| 1 | | Round 1 finding | Disposition | Reason | |
| 2 | |---|---|---| |
| 3 | | 1. Moves snapshot ordering | Resolved | §4.3 selects the snapshot under `w.pass`, checks epochs, and defines the lock order. | |
| 4 | | 2. Backstop overwrites newer view | Resolved | §§4.3–4.4 serialize incremental refreshes and the entire backstop acquisition/publication under one lock. §8 includes the race witness. | |
| 5 | | 3. Lost store capabilities | Resolved | §3.3 places hooks inside the concrete stores and covers all four mutation methods, preserving existing interfaces. | |
| 6 | | 4. Failed scopes skipped on 304 | Resolved | §4.2 separates observed and applied generations and explicitly retries outstanding scopes on 304. | |
| 7 | | 5. Incorrect/missing manifests | Resolved | §4.1 names both `instances.json` and `sidecars.json`, preserving their parsers and error semantics. | |
| 8 | | 6. Hostops integration | Resolved | §3.3 defines hook placement and bump authority; §3.4 requires read-extension forwarding; §8 tests final claim-enabled handles. | |
| 9 | | 7. Fleet-door access | Resolved | §3.4 explicitly retains ordinary polling for unsupported stores and failed index reads, without exposing the global index. | |
| 10 | | 8. Mesh keys and heartbeat | Resolved | §5 retains independent mesh-key polling and records refresh attempts on unchanged polls. | |
| 11 | | 9. Telemetry backstop | Resolved | §5 supplies first-use reads, independent retries, and a maximum successful-read age. | |
| 12 | | 10. Unrelated per-app reads | **Partly resolved** | §4.5 scopes index-only passes, but explicitly preserves unrestricted serial-triggered adoption/config sync. Ordinary console config writes still bump serial ([apiconfig.go:612](internal/console/apiconfig.go#L612)); those passes read unrelated hosted apps ([agent.go:2827](internal/host/agent.go#L2827), [syncexec.go:178](internal/appconfig/syncexec.go#L178)). The proportional-work goal therefore remains only partly met. | |
| 13 | | 11. Box-publication type assertion | Resolved | §3.3 preserves the concrete `*release.S3Store` identity; §8 requires a publication witness through the enabled opener. | |
| 14 | |
| 15 | 1. **P2 — Console orphan-run housekeeping retains an all-app listing loop (§§2, 4.6, 9).** Replacing the record walk with `RecordView` leaves a separate fan-out: housekeeping runs every twentieth 30-second sweep ([runsweep.go:17](internal/console/runsweep.go#L17), [:39](internal/console/runsweep.go#L39)). Every app with an instance record enters its app set, including apps with no active run ([:83](internal/console/runsweep.go#L83)); housekeeping then calls `sweepOrphanRuns` for each app ([:110](internal/console/runsweep.go#L110)), which lists that app’s `runs/` prefix ([:232](internal/console/runsweep.go#L232)). Thus an idle deployment still incurs an all-app LIST cycle every ten minutes, outside the specified backstop and named non-goals. **Require:** assign orphan discovery a bounded cache/backstop mechanism while preserving time-driven cleanup, or explicitly retain this loop as a non-goal and qualify the scaling claim. Because §3.2 excludes `runs/`, app-generation gating alone would not discover every orphan. |
| 16 | |
| 17 | **Verdict: accept at spec level at `ca129623`, with the P2 cost gaps above. All round-1 P1 blockers are resolved; no new P1 found.** |
amadan