carlos / platform Public

| Round 1 finding | Disposition | Reason | |---|---|---| | 1. Moves snapshot ordering | Resolved | §4.3 selects the snapshot under w.pass, checks epochs, and defines the lock order. | | 2. Backstop overwrites newer view | Resolved | §§4.3–4.4 serialize incremental refreshes and the entire backstop acquisition/publication under one lock. §8 includes the race witness. | | 3. Lost store capabilities | Resolved | §3.3 places hooks inside the concrete stores and covers all four mutation methods, preserving existing interfaces. | | 4. Failed scopes skipped on 304 | Resolved | §4.2 separates observed and applied generations and explicitly retries outstanding scopes on 304. | | 5. Incorrect/missing manifests | Resolved | §4.1 names both instances.json and sidecars.json, preserving their parsers and error semantics. | | 6. Hostops integration | Resolved | §3.3 defines hook placement and bump authority; §3.4 requires read-extension forwarding; §8 tests final claim-enabled handles. | | 7. Fleet-door access | Resolved | §3.4 explicitly retains ordinary polling for unsupported stores and failed index reads, without exposing the global index. | | 8. Mesh keys and heartbeat | Resolved | §5 retains independent mesh-key polling and records refresh attempts on unchanged polls. | | 9. Telemetry backstop | Resolved | §5 supplies first-use reads, independent retries, and a maximum successful-read age. | | 10. Unrelated per-app reads | Partly resolved | §4.5 scopes index-only passes, but explicitly preserves unrestricted serial-triggered adoption/config sync. Ordinary console config writes still bump serial (apiconfig.go:612); those passes read unrelated hosted apps (agent.go:2827, syncexec.go:178). The proportional-work goal therefore remains only partly met. | | 11. Box-publication type assertion | Resolved | §3.3 preserves the concrete *release.S3Store identity; §8 requires a publication witness through the enabled opener. |

1. P2 — Console orphan-run housekeeping retains an all-app listing loop (§§2, 4.6, 9). Replacing the record walk with RecordView leaves a separate fan-out: housekeeping runs every twentieth 30-second sweep (runsweep.go:17, :39). Every app with an instance record enters its app set, including apps with no active run (:83); housekeeping then calls sweepOrphanRuns for each app (:110), which lists that app’s runs/ prefix (:232). Thus an idle deployment still incurs an all-app LIST cycle every ten minutes, outside the specified backstop and named non-goals. Require: assign orphan discovery a bounded cache/backstop mechanism while preserving time-driven cleanup, or explicitly retain this loop as a non-goal and qualify the scaling claim. Because §3.2 excludes runs/, app-generation gating alone would not discover every orphan.

Verdict: accept at spec level at ca129623, with the P2 cost gaps above. All round-1 P1 blockers are resolved; no new P1 found.