carlos / platform Public

| Earlier finding | Disposition | Why | |---|---|---| | R4-1: Missing record-write census | Fixed | Plan 1:44 assigns the recognizer and inventory updates; Task 11 runs both censuses. | | R4-2: New owner’s key filled through old backend | Fixed | Plan 3:162 requires owner, primary-route and generation agreement before filling or acknowledging, with a withheld-reload test. | | R4-3: Buffered initiating misses labelled hits | Fixed | Plan 3:120 adds an explicit result argument and tests cold miss followed by hit. | | R3-3: Failed retirement advances authority | Fixed | Plan 1:230 includes failed retirement and failed fresh-walk confirmation in completeness, with tests for both. | | R1-15: Missing production-wired attacks | Fixed | Plan 3:260 adds missing Cache-Control, no-store and the retiring-build-only case to two-edge acceptance. |

1. P2 — An existing forwarding path bypasses the far asset cache entirely. Plan 3 Task 6 inserts serveAssetFar only in the lookup-miss branch (plan 3:193). But when a local wildcard matches and another box owns the exact hostname, ServeHTTP calls backhaulTo and returns before that branch (edge.go:1526). An armed far edge with such a wildcard therefore backhauls every asset request, even with a valid warm entry. Smallest fix: invoke the far-cache handler in the exact-remote precedence branch before backhaulTo, retaining its existing hop and door guards. Add a two-edge test with a local wildcard and an exact remote asset host; the second request must hit locally without dialing either backend.

reject