carlos / platform Public

Reviewed 521f78ee1569e1fcbaadd9647660198832290838 read-only. No builds or tests run; working tree unchanged.

| Open round-2 item | Status | Assessment | |---|---|---| | Ownership after failed install handoff | Closed | cacheDir reconciles every required parent on every invocation. The retry test covers the previous failure. | | Permanent reference collisions | Closed | Group references replace the 1,600-label namespace for identity and enrolment. Console derivation and rollout gating are specified. The status fallback has a separate defect below. | | Membership freshness at the write | Closed | writeBound covers the downstream reads and final Put of both writers. Slow-read tests now exercise the original gap. | | Seeding permissions | Closed | Seam 4 and RHB-C61 include the SSM read and scoped kms:Decrypt. | | Stop/start versus reboot verification | Partly | Explicitly gated before activation; the required dev observation remains outstanding. This does not itself block implementation. |

New findings:

1. P2 — An unresolved group reference can overwrite a legacy box’s status indefinitely. Task 6’s statusLoop patch accepts ("", true) from groupStatusLabel. statusTick interprets the empty override as “use status.Label(machineID).” WriteBox reads that key’s current ETag and replaces its contents; CAS does not establish ownership.

Reachability matters: with both claim mode and HA enabled, productionModeFacts obtains and caches a nonempty group reference before hosting starts. An IMDS outage at that startup therefore waits; it does not reach this fallback. However, decideAgentMode bypasses that check when either flag is off, while the group marker still controls status naming.

On that path, a colliding legacy label lets the group box replace another box’s report. Its own derived-key report stops refreshing, and the victim’s metrics become incorrect or fail enrolment/instance validation. Correctly keyed group reports are unaffected. Recovery of IMDS does not repair this loop: fleetLabel was captured once.

Publish nothing until the group reference resolves, then retry. Preserve existing non-group behaviour. Add coverage through the actual status publication path, including an existing victim report; the current helper test explicitly accepts the empty reference without testing its consequence.

1. P2 — Automatic replacement eventually exceeds the status reader’s lifetime-object limit. Every replacement now publishes a distinct status object, but loadBoxesReport truncates the entire prefix to 200 keys before considering freshness. The bucket lifecycle configuration does not expire these reports, and this plan adds no retirement cleanup.

Once historical and current reports exceed 200, current boxes can disappear from status results and completeness remains false. That disables automatic non-home region eligibility through regionCandidates, and blocks report-dependent retention. Two concurrent boxes do not prevent this lifetime accumulation.

The reader limit predates this change, but automatic replacement makes it an operational lifecycle requirement. Specify safe retirement/expiry or bounded discovery of current reports, and test more than 200 historical reports alongside live boxes.

The two redundant pre-checks: I recommend removing both—the enroll freshness callback and the check immediately before Invite. Retain checkConfirmed’s freshness check after the describe and retain the mandatory bound store/context. The extra checks cannot protect against intervening I/O, and the callback unnecessarily changes generic enrolment plumbing. Their surviving individual mutation tests are expected redundancy, not a safety failure.

---

FIRST PROMPT: Round 3 review of region HA 2b at 521f78ee, including status fallback and redundant pre-checks.

WHAT: Reviewed the revised plan against round 2 and its supporting code paths.

STATUS: Four prior defects closed at plan level; two new P2 findings. Activation verification remains pending.

NEEDED: Nothing for this review.

RECOMMENDED: Fix unresolved-reference publication and specify status-report retirement; remove the redundant pre-checks.

SESSION: Safe to close. No files changed or processes started.

Verdict: not ready to build.