| Earlier finding | Disposition | Why |
|---|---|---|
| R2-1: Replay after delivery starts | Fixed | [Plan 3:160](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/docs/superpowers/plans/2026-10-24-edge-asset-cache-plan-3-serve.md:160) explicitly prohibits replay onto a started response. |
| R2-2: Reader lifetime and disk accounting | Fixed | [Plan 2:129](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/docs/superpowers/plans/2026-10-24-edge-asset-cache-plan-2-disk-store.md:129) introduces reader leases and retains accounting until readers close. |
| R2-3: Authority-test package boundary | Fixed | The authority table moves into `internal/host`; edge-side tests retain their own fixtures ([Plan 3:237](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/docs/superpowers/plans/2026-10-24-edge-asset-cache-plan-3-serve.md:237)). |
| R2-4: Fixture never selects generation routing | Fixed | [Plan 3:249](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/docs/superpowers/plans/2026-10-24-edge-asset-cache-plan-3-serve.md:249) requires hibernating socket-backed instances and asserts `genManaged`. |
| R2-5: Forged marker removed by simulated old edge | Fixed | The test now constructs a legitimately signed hop carrying the forged marker directly ([Plan 3:253](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/docs/superpowers/plans/2026-10-24-edge-asset-cache-plan-3-serve.md:253)). |
| R2-6: Corrective tests excluded by selectors | Fixed | The selectors now include the corrective tests identified in R2. |
| R1-7: Confirming unapplied records | Fixed | [Plan 1:228](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/docs/superpowers/plans/2026-10-24-edge-asset-cache-plan-1-declare-publish.md:228) removes the equality shortcut and covers skipped records and failed gate convergence. |
| R1-15: Missing production-wired attacks | Partly fixed | Oversize and mismatch cases are added, but the production refusal matrix still omits `Vary: Cookie`, `private`, `no-cache` and 206 ([Plan 3:256](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/docs/superpowers/plans/2026-10-24-edge-asset-cache-plan-3-serve.md:256)). |
| R1-16: Incomplete copy inventory | Fixed | EAC-20 and EAC-21 are defined; Plan 1 gates EAC-1–22, and Plan 3 extends the inventory to 24. |

1. **P1 — Metadata is encoded before its body-file version and sizes are assigned.** Plan 2 Task 4 explicitly encodes metadata first, then generates gzip, draws `Version`, publishes the metadata, and sets `Size`, `GzipSize` and `StoredAt` ([plan 2:128](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/docs/superpowers/plans/2026-10-24-edge-asset-cache-plan-2-disk-store.md:128)). The persisted metadata therefore cannot name the newly drawn body version. On reopening, Task 1 removes bodies that no parsed metadata names ([plan 2:67](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/docs/superpowers/plans/2026-10-24-edge-asset-cache-plan-2-disk-store.md:67)). **Smallest fix:** finalize every metadata field before encoding, enforce `MaxMeta` on that final encoding, then publish it. Add a successful commit → reopen → read test covering identity and gzip.

2. **P1 — The provider test uses repository-relative paths from the package directory.** Plan 3 Task 10 places `TestAssetCodeImportsNoAWSSDK` in `internal/edge` but tells it to execute `go list -deps ./internal/assetcache` and inspect `internal/edge/asset*.go` ([plan 3:270](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/docs/superpowers/plans/2026-10-24-edge-asset-cache-plan-3-serve.md:270)). Go runs the test binary in its package directory ([test runner:1663](/usr/local/go/src/cmd/go/internal/test/test.go:1663)); those paths resolve beneath `internal/edge`, where neither exists. **Smallest fix:** specify the repository root as the subprocess working directory and resolve parser paths from that root, or use the package’s full import path and package-local filenames.

3. **P2 — Failed route retirement can still advance authority time.** Plan 1 Task 6 defines completeness over records read and convergence steps applied to those records ([plan 1:228](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/docs/superpowers/plans/2026-10-24-edge-asset-cache-plan-1-declare-publish.md:228)). A deleted record is absent from that loop. Its route’s retirement can fail, be logged, and leave the pass returning nil ([reconcile.go:1597](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/internal/provision/reconcile.go:1597)). With another live instance in the same app, the app can be reported complete while the retired hostname retains a freshly renewed authority time. **Smallest fix:** include required retirements and their fresh-read checks in per-app completeness. Test one deleted instance whose retirement fails while a sibling converges successfully, including the one-hour cutoff.

4. **P2 — Buffered fallback leaves billing ownership ambiguous and can double-charge a request.** Plan 3 Task 5 now re-forwards a buffered initiator after a late fill failure ([plan 3:160](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/docs/superpowers/plans/2026-10-24-edge-asset-cache-plan-3-serve.md:160)). Task 6 also requires the far edge to meter an acknowledged response ([plan 3:194](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/docs/superpowers/plans/2026-10-24-edge-asset-cache-plan-3-serve.md:194)). For a cold range request whose acknowledged fill receives a cookie trailer, the first response is discarded and ordinary backhaul supplies the replacement, which the home meters. Applying both instructions records two requests for one client delivery. **Smallest fix:** assign billing to the final delivery and explicitly suppress billing for the discarded buffered attempt. Add a two-edge late-veto test asserting one total request and only delivered bytes.

5. **P2 — The initiating-request rule puts plain `HEAD` into the streaming branch.** Plan 3 Task 5 fetches with `GET`, then tees any initiator lacking the four listed conditional/range headers ([plan 3:158](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/docs/superpowers/plans/2026-10-24-edge-asset-cache-plan-3-serve.md:158), [plan 3:160](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/docs/superpowers/plans/2026-10-24-edge-asset-cache-plan-3-serve.md:160)). That includes an ordinary `HEAD`, contradicting the explicit requirement to commit first and answer it from the entry ([plan 3:28](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/docs/superpowers/plans/2026-10-24-edge-asset-cache-plan-3-serve.md:28)). Although a real HTTP server suppresses HEAD body bytes, its headers would already be sent before the fallback ETag and stored representation are available. **Smallest fix:** explicitly include `HEAD` in the buffered branch and require bodyless delivery on refusal too; cover cold HEAD on both edges.

6. **P2 — Generation backfill has no retry path through an existing release.** Plan 1 Task 5 assigns `mintMissingAssetGens` after storing an asset-declaring manifest ([plan 1:202](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/docs/superpowers/plans/2026-10-24-edge-asset-cache-plan-1-declare-publish.md:202)). If generation writes partly fail, the manifest already exists. Retrying that version takes the existing-release success return before the new-manifest path ([apicli.go:2202](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/internal/console/apicli.go:2202), [apicli.go:2241](/home/paulca/amadan.net/carlos/platform-edge-asset-cache/internal/console/apicli.go:2241)); no task assigns backfill to that return. **Smallest fix:** require generation backfill before both successful ship responses, using the stored manifest on re-ship. Test partial backfill failure followed by retrying the same version.

reject