carlos / platform Public

| Earlier finding | Disposition | Why | |---|---|---| | R2-1: Replay after delivery starts | Fixed | Plan 3:160 explicitly prohibits replay onto a started response. | | R2-2: Reader lifetime and disk accounting | Fixed | Plan 2:129 introduces reader leases and retains accounting until readers close. | | R2-3: Authority-test package boundary | Fixed | The authority table moves into internal/host; edge-side tests retain their own fixtures (Plan 3:237). | | R2-4: Fixture never selects generation routing | Fixed | Plan 3:249 requires hibernating socket-backed instances and asserts genManaged. | | R2-5: Forged marker removed by simulated old edge | Fixed | The test now constructs a legitimately signed hop carrying the forged marker directly (Plan 3:253). | | R2-6: Corrective tests excluded by selectors | Fixed | The selectors now include the corrective tests identified in R2. | | R1-7: Confirming unapplied records | Fixed | Plan 1:228 removes the equality shortcut and covers skipped records and failed gate convergence. | | R1-15: Missing production-wired attacks | Partly fixed | Oversize and mismatch cases are added, but the production refusal matrix still omits Vary: Cookie, private, no-cache and 206 (Plan 3:256). | | R1-16: Incomplete copy inventory | Fixed | EAC-20 and EAC-21 are defined; Plan 1 gates EAC-1–22, and Plan 3 extends the inventory to 24. |

1. P1 — Metadata is encoded before its body-file version and sizes are assigned. Plan 2 Task 4 explicitly encodes metadata first, then generates gzip, draws Version, publishes the metadata, and sets Size, GzipSize and StoredAt (plan 2:128). The persisted metadata therefore cannot name the newly drawn body version. On reopening, Task 1 removes bodies that no parsed metadata names (plan 2:67). Smallest fix: finalize every metadata field before encoding, enforce MaxMeta on that final encoding, then publish it. Add a successful commit → reopen → read test covering identity and gzip.

1. P1 — The provider test uses repository-relative paths from the package directory. Plan 3 Task 10 places TestAssetCodeImportsNoAWSSDK in internal/edge but tells it to execute go list -deps ./internal/assetcache and inspect internal/edge/asset*.go (plan 3:270). Go runs the test binary in its package directory (test runner:1663); those paths resolve beneath internal/edge, where neither exists. Smallest fix: specify the repository root as the subprocess working directory and resolve parser paths from that root, or use the package’s full import path and package-local filenames.

1. P2 — Failed route retirement can still advance authority time. Plan 1 Task 6 defines completeness over records read and convergence steps applied to those records (plan 1:228). A deleted record is absent from that loop. Its route’s retirement can fail, be logged, and leave the pass returning nil (reconcile.go:1597). With another live instance in the same app, the app can be reported complete while the retired hostname retains a freshly renewed authority time. Smallest fix: include required retirements and their fresh-read checks in per-app completeness. Test one deleted instance whose retirement fails while a sibling converges successfully, including the one-hour cutoff.

1. P2 — Buffered fallback leaves billing ownership ambiguous and can double-charge a request. Plan 3 Task 5 now re-forwards a buffered initiator after a late fill failure (plan 3:160). Task 6 also requires the far edge to meter an acknowledged response (plan 3:194). For a cold range request whose acknowledged fill receives a cookie trailer, the first response is discarded and ordinary backhaul supplies the replacement, which the home meters. Applying both instructions records two requests for one client delivery. Smallest fix: assign billing to the final delivery and explicitly suppress billing for the discarded buffered attempt. Add a two-edge late-veto test asserting one total request and only delivered bytes.

1. P2 — The initiating-request rule puts plain HEAD into the streaming branch. Plan 3 Task 5 fetches with GET, then tees any initiator lacking the four listed conditional/range headers (plan 3:158, plan 3:160). That includes an ordinary HEAD, contradicting the explicit requirement to commit first and answer it from the entry (plan 3:28). Although a real HTTP server suppresses HEAD body bytes, its headers would already be sent before the fallback ETag and stored representation are available. Smallest fix: explicitly include HEAD in the buffered branch and require bodyless delivery on refusal too; cover cold HEAD on both edges.

1. P2 — Generation backfill has no retry path through an existing release. Plan 1 Task 5 assigns mintMissingAssetGens after storing an asset-declaring manifest (plan 1:202). If generation writes partly fail, the manifest already exists. Retrying that version takes the existing-release success return before the new-manifest path (apicli.go:2202, apicli.go:2241); no task assigns backfill to that return. Smallest fix: require generation backfill before both successful ship responses, using the stored manifest on re-ship. Test partial backfill failure followed by retrying the same version.

reject