carlos / platform Public

---

FIRST PROMPT: Review hostfiles-cap-live-entries at 7d4efe54, read-only, following the supplied brief.

WHAT: Assess correctness, test coverage, census changes, and readiness to merge after the freeze.

STATUS: Request changes: two P2 findings.

1. P2 — Inherited skipped entries still prevent successful scans. The exemption at publisher.go:73 lets Open accept an over-cap skipped entry. After restore, that unpublished file is absent, so syncRoot calls StageDelete, which still returns ErrTooDeep. Consequently, Publish and ReleaseFlushFiles.Flush fail; Run repeatedly retries the scan. The new continuation test stages a healthy file directly, bypassing this failure. Handle deletion of an inherited skipped entry without allowing new over-cap live entries, and test restore → scan → commit.

1. P2 — Exempt tombstones reintroduce unbounded, non-cancellable restore work. The relaxed validation at restore.go:270 admits arbitrarily deep tombstones. Removal checks every ancestor with realParents; directory syncing repeats those checks for every ancestor again. On this Linux toolchain, os.Root resolves each prefix component by component, making the surviving-parent case cubic in depth, without context checks. This can occupy installation indefinitely instead of returning the previous immediate refusal. The new test uses an empty destination, so it never exercises existing deep parents or actual tombstone removal. Make traversal efficient and cancellable while preserving deletion durability.

The shared validation path covers OpenAt, CopyManifest, NewFromCopy, and moves’ Establish; I found no new route for writing an over-cap live entry. Present skips exempt entries, though skipped paths still participate in superseded. The census envelope hash matches exactly; root-read units and the legacy seal are unchanged.

Targeted hostfiles tests could not start: the read-only sandbox denied Go’s temporary build directory. The full internal/host suite was not run.

NEEDED: Nothing from you for this review.

RECOMMENDED: Fix both findings and add regressions before merging after the freeze.

SESSION: Safe to close. HEAD and working tree are unchanged; no processes remain running.