loses its em dash. Shared existing flag help and the accepted table placeholder remain unchanged.

The ordinary flag-off case is preserved: with all targets listed, a complete join and no rollout reports, legacyOnly selects the original watchVersion at deploywatch.go:305, preserving its output and diagnostics.

New findings

• Medium — internal/console/apiinstances.go:489: unrelated boxes can disable a healthy app’s legacy watch. Completeness combines every platform snapshot and every fleet belonging to the account. For example, an account’s unused fleet contains corrupt JSON while its target app runs entirely on healthy platform boxes with the flag off. The list returns rollout_incomplete; legacyOnly refuses fallback, and the deploy times out without checking the app’s URLs. The loader receives neither the app nor its placement records, so it cannot distinguish relevant failures. Smallest fix: compute completeness for the targets’ possible placements, including relevant move locations, and retain unknown state only where an unreadable source could contain their reports. Add an unrelated-fleet regression test.

Another account’s fleet snapshot does not cause this: line 480 excludes it before reading. Retry also does not reject a known hold merely because another snapshot made the join incomplete; it ignores the aggregate flag and uses the available host report.

Out of scope

Legacy URL polling retains its existing HTTP timeout and sleep behavior (deploy.go:1472,1530); the discovery fix does not make those operations deadline-bound.

I inspected tip 3625973c and the supplied test evidence. My targeted test rerun was blocked because the read-only sandbox prevented Go from creating its work directory. No files were changed.