carlos / platform Public

Reviewed rev 5 at 761b8eb1 against the clean worktree, after reading AGENTS.md, rounds 1–4, and the dispositions in §21. “Resolved” below means resolved in the design; implementation remains ahead.

| Round-1 finding | Status | Why | |---|---|---| | 1. Picker bypasses pool exclusion | Resolved | Pooled manifests yield no candidates or guess; target boxes must positively advertise shared-pool eligibility. | | 2. Browser adoption changes the default | Resolved | @auto remains distinct from an explicit choice, and inference follows adoption detection. | | 3. Unnamed home prevents override | Resolved | Non-home app defaults require a named home, providing an explicit-home override. | | 4. Mixed versions and rollback unspecified | Resolved | Read-first rollout, switch behavior, and the region-aware binary floor are specified; R7 settles enforcement. | | 5. Existing-canary --region undefined | Resolved | Equal proceeds; different refuses before mutation or upload. Fleet placement now has a consistent refusal before either branch. | | 6. Manifest absence versus failure unspecified | Resolved | Absent, known, and unreadable policies have distinct behavior; legacy topology remains available. | | 7. Unavailable-default explanation disappears | Resolved | app_default represents absent regions, and C8 does not depend on the number of alternatives. | | 8. Query hints reflected by redirects | Resolved | Hints use POST bodies, with privacy assertions covering redirects, errors, logs, and audit. |

No new P1, P2, or P3 findings. The three round-4 corrections are sufficient at design level.

The requested checks support proceeding:

• Create precedence: The insertion follows placement resolution and precedes replica validation, policy validation, and the armed gate in apiinstances.go:763. Its conditions preserve fleet, pool, replica, static, and address-backed exclusions. DerivesPaths:343 matches the intended socket-backed shape; sidecars retain their separate door.
• Migration: ALTERs precede migrateAppsKey at store.go:402. §5.2 correctly requires updating the rebuild DDL and both sides of the copy at store.go:487.
• Compatibility: The existing permissive request decoder at authcli.go:945 and response unmarshalling at apimode.go:1013 support additive fields. Existing apps retain their home default.
• Policy and availability: §6.4 constrains every non-null guess through the normalized allow-list predicate; §7 rechecks placement before writing. A stale guess can be refused, but cannot bypass policy. Migrated apps avoid the new non-home eligibility refusal. For non-home apps, explicit overrides remain policy-bound: if all allowed destinations are unavailable, capacity or policy must be repaired.
• Privacy: The proposed persistent fields contain only region and source. Request-local hints and coordinates require no retention; POST bodies avoid the query reflection at server.go:1306.
• Rollout: Box publication precedes activation, region-aware reads survive switch-off, and the new service gate checks actual public and cross-edge requests. That addresses the separate mesh-key dependency at edge.go:2699. Phase L remains gated separately under R8.

There are no open questions to answer in this revision: §17 contains rollout, and §18 explicitly says none. The earlier completion, latency-sequencing, and rollback questions are settled by R5, R8, and R7 respectively.

All code citations above were checked. No files changed, no tests ran, and production configuration was not inspected.

Verdict: ready for planning. The placement design now defines the necessary precedence, migration, compatibility, privacy, and rollout safeguards without depending on Phase L.