| 1 | | R1 finding | Disposition | Evidence at `345255bf` | |
| 2 | |---|---|---| |
| 3 | | F1 — Moves regress behind live fallback | Addressed | Move steps use the live strict walk at [movespass.go:1098](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/s3-polling-336/internal/host/movespass.go:1098). Snapshot skipping requires prior idle state and no local work at [movespass.go:1307](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/s3-polling-336/internal/host/movespass.go:1307). | |
| 4 | | F2 — Sidecar placement cannot evacuate | Addressed | Placement uses the scanned manifest at [sidecar_reconcile.go:354](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/s3-polling-336/internal/provision/sidecar_reconcile.go:354); retirement rescans live and retains rows on read failure at [sidecar_reconcile.go:538](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/s3-polling-336/internal/provision/sidecar_reconcile.go:538). | |
| 5 | | F3 — Unbounded poll and frozen observation | Addressed | Both view entry points use the bounded poll at [recordview.go:201](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/s3-polling-336/internal/provision/recordview.go:201). Cancellation and lock give-up invalidate the watch at [changewatch.go:74](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/s3-polling-336/internal/release/changewatch.go:74). | |
| 6 | | F4 — Removal omits walk protections | Addressed | The shared scan protects invalid shapes and empty channels before scope checks, and collects by host. Retirement uses its live results at [reconcile.go:1614](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/s3-polling-336/internal/provision/reconcile.go:1614). | |
| 7 | | F5 — Disarmed telemetry memoization | Addressed | Nil-watch execution returns to independent per-app resolution at [telemetry_pass.go:87](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/s3-polling-336/internal/host/telemetry_pass.go:87). | |
| 8 | | F6 — Cross-channel restart suppression | Addressed | Each channel records its own head, generation and age; settlement checks them at [agent.go:2823](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/s3-polling-336/internal/host/agent.go:2823). | |
| 9 | | F7 — Failed certificate-copy retries skipped | Addressed | Unchanged polls retry pending local copies from the retained snapshot at [certsync.go:763](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/s3-polling-336/internal/edge/certsync.go:763). | |
| 10 | |
| 11 | Two new P2 findings in `4512018a..25eac78c`: |
| 12 | |
| 13 | 1. **P2 — A failed-index tick can forget a newly observed canary head.** |
| 14 | [agent.go:2749](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/s3-polling-336/internal/host/agent.go:2749) disables the entire pointer gate, including its read-result callback. Suppose the saved head and live version are v1; an unbumped promotion writes v2; an index-error tick reads v2, but its restart fails and rolls back. The saved head remains v1. After index recovery at the unchanged generation and expiry of the restart hold, [agent.go:2825](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/s3-polling-336/internal/host/agent.go:2825) considers v1 settled and suppresses retries until another pass or the age bound. |
| 15 | |
| 16 | This concerns retrying an **already observed** promotion, rather than the accepted delay in discovering unbumped writes. Force reads on failed-index ticks while retaining their result callbacks, or invalidate the saved heads. Add this recovery-and-rollback regression. |
| 17 | |
| 18 | 2. **P2 — Moves now perform additional filesystem reads while disarmed.** |
| 19 | The end-of-pass assignment at [movespass.go:1296](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/s3-polling-336/internal/host/movespass.go:1296) calls `localMoveState()` even with no armed record view. An otherwise idle worker consequently enumerates `.moves` and its child directories through [movespass.go:1356](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/s3-polling-336/internal/host/movespass.go:1356), including when Phase 1 moves are disabled. This violates the brief’s explicit disarmed-equivalence requirement. |
| 20 | |
| 21 | Restrict the idle bookkeeping and its disk inspection to armed readers; verify the disarmed path performs no added directory reads. |
| 22 | |
| 23 | Tests could not start: the read-only sandbox prevented Go from creating its build directory. Conclusions are from code and test inspection. |
| 24 | |
| 25 | **Verdict: accept under the requested P1-blocker criterion. All four R1 P1s are addressed; no new Critical/P1 found. The two P2s above remain.** |
amadan