Findings on the Meet spec, revision 6

GPT-6 via codex exec, read-only, round 6, reviewing commit 61475ed against the five earlier findings files. Two runs completed (the first was relaunched after a kill and both finished); this is the later report, which also notes revision 7 already carried its corrections. Verbatim.

Reviewed revision 6 at 61475ed787d945b2e76ccff372ded6295d409c5d. No files modified. All R5 findings and remaining earlier residues are closed. Two new P3 corrections; no blocking finding. “Closed” assesses the design against the reported failure, not implementation results.

| R5 finding | Status | Assessment | |---|---|---| | R5-1 cursor across generations | Closed | §4.6 preserves both sequence counters across resets. In the reported failure, B’s new offer now has seq > 20, so A’s old cursor cannot suppress it. The roster supplies the missed generation change, and §13 explicitly tests this case. | | R5-2 waiting takeover departure | Closed | §4.2 branches on the old participation’s state: admitted produces gone; waiting produces knock-gone for admitted members only; unjoined produces nothing. An admitted guest learns nothing about the waiting departure. | | R5-3 destructive GET | Closed | §4.2 requires a confirmation page and a CSRF-protected POST. Fresh-stream GETs conflict instead of replacing participation. §2.5 requires current standing and the session’s existing participation at execution. The erroneous test terminology below does not reopen the attack. |

The half-closed entries in R5’s two tables, checked individually:

| Earlier residue | Status | Assessment | |---|---|---| | R4-1 reset protocol | Closed | Typed reset operations, hub-owned generations, roster recovery and preserved sequence counters now work together. Losing pair no longer makes a retained new-generation offer invisible. | | R3-7 downstream signalling loss | Closed | An accepted message lost downstream is replayed when retained; missing history triggers a coordinated reset recoverable through either pair or the roster. | | R2-5 delivery | Closed | Ordered POSTs, receiver deduplication, replay and generation recovery answer the recorded delivery failures without restarting the cursor. | | R1-10 negotiation | Closed | Perfect negotiation supports either offerer; reset recovery supplies the missing exchange; renewal completion remains tied to the replacement ICE generation. |

These closures follow the operative replay rules and delivery rules, rather than §14’s dispositions.

The other entries in R5’s tables—R4-2, R4-3, R4-4, R3-9, R2-4 and R1-9—remain closed. Terminal replacement handling, fresh-entry conflicts, admission-branched resume, restart reconciliation and the corrected endpoint/continuation contracts survive the amendments. None is half-closed or worse.

R6-1 — P3 — §13: The takeover gate specifies a CSRF token the reused middleware does not use.

At the reviewed commit, line 1049 requires “a takeover POST without the CSRF token refused.” The scaffold mounts csrf.Protect, whose protection checks Sec-Fetch-Site, Origin or Referer. It neither issues nor checks a token. A legitimate same-origin confirmation succeeds without one. Scaffold mounting, framework protection.

Correction: Assert that a cross-origin takeover POST is refused without changing participation, and that an authorized same-origin confirmation succeeds without a token. Retain the cross-site GET navigation gate. This corrects the test contract; the POST mechanism already closes R5-3.

R6-2 — P3 — §§4.2, 4.5: The replacement response requires a successor peer that may not exist.

§4.2 now ends the old participation and redirects. The successor peer is allocated only when a later fresh stream opens. The old tab can resume between those requests—or after the destination tab closes without opening its stream—yet §4.5 still requires 410 {reason: "replaced", by: <peer>}. No successor ID exists to populate by. Takeover ordering, 410 contract.

Correction: Remove by; terminal handling needs only reason: "replaced". The tombstone already establishes displacement without identifying a successor.

The source checks found no further blocking defect. The relay configuration and credential schedule match relay §2 at dcf0cad. The browser contracts support ICE restart and the candidate generation statistic used to establish renewal. The scriptless floor remains buildable, and the amendments introduce no dependency on a later slice.

Verification limits remain for rastrillo/rastrillo discussion 17, oficina/suite discussion 5 and the claimed live relay deployment.

During review, the checkout advanced externally to revision 7 at f467cd9, which already contains both corrections above. This report’s findings and verdict concern revision 6 at 61475ed; they are not an independent review of revision 7.

Verdict: accept with corrections.