carlos / platform Public

Reviewed HEAD 04f5d21d36800d6354cf08c1bda996774860a62e read-only. No builds or tests run; working tree unchanged.

| Open round-4 item | Status | Assessment | |---|---|---| | #1: Late success escapes unknown classification | Closed | deadlineStore.call checks cancellation and checks the deadline after successful completion. Late success becomes ErrWriteDeadline. | | #2: Read-back accepts stale membership | Closed | Removed under U1. Subsequent passes use the roster; no recovery describe remains. | | #3: Failed paging loses escalation | Closed | Paging removed under U1. Detached-but-running reconciliation is explicitly assigned to spec 3. | | #4: Unprotected host.env write path | Closed | Fixed path, descriptor-relative traversal, ownership/mode checks, exclusive temporary file, and rename address the reported attack. | | Inherited stop/start versus reboot verification | Partly | Still an explicit activation gate; the dev observation remains outstanding. This alone does not block implementation. |

New finding — P2: The timeout does not establish the claimed 75-second commit ceiling.

Task 4’s bound contract asserts that a late commit is at most 75 seconds behind its membership read. But deadlineStore.call stops waiting for its goroutine; it cannot stop a context-ignoring store from subsequently committing. HTTP cancellation likewise supplies no server-side commit deadline.

A concrete counterexample: the roster Put starts at second 59, the wrapper returns unknown at second 60, and the instance leaves the group. A subsequent pass sees no enrolment and refuses its fresh membership check, without changing the roster. The original pending write then commits at second 90 against the unchanged ETag. A later pass accepts that enrolment. This exceeds the asserted ceiling.

The proposed fake commits before simulating the delay. Add a case that delays the mutation itself until after cancellation and the next roster read.

On context versus http.Client.Timeout: the per-call context is adequate for the client-side timeout. AWS passes it to the HTTP transport and stops retries when cancelled; the installed SDK source confirms that propagation. Go documents that Client.Timeout cancels transport requests through equivalent context semantics. The operation context additionally spans SDK retries. A dedicated HTTP client is unnecessary for this purpose. AWS timeout documentation, Go client documentation.

Keep that mechanism, but state its actual guarantee: calls are issued before the membership deadline, client waiting is bounded by the earlier deadline, and cancelled writes may commit later. If a strict 75-second commit limit remains required, it needs storage-side enforcement; neither client timeout provides it. This finding does not require restoring the removed recovery machinery.

The two new filesystem authority rows are explicitly marked proposed, and the changed copy is inventoried with approval still gated.

---

FIRST PROMPT: Round 5 review of region HA 2b at 04f5d21d.

WHAT: Reviewed round-4 dispositions and the revised timeout and filesystem contracts.

STATUS: Four findings closed; activation verification partly complete; one new P2.

NEEDED: Nothing for this review.

RECOMMENDED: Correct the commit-time guarantee and add delayed-mutation coverage.

SESSION: Safe to close. No files changed or background processes started.

Verdict: not ready to build as specified.