Review `hostfiles-cap-live-entries` at `7d4efe54`, read-only, following the supplied brief.
5
6
**WHAT:**
7
Assess correctness, test coverage, census changes, and readiness to merge after the freeze.
8
9
**STATUS:**
10
**Request changes: two P2 findings.**
11
12
1. **P2 — Inherited skipped entries still prevent successful scans.** The exemption at [publisher.go:73](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/hostfiles-cap-live-entries/internal/hostfiles/publisher.go:73) lets `Open` accept an over-cap skipped entry. After restore, that unpublished file is absent, so `syncRoot` calls `StageDelete`, which still returns `ErrTooDeep`. Consequently, `Publish` and `ReleaseFlushFiles.Flush` fail; `Run` repeatedly retries the scan. The new continuation test stages a healthy file directly, bypassing this failure. Handle deletion of an inherited skipped entry without allowing new over-cap live entries, and test restore → scan → commit.
13
14
2. **P2 — Exempt tombstones reintroduce unbounded, non-cancellable restore work.** The relaxed validation at [restore.go:270](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/hostfiles-cap-live-entries/internal/hostfiles/restore.go:270) admits arbitrarily deep tombstones. Removal checks every ancestor with `realParents`; directory syncing repeats those checks for every ancestor again. On this Linux toolchain, `os.Root` resolves each prefix component by component, making the surviving-parent case cubic in depth, without context checks. This can occupy installation indefinitely instead of returning the previous immediate refusal. The new test uses an empty destination, so it never exercises existing deep parents or actual tombstone removal. Make traversal efficient and cancellable while preserving deletion durability.
15
16
The shared validation path covers `OpenAt`, `CopyManifest`, `NewFromCopy`, and moves’ `Establish`; I found no new route for writing an over-cap live entry. `Present` skips exempt entries, though skipped paths still participate in `superseded`. The census envelope hash matches exactly; root-read units and the legacy seal are unchanged.
17
18
Targeted `hostfiles` tests could not start: the read-only sandbox denied Go’s temporary build directory. The full `internal/host` suite was not run.
19
20
**NEEDED:**
21
Nothing from you for this review.
22
23
**RECOMMENDED:**
24
Fix both findings and add regressions before merging after the freeze.
25
26
**SESSION:**
27
Safe to close. HEAD and working tree are unchanged; no processes remain running.
amadan