| 1 | 1. **Where does the app’s purge generation survive instance deletion and recreation?** (§6) |
| 2 | The generation exists only on instance records. Recreating the same hostname could reuse an old cache key; concurrent creation or partially failed purge writes could leave different generations. The answer determines whether the plan needs durable app-level state and coordinated instance creation, or a different generation scheme. |
| 3 | |
| 4 | 2. **What should happen when one hostname routes to several instances of the same app with different asset settings?** (§§3.3–4.1) |
| 5 | The single-owner check permits this, but those instances can have different releases, gates and opt-outs. Should such a hostname be excluded entirely, or publish policy for each routed prefix? That changes the publication format and far-edge matching logic; one hostname-wide declaration cannot represent all those policies. |
| 6 | |
| 7 | 3. **May an unarmed home edge recognise asset fills and bypass its ordinary cache and billing?** (§§5.1, 8, 10) |
| 8 | Otherwise, arming only the far edge allows fills from the home’s shared LRU and counts the exchange at both edges. The plan needs either an authenticated fill protocol honoured while unarmed, or a home-first arming requirement. Both require qualifying “an unarmed box forwards exactly as today.” |
| 9 | |
| 10 | 4. **For noncanonical URLs, should fills use the cleaned path, preserve distinct cache keys, or bypass caching?** (§§5.1–5.4) |
| 11 | The proposed key collapses paths that the upstream can distinguish. Forwarding the original path can therefore populate a canonical asset’s cache entry with another response. Normalising the upstream request changes application routing; preserving distinct keys or bypassing changes the specified cache behaviour. |
| 12 | |
| 13 | Separately, these mechanisms do not work as written against this checkout: |
| 14 | |
| 15 | - **`Route.Version` does not identify the serving release.** For generation-managed instances it identifies the installed build; the response version comes from the generation that actually answered. Publishing declarations from `t.Version` can therefore publish the wrong build’s prefixes during an update. Evidence: [edge.go:842](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/internal/edge/edge.go:842), [genproxy.go:298](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/internal/edge/genproxy.go:298). |
| 16 | |
| 17 | - **Ordinary backhaul does not provide cache isolation or single accounting.** The home meters the hop and consults its shared LRU. A purge affecting only asset generations can immediately refill a far cache from that old LRU response. Evidence: [edge.go:1678](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/internal/edge/edge.go:1678), [edge.go:1768](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/internal/edge/edge.go:1768). |
| 18 | |
| 19 | - **`lookupUpstreamPath` does not canonicalise the forwarded path.** It matches cleaned and raw first segments, deliberately retaining the original request path. It cannot supply the assumed equivalence between cleaned cache keys and upstream responses. Evidence: [edge.go:1304](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/internal/edge/edge.go:1304), [edge.go:1323](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/internal/edge/edge.go:1323). |
| 20 | |
| 21 | - **Successful reads do not establish freshness of the home’s published state.** A stopped publisher’s unchanged object remains readable indefinitely, continually renewing the proposed read-age bound. Local caches also use registry state without that bound. Thus the one-hour mechanism does not cover a disconnected home that misses a purge. Evidence: [homemap.go:448](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/internal/edge/homemap.go:448), [edgesfile.go:666](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/internal/host/edgesfile.go:666). |
| 22 | |
| 23 | - **The exclusions omit the separate import gate.** `ImportGate` can refuse a route even when `Route.Gate` is empty. A warm far-edge cache would answer before reaching that protection unless import state also withdraws asset eligibility. Evidence: [importgate.go:24](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/internal/edge/importgate.go:24), [edge.go:1635](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/internal/edge/edge.go:1635). |
amadan