Review brief: S3 change index

You are an independent second reader of a design spec for the CARLOS platform (this repository). Read cold and adversarially.

Spec: docs/superpowers/specs/2026-10-21-s3-change-index-design.md at the commit named in the prompt.

Fixed rulings, do not re-argue

§1 of the spec lists the product owner's rulings: the bucket stays the store of record (no database, cache tier or DynamoDB), and the fix is a change index in the bucket with a backstop walk. Do not propose alternatives to them. Report only mechanisms that fail to honour a ruling, fail the spec's own goals (§2), or break something else in the platform. Cost estimates are context, not something to audit to the cent.

What to check

Verify against the code, not the spec's description of it. Cite file:line for every claim about existing code. The places that matter:

• internal/release/store.go (Store, prefixStore, ModLister, S3Store Put/Get/ListMod, DirStore), internal/release/serial.go, internal/console/serialbump.go.
• internal/provision/reconcile.go (Reconcile, knownAccounts, ListAllRecords*, listAppSubtree, the per-app trash and manifest reads), sidecar_reconcile.go, record_sequence.go (WriteRecord), provision.go (DeleteRecord).
• internal/host/agent.go (reconcileMu, fastTick, fullPass, fastMembers, PassFilter call, configGenLoop, genPollPass, instancesLoop), movespass.go, moveshold.go, movesoffline*.go, steering_loop.go, telemetry_pass.go, runs.go, seedwiring.go.
• internal/console/runsweep.go, seedsweep.go, apiruns*.go.
• internal/edge/certsync.go, homemap.go, storedoor.go.
• cli.go (openStore), appconfig_cli.go, every release.NewS3Store/NewS3StoreIn call site.
• internal/hostops mutation boundary and classifier.

Questions worth your time:

1. Missed changes. Is there any write that a reader acts on whose key §3.2 maps to no scope, or to the wrong scope? Any reader input outside the scopes (for example something Reconcile or the moves pass reads that is not under apps/<a>/<b>/ or accounts/<a>/)? Any data prefix wrongly excluded?
2. Ordering. Does bump-after-write plus re-list hold under every interleaving with concurrent writers, the backstop walk (§4.4) and the moves pass's separate lock (§4.3)? Can a view ever move backwards, or a strict consumer get an incomplete view as complete?
3. Removal safety. Reconcile removes rows whose host is missing; moves and seed sweep act on absence. Can a stale or partially refreshed view cause a removal, a lost grant, a wrong move step or a snapshot delete that today's walk would not?
4. The writer hook. Does wrapping at the store level actually catch every writer (hostops boundary, prefix stores, store doors for fleet boxes, writers that use S3Store directly, CAS helpers)? Does the wrapper break any caller that type-asserts optional extensions? What happens with contention on one index object under bursts (deploys, purges, run churn)?
5. The GET loops (§5): can gating configGenLoop, canary PassFilter, telemetry, the cert mirror or the home map on generations lose a change, a challenge token or a canary adoption that today's polling catches?
6. Rollout (§7): is a mixed fleet (old writers, new readers armed) safe given the flag, and is disarm really a clean fallback?
7. Anything the spec relies on that does not exist, or exists with a different shape.

Output

A numbered list of findings, each with severity (P1 = correctness or data loss, P2 = goal failure or significant gap, P3 = minor), the spec section, the code evidence with file:line, and the change you would require. End with a verdict: accept, or reject with the P1s that block.