carlos / platform Public

| Earlier finding | Disposition at e053a333 | |---|---| | R1-1 — Run/move admission race | Fixed. Run §5.1 puts both admissions on the instance record’s ETag and requires guards to be reapplied after a conflict. | | R1-3 — Missing incarnation | Fixed. Run §§5.1–5.2 bind the request to the record incarnation and check it before launch. | | R1-10 — Protected route columns | Fixed. Seeded §5.4 explicitly refuses Backing, Tunnel, Caps, Platform and Canary. | | R1-15 — Abort safety outside HTTP | Fixed. The import gate, commit boundary and run refusal together cover the previously identified paths. | | R1-18 — Historical timestamps | Declined with an acceptable reason. Seeded §4 limits this version to TXIDs; timestamp support is explicitly excluded. | | R1-19 — Scratch bounds | Fixed at spec level. Seeded §4 names decoded-size admission, a shared reservation pool, shared concurrency limits and cancellation on overgrowth. | | R2-1 — Local database survives abort/re-import | Fixed for the reported local-data defect. Seeded §§3.4 and 5.6 require matching installation identity and removal of local database artifacts. A distinct remote-cleanup defect appears below. | | R2-2 — Run bypasses import gate | Fixed. Run §5.1 refuses uncommitted imports under the shared CAS and requires another check at launch. | | R2-3 — Crash between swap and record CAS | Fixed. Seeded §§5.4 and 5.7 consult the identity-bound journal before applying legacy-row predicates and resume the record transition. | | R2-4 — Verification wake during rollback | Not fixed as an implementable rollback. The durable gate closes admission, but §5.6’s retry instruction cannot work with the selected API: FenceAndStopIfUnfenced refuses any existing fence, including its own previous attempt (maintenance.go:103). A never-woken import also lacks stop history and returns ErrStopUnproven (maintenance.go:114); every subsequent attempt then returns ErrFenceHeld. Fix: define resumption of the journal’s own fence and cold/restarted stop proof. The existing layout caller handles these distinctions explicitly (pass.go:654). | | R2-5 — Seven-day expiration deletes needed seeds | Fixed for the reported expiration defect. Seeded §3.1 removes unconditional expiration. The replacement sweep introduces a separate publication race below. | | R2-6 — Reported pickup failure leaves executable work | Fixed. Run §5.2 requires successful terminal expiry before reporting “not picked up”; §5.7 makes queued cancellation terminal. | | R2-7 — Instance deletion bypasses rollback | Fixed. Seeded §5.6 refuses deletion after import admission becomes actionable, and journal recovery does not depend on the record remaining present. |

1. P2 — Seeded §§5.6–5.7: rollback forgets unfinished replica cleanup.

Step 4 restores the original route and deletes the journal; step 6 deletes the remote replica. Crash between them. On restart, the surviving aborted record has no journal, so §§3.2 and 5.6 direct the box to delete only the seed snapshot and record. Nothing resumes deletion of the replica.

Record deletion deliberately preserves replica data (provision.go:1840). The ordinary creation gate then refuses reuse of that hostname because replica data remains (apiinstances.go:1146). Thus an interrupted abort leaves the conversion unable to retry through the ordinary creation checks.

Fix: retain the journal in a route-restored/cleanup-pending phase until remote cleanup and record retirement finish. Recovery from that phase must neither repeat the swap nor stop the restored legacy process.

1. P2 — Seeded §§3.1, 4 step 7: the sweep can delete a snapshot during successful creation.

--from writes the snapshot before writing its record. The new sweep deletes snapshots when “no record names it.” A sweep between those two writes therefore deletes the snapshot, after which creation can successfully publish ready. Its first wake has neither a replica nor the required snapshot and must fail.

These are independent conditional object writes: PutFrom conditions only the snapshot key (store.go:800); CreateRecord separately creates the record key (provision.go:845). Neither protects the interval from deletion.

Fix: reserve the seed identity durably before uploading, using a non-minting record state or publication intent that the sweep honors. Retire abandoned reservations through an explicit terminal transition before deleting their objects.

1. P2 — Run §§5.2, 5.8: a disconnected caller can leave queued work open indefinitely.

Let the console accept a run while its box is unavailable, then disconnect the CLI before its 60-second expiry request. Only the CLI initiates queued → expired. The sweep handles overdue picked/cancel runs and terminal runs, but never queued. Consequently ActiveRun remains non-terminal indefinitely and blocks subsequent runs and moves.

The selected persistence mechanism is a conditional object write, with no expiry behavior (store.go:767). Existing record transitions likewise occur through explicit mutations (provision.go:1129); storing Deadline does not perform a transition.

Fix: assign overdue queued-run expiry to the console sweep, independently of the CLI. It must CAS queued → expired against pickup, publish the terminal result and audit outcome, and release the reservation.

carlos run: revise.

Seeded instances: revise.