carlos / platform Public

Reviewed plan 7db8869f against spec 9ccfaca6, amendment 56756f09, reviews R1–R4, dispositions, and the current code.

| Earlier finding still open after R4 | Status | Why | |---|---|---| | R1-17 — release/build/scratch gates | Resolved; decline accepted | The final operator rule explicitly authorizes the socket-test arrangement. Release and cross-build gates are covered. | | R4-1 — unread stored region violates R9a | Resolved | Pooled/fleet branches leave effective placement unknown; canary requires both knowledge flags. | | R4-2 — refusal suggests rejected alternatives | Resolved | Alternatives use the relevant acceptance predicates, including allow-lists and R9; tests submit the advertised choices. | | R4-3 — unchanged form neither preserved nor tested | Resolved | Conditional placement preserves whitespace; complete form goldens cover switch-off and one eligible region. |

New finding: P1 — Task 22 discards the authoritative canary record before deciding whether to create.

Plan: record read and return, lines 7259–7272, caller wiring, line 7309. Code: canary.go:387, canary.go:405, provision.go:1188.

Consider an existing UK canary preceded by 520 other records, invoked with --region uk. The direct GET correctly finds it and approves the matching region. But canaryRegionCheck returns only its hostname. The unchanged command then reads the capped list, misses that same record, and selects canaryPlanCreate. It attempts a duplicate create instead of reusing or rechannelling the existing canary, ultimately receiving 409 “already exists”.

That violates §11’s “equal proceeds” requirement. R3-1’s mismatch refusal is fixed; this finding concerns the successful matching-region path. Task 22’s capped-list command test exercises only refusal.

Fix: carry the authoritative record and found result into the create/rechannel/ready decision, including the later environment-update decision. Add command tests with a same-region canary beyond the cap, covering both matching and different channels. Assert no duplicate-create request and that execution reaches shipping; these should fail against the proposed wiring.

I found no additional blocker in migration carry through migrateAppsKey, publication/reconciliation parsing, create-door precedence, interface declarations, or legacy wire compatibility. CARLOS_POOLS=",tito" correctly publishes shared-pool eligibility as false. The C-string inventory, copy-review ordering, Review Focus cases and rollout stages have task coverage.

The dependency choices have no identified blocker: MaxMind v1.13.1 declares Go 1.21, compatible with this repository’s Go declaration; IANA publishes tzdata 2026b and its signature. Signature verification and all five CI cross-build targets are included.

This was static review. I did not reproduce the author’s scratch implementation, red/green runs or cross-builds. No files changed; the worktree remains clean.

---

FIRST PROMPT: Independent, read-only round-5 review of the nearest-region implementation plan.

WHAT: Check earlier dispositions, spec coverage, interfaces, compatibility and execution gates.

STATUS: Earlier findings resolved; one new P1 in canary reuse.

NEEDED: No additional user input.

RECOMMENDED: Carry the direct-read record through Task 22 and add matching-region command tests.

SESSION: Safe to close; no files changed or processes left running.

Verdict: not ready to execute. Task 22 still fails to reuse a matching-region canary outside the capped list.