carlos / platform Public

| R1 finding | Disposition | Evidence at 345255bf | |---|---|---| | F1 — Moves regress behind live fallback | Addressed | Move steps use the live strict walk at movespass.go:1098. Snapshot skipping requires prior idle state and no local work at movespass.go:1307. | | F2 — Sidecar placement cannot evacuate | Addressed | Placement uses the scanned manifest at sidecar_reconcile.go:354; retirement rescans live and retains rows on read failure at sidecar_reconcile.go:538. | | F3 — Unbounded poll and frozen observation | Addressed | Both view entry points use the bounded poll at recordview.go:201. Cancellation and lock give-up invalidate the watch at changewatch.go:74. | | F4 — Removal omits walk protections | Addressed | The shared scan protects invalid shapes and empty channels before scope checks, and collects by host. Retirement uses its live results at reconcile.go:1614. | | F5 — Disarmed telemetry memoization | Addressed | Nil-watch execution returns to independent per-app resolution at telemetry_pass.go:87. | | F6 — Cross-channel restart suppression | Addressed | Each channel records its own head, generation and age; settlement checks them at agent.go:2823. | | F7 — Failed certificate-copy retries skipped | Addressed | Unchanged polls retry pending local copies from the retained snapshot at certsync.go:763. |

Two new P2 findings in 4512018a..25eac78c:

1. P2 — A failed-index tick can forget a newly observed canary head. agent.go:2749 disables the entire pointer gate, including its read-result callback. Suppose the saved head and live version are v1; an unbumped promotion writes v2; an index-error tick reads v2, but its restart fails and rolls back. The saved head remains v1. After index recovery at the unchanged generation and expiry of the restart hold, agent.go:2825 considers v1 settled and suppresses retries until another pass or the age bound.

This concerns retrying an already observed promotion, rather than the accepted delay in discovering unbumped writes. Force reads on failed-index ticks while retaining their result callbacks, or invalidate the saved heads. Add this recovery-and-rollback regression.

1. P2 — Moves now perform additional filesystem reads while disarmed. The end-of-pass assignment at movespass.go:1296 calls localMoveState() even with no armed record view. An otherwise idle worker consequently enumerates .moves and its child directories through movespass.go:1356, including when Phase 1 moves are disabled. This violates the brief’s explicit disarmed-equivalence requirement.

Restrict the idle bookkeeping and its disk inspection to armed readers; verify the disarmed path performs no added directory reads.

Tests could not start: the read-only sandbox prevented Go from creating its build directory. Conclusions are from code and test inspection.

Verdict: accept under the requested P1-blocker criterion. All four R1 P1s are addressed; no new Critical/P1 found. The two P2s above remain.