| 1 | | Earlier finding | Disposition | Why | |
| 2 | |---|---|---| |
| 3 | | R3-1: Metadata encoded before final fields | Fixed | [Plan 2:128](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/docs/superpowers/plans/2026-10-24-edge-asset-cache-plan-2-disk-store.md:128) finalizes fields before encoding and adds a commit/reopen/read test. | |
| 4 | | R3-2: Provider-test paths | Fixed | [Plan 3:272](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/docs/superpowers/plans/2026-10-24-edge-asset-cache-plan-3-serve.md:272) uses the correct full import path and package-local filenames. | |
| 5 | | R3-3: Failed retirement advances authority | Partly fixed | Failed deletes are covered, but failed retirement revalidation still has a [nil-return path](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/internal/provision/reconcile.go:1615) with no explicit completeness rule or test. | |
| 6 | | R3-4: Buffered fallback double billing | Fixed | [Plan 3:160](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/docs/superpowers/plans/2026-10-24-edge-asset-cache-plan-3-serve.md:160) assigns billing to the delivered response; Task 9 tests the combined meters. | |
| 7 | | R3-5: Plain HEAD streamed | Fixed | [Plan 3:160](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/docs/superpowers/plans/2026-10-24-edge-asset-cache-plan-3-serve.md:160) explicitly buffers HEAD and requires bodyless refusal delivery. | |
| 8 | | R3-6: Re-ship cannot retry generation backfill | Fixed | [Plan 1:202](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/docs/superpowers/plans/2026-10-24-edge-asset-cache-plan-1-declare-publish.md:202) requires backfill before both successful responses and adds the partial-failure retry test. | |
| 9 | | R1-15: Missing production-wired attacks | Partly fixed | The named refusal gaps are closed, but [Task 9](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/docs/superpowers/plans/2026-10-24-edge-asset-cache-plan-3-serve.md:250) still omits explicit two-edge cases for missing Cache-Control, `no-store`, and the retiring-build-only declaration required by spec §12. | |
| 10 | |
| 11 | 1. **P1 — The record-write census is missing from the implementation and landing tasks.** Plan 1 Tasks 5 and 11. Task 5 introduces `SetRecordAssetGen` through `updateRecord` and changes existing record creators ([plan 1:192](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/docs/superpowers/plans/2026-10-24-edge-asset-cache-plan-1-declare-publish.md:192)). Those changes trigger the separate record-write census, which rejects both unlisted declarations and changed source digests ([plan9_b8_census_test.go:262](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/internal/provision/plan9_b8_census_test.go:262)). Task 11 updates only the root-read census; that cannot satisfy `TestPlan9B8RecordWriteCensus`. **Smallest fix:** assign review and updates of the record-write inventory, register `SetRecordAssetGen` in its typed-writer recognizer, and run the record-write census alongside the root-read gate. |
| 12 | |
| 13 | 2. **P2 — A new owner’s cache key can be filled through the previous owner’s backend.** Plan 1 Task 8 and Plan 3 Task 5. `assetPolicy` reads the registry ([plan 1:268](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/docs/superpowers/plans/2026-10-24-edge-asset-cache-plan-1-declare-publish.md:268)), while `fillFromApp` dispatches through the independently captured `up.proxy`; the signed-fill check compares the assertion only against `LocalAssets.For` ([plan 3:158](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/docs/superpowers/plans/2026-10-24-edge-asset-cache-plan-3-serve.md:158), [plan 3:162](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/docs/superpowers/plans/2026-10-24-edge-asset-cache-plan-3-serve.md:162)). The edge reloads its route snapshot on a separate [two-second poll](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/internal/edge/edge.go:2324). After an alias changes owners, policy can therefore name the new app while `up` still targets the old one. If both apps use the same version string and declare the prefix, the declaration check does not distinguish them. **Smallest fix:** require the selected upstream’s owner, primary route and asset generation to match the policy used for the key before acknowledging or filling. Add a test that changes the registry’s alias target while deliberately withholding `Edge.Reload`. |
| 14 | |
| 15 | 3. **P3 — Buffered initiating misses are labelled as hits.** Plan 3 Tasks 3, 5 and 6. `serveAssetEntry` unconditionally sets `Carlos-Cache: hit` ([plan 3:120](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/docs/superpowers/plans/2026-10-24-edge-asset-cache-plan-3-serve.md:120)), but buffered cold HEAD, range and conditional requests must also use that helper after filling ([plan 3:160](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/docs/superpowers/plans/2026-10-24-edge-asset-cache-plan-3-serve.md:160)). No interface permits the initiating response to retain `miss`. **Smallest fix:** pass the cache result into the serving helper, or assign that header in its callers; test that the cold initiator reports `miss` and subsequent requests report `hit`. |
| 16 | |
| 17 | reject |
amadan