1. **P2 — An inherited over-limit entry traps publishing in a permanent retry loop.** [publisher.go:171](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-1b-next-build/internal/hostfiles/publisher.go:171)  
   The previous publisher could commit a path longer than 4095 bytes. `Open` still accepts that manifest, but this new check rejects every subsequent dirty commit—including updates to healthy files. `StageDelete` also rejects the offending path, so deleting it locally cannot recover publishing. Meanwhile, [run.go:171](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-1b-next-build/internal/hostfiles/run.go:171) retries and logs the permanent failure every tick. Reject such manifests at `Open`, or make this error terminal with an explicit recovery path. Add a continuation test covering a healthy-file update beside an inherited over-limit entry.

**Verdict: request changes for the retry handling.**

The original P2 is closed for newly published manifests: writers and validating readers share the byte cap, without the 256-component restriction. The event skip removes over-limit paths from the retry queue and logs once; it does not discard an in-limit path. Full scans still refuse over-limit trees.

The #279 deferral is acceptable **while relocation remains dormant**, with all three resource defects fixed before activation. Local code supports that dormancy; network restrictions prevented independently reading #279.

Targeted tests could not start because the sandbox prohibits Go’s build-directory creation. Findings are based on source inspection.

---

**FIRST PROMPT:**
“Follow the review brief docs/superpowers/plans/CODEX-REVIEW-REGION-HA-TENANT-DIR-BRIEF-3.md. Review the diff f9123572..400a3302 on branch region-ha-1b-next-build.”

**WHAT:**
Confirm the tenant-directory path-cap fix.

**STATUS:**
Review complete: one P2; tests blocked by the sandbox.

**NEEDED:**
Nothing for this review.

**RECOMMENDED:**
Handle inherited invalid manifests without endless retries; retain #279 as an activation gate.

**SESSION:**
Safe to close. No files changed or processes left running. The read-only sandbox prevented saving the handoff.