carlos / platform Public

| Earlier finding | Disposition | Verification against rev 5 and existing code | |---|---|---| | 1. Incarnation check | FIXED; DECLINED-AGREE on version pinning | §8.2:660 brackets every download and retry with fresh checks, withholding output until check B. Existing record reads validate account/app/host identity (provision.go:2777); incarnation includes creation identity (claim.go:192). Version pinning is unnecessary to close the reported recreation race. | | 2. Socket on stdin | FIXED | §8.3:716 explicitly sets socket stdin/stdout and journal stderr, replacing the incompatible output arrangement in claimunit_template.go:19. | | 3. Progress versus completion acknowledgement | FIXED | §9.1:812 removes acknowledgements entirely. The terminal-only semantics of apirunsfollow.go:287 are no longer reused for progress. | | 4. Late writes after lost | FIXED | §5.5:370 ends the sole response without creating another terminal result. Late output has no subsequent reader. This avoids claiming a cross-object fence from the per-object conditional writes in store.go:787. | | 5. Cleanup reopens election | FIXED | §5.9:534 retains picked beyond the acceptance window. Conditional creation is implemented by If-None-Match: * in store.go:794. | | 6. “Showed none” after rejection | FIXED | §5.5:377 requires buffering and verification before stdout. This avoids exposing the immediate writes made by the existing runner at db.go:427. | | 7. Stored-ciphertext bound | FIXED | §5.7:469 separates plaintext limits, sealing overhead and lifecycle retention, including noncurrent versions. The envelope components match crypto.go:215; deployment-bucket versioning is confirmed at main.tf:23. | | 8. Disk reservations and restart recovery | FIXED | §5.7:491 serializes reservations and blocks admission beside orphan units. §8.3:753 adds forced process exit after disconnect, covering the context-insensitive file reader (replica_client.go:135) and compactor (compactor.go:177). Reservations remain held until unit termination. | | 9. Worker readiness | FIXED | §7.1:571 requires a real worker exchange and reserves a third connection for probes. Capability remains tied to the running worker loop, following movesoffline.go:254. | | 10. Incomplete snapshot evidence | FIXED | §7.1:590 gives incomplete evidence precedence over both refusals. This matches status-load failure returning nil error at snapshot.go:137, and missing counterparts clearing BoxesComplete at snapshot.go:182. | | 11. Separate store endpoints | DECLINED-AGREE | §12:985 explicitly limits support to the existing shared-endpoint configuration. Both constructors use it: store.go:712, endpoint.go:146. Separate servers remain a separate platform change. | | 12. Census classifications | FIXED | §13:1010 names supported classifications, both query-runner callers, removal rows and required rulings. These match the scanner and overlay validation at plan14rootreads_test.go:33 and line 465. | | 13. Completion deletes terminal evidence | FIXED | §5.3:211 removes protocol deletion and subsequent terminal synthesis. The retained-state recovery needed by the run transport at apirunsfollow.go:126 is unnecessary here. | | 14. Cleanup removes follow identity | FIXED | §9.1:812 removes follow routes. No later request needs the retained identity used by apirunsfollow.go:80. | | 15. Full db gate hides record-changed | FIXED | §9.1:812 runs admission once and returns the box’s refusal through the same response. Later record changes cannot rerun the eligibility checks at apidb.go:132. | | 16. Lazy expiry strands a read | FIXED | Console expiry writes are removed. §5.4:256 requires nonce-based ownership read-back after ambiguous pickup, following the recovery principle in host/runs.go:270. | | 17. Abandoned reads hold admission | FIXED | §5.7:463 binds counts to handler lifetime and deferred release, following apidb.go:395. Explicitly flushed progress and bounded writes provide the disconnect/stall path. | | 18. Forgery claim contradicts sealing | FIXED | §5.6:408 withdraws authenticated-authorship claims. Public-key sealing uses a fresh sender key (crypto.go:173); every box has deployment-bucket write authority (main.tf:166). | | 19. Progress remains buffered | FIXED | §5.5:345 requires flushing every line under its write deadline, including initial headers, and bounds admission before the response. NDJSON is excluded from gzip by compress.go:128. The backhaul’s actual 30-second header timeout is at edge.go:2958. | | 20. Result overtakes final chunk | FIXED | §5.5:328 reads the result before listing chunks and withholds the terminal line until every sequence through last_seq has been delivered. This matches the ordering explicitly required by apirunsfollow.go:101. |

| Invariant | Disposition | Check | |---|---|---| | J1 — One request | FIXED | §§5.5 and 9.1 provide one response, with no follow, resume or later terminal route. The sole post-request write is the stated best-effort cancel. Findings 3, 4, 13, 14 and 15 remain closed. | | J2 — Write once | FIXED | §5.4 requires conditional creation for every protocol object. No replacement or protocol deletion remains. The serial bump is outside db-reads/. Finding 5 remains closed. | | J3 — One owner | FIXED | §5.4 permits execution after an ambiguous create only when read-back contains the same attempt nonce. Failed read-back does not grant ownership. This closes 16 within the explicitly accepted deployment-writer trust boundary of 18. | | J4 — Store-only deletion | FIXED | §§5.7 and 11.1 require lifecycle expiry, including noncurrent versions, before enabling forwarding. Expiry occurs after the request and acceptance windows. Findings 5, 7, 13 and 14 remain closed. | | J5 — Admission follows the work | FIXED | Console reservations last until handler return. Box reservations last until worker-unit termination; unknown units block admission after restart. The forced-exit rule closes the remaining cancellation gap in 8, and handler ownership closes 17. |

New P0–P2 findings: none. P3 observations are excluded as the round-5 brief requests.

The proposed socket activation and private-temp cleanup agree with systemd’s documented semantics: https://www.freedesktop.org/software/systemd/man/257/systemd.exec.html. The revised retention statement correctly distinguishes current-version expiry from permanent noncurrent-version deletion: https://docs.aws.amazon.com/AmazonS3/latest/userguide/lifecycle-expire-general-considerations.html.

Reviewed at 7f463d84eac2d2e161a1a5ade8c5efdbde342df6. Static design review; no files changed or runtime acceptance tests run. Both cited platform module tags were inspected. Current flagship refs, claim activation and the October 21 deployment event remain unverified: GitHub retrieval failed, and the available infrastructure checkout is dated October 6. Acceptance concerns the design; §16’s product-owner rulings remain pending.

ACCEPT