| 1 | Reviewed rev 5 at `761b8eb1` against the clean worktree, after reading AGENTS.md, rounds 1–4, and the dispositions in **§21**. “Resolved” below means resolved in the design; implementation remains ahead. |
| 2 | |
| 3 | | Round-1 finding | Status | Why | |
| 4 | |---|---|---| |
| 5 | | 1. Picker bypasses pool exclusion | Resolved | Pooled manifests yield no candidates or guess; target boxes must positively advertise shared-pool eligibility. | |
| 6 | | 2. Browser adoption changes the default | Resolved | `@auto` remains distinct from an explicit choice, and inference follows adoption detection. | |
| 7 | | 3. Unnamed home prevents override | Resolved | Non-home app defaults require a named home, providing an explicit-home override. | |
| 8 | | 4. Mixed versions and rollback unspecified | Resolved | Read-first rollout, switch behavior, and the region-aware binary floor are specified; R7 settles enforcement. | |
| 9 | | 5. Existing-canary `--region` undefined | Resolved | Equal proceeds; different refuses before mutation or upload. Fleet placement now has a consistent refusal before either branch. | |
| 10 | | 6. Manifest absence versus failure unspecified | Resolved | Absent, known, and unreadable policies have distinct behavior; legacy topology remains available. | |
| 11 | | 7. Unavailable-default explanation disappears | Resolved | `app_default` represents absent regions, and C8 does not depend on the number of alternatives. | |
| 12 | | 8. Query hints reflected by redirects | Resolved | Hints use POST bodies, with privacy assertions covering redirects, errors, logs, and audit. | |
| 13 | |
| 14 | **No new P1, P2, or P3 findings.** The three round-4 corrections are sufficient at design level. |
| 15 | |
| 16 | The requested checks support proceeding: |
| 17 | |
| 18 | - **Create precedence:** The insertion follows placement resolution and precedes replica validation, policy validation, and the armed gate in [apiinstances.go:763](/home/paulca/amadan.net/carlos/platform-nearest-region/internal/console/apiinstances.go:763). Its conditions preserve fleet, pool, replica, static, and address-backed exclusions. [DerivesPaths:343](/home/paulca/amadan.net/carlos/platform-nearest-region/internal/provision/provision.go:343) matches the intended socket-backed shape; sidecars retain their separate door. |
| 19 | - **Migration:** ALTERs precede `migrateAppsKey` at [store.go:402](/home/paulca/amadan.net/carlos/platform-nearest-region/internal/console/store.go:402). §5.2 correctly requires updating the rebuild DDL and both sides of the copy at [store.go:487](/home/paulca/amadan.net/carlos/platform-nearest-region/internal/console/store.go:487). |
| 20 | - **Compatibility:** The existing permissive request decoder at [authcli.go:945](/home/paulca/amadan.net/carlos/platform-nearest-region/internal/console/authcli.go:945) and response unmarshalling at [apimode.go:1013](/home/paulca/amadan.net/carlos/platform-nearest-region/apimode.go:1013) support additive fields. Existing apps retain their home default. |
| 21 | - **Policy and availability:** §6.4 constrains every non-null guess through the normalized allow-list predicate; §7 rechecks placement before writing. A stale guess can be refused, but cannot bypass policy. Migrated apps avoid the new non-home eligibility refusal. For non-home apps, explicit overrides remain policy-bound: if all allowed destinations are unavailable, capacity or policy must be repaired. |
| 22 | - **Privacy:** The proposed persistent fields contain only region and source. Request-local hints and coordinates require no retention; POST bodies avoid the query reflection at [server.go:1306](/home/paulca/amadan.net/carlos/platform-nearest-region/internal/console/server.go:1306). |
| 23 | - **Rollout:** Box publication precedes activation, region-aware reads survive switch-off, and the new service gate checks actual public and cross-edge requests. That addresses the separate mesh-key dependency at [edge.go:2699](/home/paulca/amadan.net/carlos/platform-nearest-region/internal/edge/edge.go:2699). Phase L remains gated separately under R8. |
| 24 | |
| 25 | There are **no open questions to answer** in this revision: §17 contains rollout, and §18 explicitly says none. The earlier completion, latency-sequencing, and rollback questions are settled by R5, R8, and R7 respectively. |
| 26 | |
| 27 | All code citations above were checked. No files changed, no tests ran, and production configuration was not inspected. |
| 28 | |
| 29 | **Verdict: ready for planning.** The placement design now defines the necessary precedence, migration, compatibility, privacy, and rollout safeguards without depending on Phase L. |
amadan