| 1 | # Findings on the Meet spec, revision 6 |
| 2 | |
| 3 | GPT-6 via `codex exec`, read-only, round 6, reviewing commit 61475ed against the five earlier findings files. Two runs completed (the first was relaunched after a kill and both finished); this is the later report, which also notes revision 7 already carried its corrections. Verbatim. |
| 4 | |
| 5 | Reviewed revision 6 at `61475ed787d945b2e76ccff372ded6295d409c5d`. No files modified. **All R5 findings and remaining earlier residues are closed. Two new P3 corrections; no blocking finding.** “Closed” assesses the design against the reported failure, not implementation results. |
| 6 | |
| 7 | | R5 finding | Status | Assessment | |
| 8 | |---|---|---| |
| 9 | | R5-1 cursor across generations | **Closed** | §4.6 preserves both sequence counters across resets. In the reported failure, B’s new offer now has `seq > 20`, so A’s old cursor cannot suppress it. The roster supplies the missed generation change, and §13 explicitly tests this case. | |
| 10 | | R5-2 waiting takeover departure | **Closed** | §4.2 branches on the old participation’s state: admitted produces `gone`; waiting produces `knock-gone` for admitted members only; unjoined produces nothing. An admitted guest learns nothing about the waiting departure. | |
| 11 | | R5-3 destructive GET | **Closed** | §4.2 requires a confirmation page and a CSRF-protected POST. Fresh-stream GETs conflict instead of replacing participation. §2.5 requires current standing and the session’s existing participation at execution. The erroneous test terminology below does not reopen the attack. | |
| 12 | |
| 13 | The half-closed entries in R5’s two tables, checked individually: |
| 14 | |
| 15 | | Earlier residue | Status | Assessment | |
| 16 | |---|---|---| |
| 17 | | R4-1 reset protocol | **Closed** | Typed reset operations, hub-owned generations, roster recovery and preserved sequence counters now work together. Losing `pair` no longer makes a retained new-generation offer invisible. | |
| 18 | | R3-7 downstream signalling loss | **Closed** | An accepted message lost downstream is replayed when retained; missing history triggers a coordinated reset recoverable through either `pair` or the roster. | |
| 19 | | R2-5 delivery | **Closed** | Ordered POSTs, receiver deduplication, replay and generation recovery answer the recorded delivery failures without restarting the cursor. | |
| 20 | | R1-10 negotiation | **Closed** | Perfect negotiation supports either offerer; reset recovery supplies the missing exchange; renewal completion remains tied to the replacement ICE generation. | |
| 21 | |
| 22 | These closures follow the operative [replay rules](/home/paulca/amadan.net/oficina/meet-spec/docs/superpowers/specs/2026-09-07-meet-design.md:598) and [delivery rules](/home/paulca/amadan.net/oficina/meet-spec/docs/superpowers/specs/2026-09-07-meet-design.md:662), rather than §14’s dispositions. |
| 23 | |
| 24 | The other entries in R5’s tables—R4-2, R4-3, R4-4, R3-9, R2-4 and R1-9—remain **closed**. Terminal replacement handling, fresh-entry conflicts, admission-branched resume, restart reconciliation and the corrected endpoint/continuation contracts survive the amendments. None is half-closed or worse. |
| 25 | |
| 26 | **R6-1 — P3 — §13: The takeover gate specifies a CSRF token the reused middleware does not use.** |
| 27 | |
| 28 | At the reviewed commit, line 1049 requires “a takeover POST without the CSRF token refused.” The scaffold mounts `csrf.Protect`, whose protection checks `Sec-Fetch-Site`, `Origin` or `Referer`. It neither issues nor checks a token. A legitimate same-origin confirmation succeeds without one. [Scaffold mounting](/home/paulca/amadan.net/oficina/meet-spec/internal/calls/app.go:55), [framework protection](/home/paulca/go/pkg/mod/amadan.net/rastrillo/rastrillo@v0.26.0/csrf/csrf.go:47). |
| 29 | |
| 30 | **Correction:** Assert that a cross-origin takeover POST is refused without changing participation, and that an authorized same-origin confirmation succeeds without a token. Retain the cross-site GET navigation gate. This corrects the test contract; the POST mechanism already closes R5-3. |
| 31 | |
| 32 | **R6-2 — P3 — §§4.2, 4.5: The replacement response requires a successor peer that may not exist.** |
| 33 | |
| 34 | §4.2 now ends the old participation and redirects. The successor peer is allocated only when a later fresh stream opens. The old tab can resume between those requests—or after the destination tab closes without opening its stream—yet §4.5 still requires `410 {reason: "replaced", by: <peer>}`. No successor ID exists to populate `by`. [Takeover ordering](/home/paulca/amadan.net/oficina/meet-spec/docs/superpowers/specs/2026-09-07-meet-design.md:505), [410 contract](/home/paulca/amadan.net/oficina/meet-spec/docs/superpowers/specs/2026-09-07-meet-design.md:639). |
| 35 | |
| 36 | **Correction:** Remove `by`; terminal handling needs only `reason: "replaced"`. The tombstone already establishes displacement without identifying a successor. |
| 37 | |
| 38 | The source checks found no further blocking defect. The relay configuration and credential schedule match relay §2 at `dcf0cad`. The browser contracts support [ICE restart](https://www.w3.org/TR/webrtc/#dom-rtcpeerconnection-restartice) and the [candidate generation statistic](https://www.w3.org/TR/webrtc-stats/#dom-rtcicecandidatestats-usernamefragment) used to establish renewal. The scriptless floor remains buildable, and the amendments introduce no dependency on a later slice. |
| 39 | |
| 40 | Verification limits remain for `rastrillo/rastrillo` discussion 17, `oficina/suite` discussion 5 and the claimed live relay deployment. |
| 41 | |
| 42 | During review, the checkout advanced externally to revision 7 at `f467cd9`, which already contains both corrections above. This report’s findings and verdict concern revision 6 at `61475ed`; they are not an independent review of revision 7. |
| 43 | |
| 44 | **Verdict: accept with corrections.** |
amadan