carlos / platform Public

| Round-1 finding | Disposition | |---|---| | A1: Registration before capacity refusal | Closed. Task 11 chooses before RegisterStart, carries the selection forward, and tests refusal through recovery. | | A2: Missing choosing doors | Partly closed — P2 remains. The shared refusal reaches all four doors, but Task 12 leaves the move handler’s earlier placement checks intact. A configured destination with no edges file, or only blank public addresses, still returns 400 without an alert at apiinstancemove.go:594. Test the full HTTP path and route this capacity failure through H27. | | A3: App-derived region validation | Closed for both reported scenarios. Task 11 uses PlaceableBoxes and adds HTTP tests for stale boxes and a misconfigured sibling. | | A4: Move filtering with HA off | Closed. placementChooser gates the filter on HA; tests cover persisted roles and an unreadable roster. | | A5: Private dialing with HA off | Closed. Task 8 uses the reader’s switch and tests both settings. | | A6: Restart resets alert limit | Closed by ruling. Revised H27 explicitly permits an extra alert after restart. | | A7: Pending copy exposed | Closed in the plan. Built rows must be approved; Tasks 10 and 11 wait for approval. |

Two new findings:

1. P2 — A capacity-refused create can still change its environment’s store. Task 11 inserts early selection inside beginClaimCreate, but apiinstances.go:1573 calls bindEnvironmentCreate first. If the requested environment has a seed-owned store, takeSeedStore clears Declared.Seed and writes it back. An explicit-region create can therefore change storage ownership, then return the no-capacity 503. Later seed cleanup leaves that store standing despite no instance having been created. Choose before this mutation, and test that the store bytes remain unchanged after refusal.

1. P2 — Capacity metrics can be published to the wrong AWS region. Task 13’s regionCapacities takes the destination AWS region from the last edges file naming each placement. The capacity count, however, uses the signed roster. A stale or misconfigured file naming placement=uk, region=eu-west-1 can therefore redirect the valid UK count away from eu-west-2. The intended alarm receives missing data and reports a capacity problem even when eligible boxes exist. Derive the metric destination from the same authoritative region mapping used by the chooser, and test conflicting edges-file metadata.

Platform-1e’s stated conditions are met by the proposed code on static inspection: private addresses use the configured address source, undergo private-IPv4 and CIDR validation, exclude loopback and link-local addresses, and remain routing data. Writer/source and reader tests cover invalid addresses. boxRoster performs only a signed roster read, and both production callers pass the operator gate first.

The census treatment appears complete for the current proposal: all four authority/legacy units and all four B8 digest changes are covered. The overlay must load last, with coverage hashes, unit digests, fingerprints and seals recomputed after Plan 14 Parts 2 and 3. I did not execute the census checks.

---

FIRST PROMPT: Review plan 2a round 2 at 16939cda, read-only, without heavy checks.

WHAT: Check prior findings, census conditions and new defects.

STATUS: Six findings closed, one partly closed; two new P2 findings. No builds or tests ran.

NEEDED: Nothing for this review.

RECOMMENDED: Resolve the three outstanding paths and add the described regression coverage.

SESSION: Safe to close. HEAD verified; worktree unchanged; no processes started.

Verdict: not ready to build.