| 1 | Reviewed plan `5600586a` against spec `9ccfaca6`, amendment `8baddbaa`, the three earlier reviews, and this worktree. R1–R9 remain settled. |
| 2 | |
| 3 | | Earlier finding still open after round 3 | Status | Why | |
| 4 | |---|---|---| |
| 5 | | R1-13 — copy-review completeness | Resolved | O19 is inventoried; new C30c/O20 are included, with review required before product-file writes. | |
| 6 | | R1-17 — release/build/scratch gates | **Partly; decline unjustified** | Release and cross-build gates are complete. The supplied instructions contain no `/tmp/g` exception; socket-path limits do not authorize one. The tzdata and probe scripts also retain `/tmp` fallbacks. | |
| 7 | | R2-4 — canary mismatch checked after writing | Resolved | The exact record is now checked before `instancesEnable`. | |
| 8 | | R3-1 — capped/partial listing bypasses refusal | Resolved | Direct record GET replaces listing-based inference; capped-list and failed-read cases assert zero writes. | |
| 9 | | R3-2 — pooled availability ignores allow-list | Resolved | Availability now applies `pol.allows("")` to the effective home. | |
| 10 | | R3-3 — fixture provenance breaks approved-copy equality | Resolved | The immutable SHA is resolved before review; approved F1 is copied without substitution. | |
| 11 | | R3-4 — missing same-box eligibility proof | Resolved | Split-capability fixtures and real reconciler pairing cover the required distinction. | |
| 12 | | R3-5 — missing persisted-record compatibility proof | Resolved | Home/non-home stored-byte goldens and the steering-stamp mutation cover it. | |
| 13 | | R3-6 — replicas lose their place name | Resolved | Every non-fleet response receives `region_name`, with endpoint and CLI coverage. | |
| 14 | |
| 15 | For R1-17, replace the exception at [plan:107](/home/paulca/amadan.net/carlos/platform-nearest-region/docs/superpowers/plans/2026-10-02-nearest-region-default.md:107) with an allowed on-disk directory and shorten test socket paths where necessary. Remove the `/tmp` fallbacks too. A passing test under `/tmp/g` establishes functionality, not authorization. |
| 16 | |
| 17 | **New findings** |
| 18 | |
| 19 | 1. **P1 — Tasks 15 and 22: pooled/fleet branches violate R9a when the stored-region read fails.** |
| 20 | |
| 21 | **Plan:** [5324](/home/paulca/amadan.net/carlos/platform-nearest-region/docs/superpowers/plans/2026-10-02-nearest-region-default.md:5324), [6944](/home/paulca/amadan.net/carlos/platform-nearest-region/docs/superpowers/plans/2026-10-02-nearest-region-default.md:6944). |
| 22 | **Code:** proposed `internal/console/regiondefault.go:56` and `:62` within Task 15’s file block; integration at [apiregions.go:31](/home/paulca/amadan.net/carlos/platform-nearest-region/internal/console/apiregions.go:31) and [canary.go:381](/home/paulca/amadan.net/carlos/platform-nearest-region/canary.go:381). |
| 23 | |
| 24 | With `rerr != nil`, a known fleet returns `region_known:false` but `effective:"fleet/acme"`. A known pooled manifest returns a home-valued `effective` and nonnil `available`. [R9a explicitly requires both fields to remain unknown](/home/paulca/amadan.net/carlos/platform-nearest-region/docs/superpowers/specs/2026-10-01-nearest-region-default-design.md:791): empty `effective`, omitted `available`. |
| 25 | |
| 26 | `TestAppDefaultKnownFlags` exercises the failed read only without either overriding placement, so it misses both cases. |
| 27 | |
| 28 | **Fix:** condition `Effective` and `Available` on a successful region read. Preserve canary’s refusal independently: simply clearing `Effective` would defeat Task 22’s fleet-prefix check. Use independently confirmed placement information, or conservatively refuse that combined state. Add failed-region-read × pooled/fleet endpoint cases and a fleet-canary zero-write test. |
| 29 | |
| 30 | 2. **P2 — Tasks 12 and 14: refusal messages recommend choices the corresponding door rejects.** |
| 31 | |
| 32 | **Plan:** [4041](/home/paulca/amadan.net/carlos/platform-nearest-region/docs/superpowers/plans/2026-10-02-nearest-region-default.md:4041), [4044](/home/paulca/amadan.net/carlos/platform-nearest-region/docs/superpowers/plans/2026-10-02-nearest-region-default.md:4044), [4859](/home/paulca/amadan.net/carlos/platform-nearest-region/docs/superpowers/plans/2026-10-02-nearest-region-default.md:4859). |
| 33 | **Code:** proposed `internal/console/regionclaim.go:35` and `:38`; existing rejection predicates at [apiinstances.go:799](/home/paulca/amadan.net/carlos/platform-nearest-region/internal/console/apiinstances.go:799) and [apiinstances.go:827](/home/paulca/amadan.net/carlos/platform-nearest-region/internal/console/apiinstances.go:827). |
| 34 | |
| 35 | There are three concrete cases: |
| 36 | |
| 37 | - C18 lists every published code, including non-hosting `nz`. The Task 12 test explicitly expects that suggestion, then verifies that choosing `nz` produces C19. |
| 38 | - C19 filters hosting capability but still suggests regions that `NoKeyProven` makes fail with C31. |
| 39 | - C16 lists eligible regions without the manifest allow-list. An unavailable UK default with `Regions:["uk"]` can recommend home `ie`, which the next request rejects. |
| 40 | |
| 41 | This misses [§8.1’s requirement that refusals list what would pass](/home/paulca/amadan.net/carlos/platform-nearest-region/docs/superpowers/specs/2026-10-01-nearest-region-default-design.md:709), and makes C16’s recovery advice unreliable. |
| 42 | |
| 43 | **Fix:** construct alternatives using the relevant door’s predicates, including normalized allow-lists for instance requests and the explicit R9 refusal for app requests. Keep explicit-choice rules distinct from automatic eligibility. Add tests that submit every advertised alternative under the same fixture and verify acceptance. |
| 44 | |
| 45 | 3. **P2 — Task 13: the unchanged-form contract is neither preserved nor tested.** |
| 46 | |
| 47 | **Plan:** [4265](/home/paulca/amadan.net/carlos/platform-nearest-region/docs/superpowers/plans/2026-10-02-nearest-region-default.md:4265), [4505](/home/paulca/amadan.net/carlos/platform-nearest-region/docs/superpowers/plans/2026-10-02-nearest-region-default.md:4505). |
| 48 | **Code:** [app_new.html:14](/home/paulca/amadan.net/carlos/platform-nearest-region/internal/console/templates/app_new.html:14), [server.go:3586](/home/paulca/amadan.net/carlos/platform-nearest-region/internal/console/server.go:3586). |
| 49 | |
| 50 | `TestNewAppPageWithoutPickerIsUnchanged` checks only that `name="region"` is absent, and only with the switch off. It would pass if existing form content changed or disappeared. |
| 51 | |
| 52 | The proposed untrimmed `{{with .RegionPicker}}` block also leaves additional whitespace when the picker is nil. That fails the explicit byte-identical requirement in §§10 and 16, even though the rendered appearance remains unchanged. |
| 53 | |
| 54 | **Fix:** preserve the existing no-picker output exactly and compare the rendered form against a baseline golden with deterministic CSRF data. Cover both switch-off and switch-on/one-eligible-region cases. The proposed insertion should fail that comparison before correction. |
| 55 | |
| 56 | **Other requested checks** |
| 57 | |
| 58 | The additive `instance_domain` field is sound. It supplies the authoritative hostname suffix needed for a direct preflight read, without changing legacy `regions` or `default`. Checking the subsequent enable response against the preflight hostname is appropriate. |
| 59 | |
| 60 | I found no further mismatch in the interface blocks, migration carry through `migrateAppsKey`, create-door precedence, or old-CLI/old-console handling. Task 1 correctly reuses reconciliation parsing: `CARLOS_POOLS=",tito"` does **not** advertise shared-pool eligibility. All specified C identifiers, five Review Focus cases, and rollout stages have task coverage; the behavioral gaps above remain despite that coverage. |
| 61 | |
| 62 | The dependency choices have no identified blocker: [MaxMind v1.13.1 declares Go 1.21](https://github.com/oschwald/maxminddb-golang/blob/v1.13.1/go.mod), compatible with this repository’s Go 1.26 declaration, and [IANA publishes tzdata 2026b and its signature](https://data.iana.org/time-zones/releases/). The plan includes signature verification and all five required cross-build targets with failure propagation. |
| 63 | |
| 64 | This was static, read-only review. I did not run the proposed implementation’s tests or cross-builds; its implementation files do not yet exist. The worktree remains clean. |
| 65 | |
| 66 | --- |
| 67 | |
| 68 | **FIRST PROMPT:** |
| 69 | Independent round-4 review of the nearest-region implementation plan. |
| 70 | |
| 71 | **WHAT:** |
| 72 | Check prior dispositions, spec coverage, interfaces, compatibility and execution gates. |
| 73 | |
| 74 | **STATUS:** |
| 75 | Review complete: three new findings; R1-17 remains partly unresolved. |
| 76 | |
| 77 | **NEEDED:** |
| 78 | No additional user input. |
| 79 | |
| 80 | **RECOMMENDED:** |
| 81 | Correct the findings and scratch instructions before implementation. |
| 82 | |
| 83 | **SESSION:** |
| 84 | Safe to close; no files changed. |
| 85 | |
| 86 | **Verdict: not ready to execute. R9a is violated, refusal alternatives and form-preservation tests need correction, and the declined scratch-rule finding remains unresolved.** |
amadan