1. **P1 — Restore still traverses an uncapped tenant-controlled tree.** [restore.go:409](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-1b-next-build/internal/hostfiles/restore.go:409)
2
A valid manifest can name the shallow file `x` while the tenant has left a deeply nested directory at `x`. `writeInside` calls `root.RemoveAll(x)`, bypassing `withinTreeCap`. Go’s implementation recurses with an open descriptor per directory and has no context checks. This can exhaust descriptors or prolong installation while its host guard remains locked. This is an inherited risk still within the brief’s scope. Bound the deletion traversal and make it cancellable.
3
4
2. **P1 — The walk’s memory remains unbounded by directory width.** [walk_unix.go:32](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-1b-next-build/internal/hostfiles/walk_unix.go:32), [dir_unix.go:74](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-1b-next-build/internal/hostfiles/dir_unix.go:74)
5
`d.names()` calls `Readdirnames(-1)` and sorts every name before any path cap or further cancellation check. A tenant can leave sufficiently many empty files in one shallow directory to exhaust the shared agent’s memory; depth and file-content limits do not constrain this. Ancestor name lists also remain allocated during recursion. This is another inherited gap. Read bounded batches and enforce a total traversal budget.
6
7
3. **P2 — The new manifest restriction is not enforced by every publisher.** [restore.go:271](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-1b-next-build/internal/hostfiles/restore.go:271)
8
`checkManifest` now rejects paths above 256 components, but `publishOne` → `Publisher.Stage` → `Commit` still accepts them. A watcher event for a valid 257-component path can therefore publish a manifest that `Restore`, `CopyManifest`, and `ValidateManifest` refuse. `Run` continues processing events and committing after a failed full scan. Deleting that file leaves a tombstone that also fails validation. Apply the policy across all publishing paths and address existing manifests.
9
10
**Verdict: request changes.** The original FIFO-blocking P1 and vanished-directory P2 are closed by source inspection. The remaining resource risks prevent approval, and the cap introduces a reader/writer mismatch.
11
12
The caps exclude legitimate filesystem trees: 257 one-character components require only 513 bytes. Moves’ archive contract also permits 4096-byte paths without this depth limit. I found no active moves caller of `hostfiles.Publish`, so this is a contract mismatch rather than a demonstrated live moves regression.
13
14
Targeted tests could not start because the read-only sandbox prevented Go from creating its build directory. Findings are based on source inspection.
15
16
---
17
18
**FIRST PROMPT:**
19
“Follow the review brief docs/superpowers/plans/CODEX-REVIEW-REGION-HA-TENANT-DIR-BRIEF-2.md. Review the diff 3194d674..f9123572 on branch region-ha-1b-next-build.”
20
21
**WHAT:**
22
Confirm tenant-directory safety fixes in the requested diff.
23
24
**STATUS:**
25
Review complete: two remaining P1 risks and one new P2 mismatch; tests blocked.
26
27
**NEEDED:**
28
Nothing for this review.
29
30
**RECOMMENDED:**
31
Bound both remaining traversals and align manifest writers with readers before approval.
32
33
**SESSION:**
34
Safe to close. No files changed or processes left running; the read-only sandbox prevented saving the handoff.
amadan