carlos / platform Public

| Round-1 # | Disposition at 3bdd1b14 | |---|---| | 1 | Fixed: readiness observes interfaces through /proc, and observation errors fail the probe. | | 2 | Original collisions fixed. A new declaration collision remains; see 25. | | 3 | Fixed: the parent scans for the DBREAD-REPORT line. | | 4 | Incomplete: the removal path is corrected, but the runtime mask cannot override that path; see 27. | | 5 | Fixed: fingerprints use the census row’s seven fields. | | 6 | Fixed: fixture replacements use the existing etag. | | 7 | Fixed: admission tests follow the streaming implementation. | | 8 | Fixed: installed-unit pull acceptance follows agent support. | | 9 | Fixed: sequence advances only after confirmed publication. | | 10 | Fixed: retry preserves the previous reservation and waits for worker shutdown. | | 11 | Incomplete beyond the accepted audit-insert exception: publication boundaries and the serial mutation test still have gaps; see 28, 33. | | 12 | Blocking calls and phase bounds addressed. The claimed impossibility of testing the final bound check is incorrect; see 35. | | 13 | Fixed: body reading receives the pre-header deadline and a stalled-body test. | | 14 | Fixed: draining is checked before admission and after jitter. | | 15 | Incomplete: failures enqueue probes, but the loop can discard them without probing; see 29. | | 16 | Fixed: the second read is submitted after the first worker starts. | | 17 | Fixed: the witness checks interfaces and uses a real ATTACH target. | | 18 | Addressed: both admission counts, release before/after pickup, and fresh-server counts are covered. | | 19 | Addressed: publication is gated until the request ends, with late-write assertions. | | 20 | Ordering mutation addressed; the independent completeness mutation remains unwitnessed; see 31. | | 21 | Telemetry is added, then deleted by Plan 3’s replacement block; see 26. | | 22 | Manifest validation addressed. It invalidates the hash-test fixture; see 32. | | 23 | Fixed: cleanup tests exercise dbPull, including binary SIGINT. | | 24 | Original clamp, malformed-manifest and worker-run cases addressed. A separate hash mutation gap remains; see 32. |

1. P0 — Plan 2, Task 7: dbStream collides with an existing function. Plan 2:2243 declares type dbStream, but package console already contains func dbStream. Types and functions share the package namespace, so Task 7 cannot build. Fix: rename the new relay type, its constructors and dbfCall references consistently, including its census identity.

1. P0 — Plan 3, Task 5: the replacement leaves an unused variable and removes required telemetry. Reopens round-1 #21. Plan 3:713 replaces the block containing both timing logs. It leaves attemptStart, declared at Plan 1:4972, without its sole use at line 5067. This fails compilation and removes the measurements Plan 3 relies on. Fix: retain both timing logs in the replacement, adapting the planning message for pulls that hold files without restoring them.

1. P0 — Plan 1, Task 15: the readiness mask test still cannot establish its premise. Reopens round-1 #4. Plan 1:7142 restores /etc/systemd/system/carlos-dbread@.service, then line 7149 masks it with --runtime. That creates the mask under /run/systemd/system, below /etc/systemd/system in systemd’s load precedence. The restored service remains effective. The installation location agrees with ensureSystemUnits. Fix: temporarily replace the effective /etc unit with a /dev/null symlink, reload, assert that it is masked, and explicitly remove the symlink before restoring the saved unit.

1. P1 — Plan 2, Task 6: admission can still publish after cancellation. Reopens round-1 #11, without reopening the declined SQL-layer change. Plan 2:1443 checks cancellation before the audit insert, then creates both objects without another check until after the queue create. Cancellation during the insert or after request creation therefore permits subsequent publication: the existing DirStore.Put explicitly ignores its context. This contradicts J1 and the claim that cancellation during the insert leaves only an audit row. Fix: check cancellation after the insert and before each subsequent publication, with the appropriate cancel-only exit once publication may have occurred. Test cancellation at those boundaries using the existing store.

1. P2 — Plan 1, Tasks 11–12: a requested readiness probe can be lost. Reopens round-1 #15. Plan 1:5528 consumes probeAfter once. Probe then returns immediately when admission is blocked. After the failed connection closes, its unit may still be deactivating; the orphan check correctly blocks the probe, but nothing retains the request. Capability can remain advertised until the five-minute timer. The new test only checks the channel length. Fix: retain a pending probe until admission permits it, and test the real loop with a failed worker whose unit lingers after connection closure.

1. P2 — Plan 2, Tasks 6–7: accelerated pickup tests depend on the wall clock’s fractional second. Admission truncates issued to seconds, and streaming derives the pickup deadline from that timestamp. Task 7:1598 sets a 400 ms window while requiring three wait lines. For admissions more than 400 ms into a second, the deadline has already passed. The following one-second/five-line flushing test has the same problem. Fix: use a controlled clock or budgets covering timestamp quantization plus the required observation interval. Preserve production timestamp semantics.

1. P2 — Plan 2, Tasks 7 and 14: T18 still does not witness the completeness guard. Reopens round-1 #20. In Plan 2:2022, the first result read sees nothing; the first listing takes its snapshot and then publishes both result and chunk 2. The next round sees both. Consequently, removing next > res.LastSeq still returns the result after both chunks. Reversing the two writes inside the hook does not expose an intermediate state to the console. Fix: make one listing omit chunk 2 after a result read has returned last_seq: 2; release the chunk on a later round and assert that no result was emitted meanwhile.

1. P2 — Plan 3, Tasks 9–10: the hash-mismatch test fails before reaching the hash check. Plan 3:1565 supplies a 13-byte “LTX file.” The new manifest minimum-size check rejects it immediately. Removing the hash comparison therefore leaves the test green, contrary to Task 10’s mutation table. Simply padding the fixture would also leave later LTX validation as an independent rejection. Fix: use valid, restorable LTX bytes and a structurally valid manifest, changing only the summary digest.

1. P2 — Plan 2, Tasks 6 and 14: the serial-context mutation never executes the changed call. Reopens round-1 #11’s validation. Plan 2:1144 cancels during queue creation. The subsequent context check returns before announceDBRead, so replacing that call with detached s.bumpSerial cannot change the test outcome. Fix: add a separate cancellation during the serial read, after the admission check, using a cancellation-aware store wrapper. Assert that the subsequent serial write is refused with announceDBRead and succeeds under the detached-call mutation.

1. P2 — Plan 2, Tasks 10–11: no task supplies T7’s required real CLI/console backhaul acceptance path. Task 11:3599 substitutes a handler that independently writes and flushes fabricated lines, and uses an HTTP client rather than the CLI. Task 10 exercises the real console locally, but does not close that integration gap. Spec T7 explicitly requires the real CLI and console through both paths. Fix: put the combined acceptance test in the root or an external test package with a reusable backhaul harness. Observe progress from the actual CLI process through both edges.

1. P2 — Plan 2, Tasks 7 and 14: the final owner-deadline check has a feasible witness. Task 14:4333 says no in-process client can force a line write past the deadline. A controlled ResponseWriter can hold the final chunk write until the owner deadline passes, then complete within the allowed write slack. That reaches the otherwise untested check. Fix: add this labelled unit test and require removing only the check to change an ended response into an incorrectly relayed result. The stated reason for accepting no witness is false.

1. P2 — Plan 2, Tasks 6 and 8: invalid UTF-8 SQL is rewritten before Sign can reject it. Plan 2:2776 marshals the SQL first. Go replaces invalid UTF-8 during JSON encoding; checkQuerySQL does not validate it. The console therefore signs valid replacement text, defeating Plan 1’s explicit “exact bytes or refusal” requirement. Raw HTTP input has the analogous issue through decodeJSONBody. Fix: validate SQL before CLI serialization and reject malformed string encodings at the HTTP boundary. Add a binary-level invalid-byte test proving that no altered query is published.

1. P2 — Plan 2, Task 8; Plan 3, Task 7: the chunk limit does not bound buffer or spool growth. Plan 2:2831 and Plan 3:1218 increase the allowed total by SealOverhead for every received chunk, without bounding chunk count. Repeated overhead-sized chunks never consume the payload allowance; empty malformed chunks grow the slice or create spool files without consuming any byte allowance. Validation waits until the result. Fix: enforce independent ciphertext-byte and chunk-count limits derived from the supported payload, duration and flush cadence; reject malformed short chunks before storage. Test memory and file sinks with excessive tiny chunks.

1. P2 — Plan 2, Tasks 10 and 14: the named deadline-extension mutation need not fail. Task 10:3442 sends a complete JSON body and assumes the server’s two-second ReadTimeout remains active unless extended. In the checked Go implementation, request-body EOF starts the background reader, which clears the read deadline; the EOF callback is installed at server.go:2059. Removing the handler’s deadline calls therefore does not necessarily interrupt this response, so Task 14’s required mutation remains green. Fix: add an explicit connection/deadline observation that proves the post-admission extension occurs, while retaining the real-path test for streaming and flushing.

Plan 1: REVISE. Plan 2: REVISE. Plan 3: REVISE.

REVISE