- **X1 / R2 #4 — ADDRESSED.** A 401 now retries until the deadline without URL polling. I accept the controller’s 403 ruling for this dormant merge: it preserves the deliberate legacy-watch exception.
6
- **X2 / R2 new Medium — NOT ADDRESSED fully.** The unrelated-fleet case is fixed, but incomplete record reads can incorrectly exclude a relevant fleet. I accept the controller’s 403 ruling; this defect occurs on a successful list response.
7
8
## New findings
9
10
- **High — [internal/console/apiinstances.go:636](internal/console/apiinstances.go:636): skipped records can authorize URL polling of a sleeper.**
11
Scenario: deploy’s initial target discovery succeeds for a sleeping instance on `fleet/pi`. During watch discovery, that record’s read fails. `provision.ListRecords` silently skips failed reads (`internal/provision/provision.go:2619`), returning success and `truncated:false` for an app below the cap. Consequently, `recordFleets(recs)` omits `pi`. If its snapshot is also unreadable, lines 494–497 ignore that failure and return a complete join. The target is absent, so `legacyOnly` refuses whole-watch fallback, but `rolloutWatch.apply` reaches `modeURL` at `deploywatch.go:509` and polls it anyway. Before X2, that fleet failure kept the join incomplete and prevented polling.
12
13
**Smallest fix:** expose record-read completeness to this endpoint and prevent a complete-join response when records were skipped, or fail the list read. Add a regression covering successful initial discovery followed by an unreadable target record and fleet snapshot, asserting zero origin requests.
14
15
Tenant isolation remains intact in the changed lookup: record identities are checked against their account/app paths, and fleet ownership is checked before snapshot reads.
16
17
Reviewed tip `971470f3`. The targeted test rerun was blocked by the read-only sandbox before compilation; no files changed.
amadan