carlos / platform Public

ACCEPT WITH FIXES for a DORMANT merge.

Open items

• X1 / R2 #4 — ADDRESSED. A 401 now retries until the deadline without URL polling. I accept the controller’s 403 ruling for this dormant merge: it preserves the deliberate legacy-watch exception.
• X2 / R2 new Medium — NOT ADDRESSED fully. The unrelated-fleet case is fixed, but incomplete record reads can incorrectly exclude a relevant fleet. I accept the controller’s 403 ruling; this defect occurs on a successful list response.

New findings

• High — internal/console/apiinstances.go:636: skipped records can authorize URL polling of a sleeper. Scenario: deploy’s initial target discovery succeeds for a sleeping instance on fleet/pi. During watch discovery, that record’s read fails. provision.ListRecords silently skips failed reads (internal/provision/provision.go:2619), returning success and truncated:false for an app below the cap. Consequently, recordFleets(recs) omits pi. If its snapshot is also unreadable, lines 494–497 ignore that failure and return a complete join. The target is absent, so legacyOnly refuses whole-watch fallback, but rolloutWatch.apply reaches modeURL at deploywatch.go:509 and polls it anyway. Before X2, that fleet failure kept the join incomplete and prevented polling.

Smallest fix: expose record-read completeness to this endpoint and prevent a complete-join response when records were skipped, or fail the list read. Add a regression covering successful initial discovery followed by an unreadable target record and fleet snapshot, asserting zero origin requests.

Tenant isolation remains intact in the changed lookup: record identities are checked against their account/app paths, and fleet ownership is checked before snapshot reads.

Reviewed tip 971470f3. The targeted test rerun was blocked by the read-only sandbox before compilation; no files changed.