# Review brief: S3 change index

You are an independent second reader of a design spec for the CARLOS
platform (this repository). Read cold and adversarially.

**Spec:** `docs/superpowers/specs/2026-10-21-s3-change-index-design.md`
at the commit named in the prompt.

## Fixed rulings, do not re-argue

§1 of the spec lists the product owner's rulings: the bucket stays the
store of record (no database, cache tier or DynamoDB), and the fix is a
change index in the bucket with a backstop walk. Do not propose
alternatives to them. Report only mechanisms that **fail to honour** a
ruling, fail the spec's own goals (§2), or break something else in the
platform. Cost estimates are context, not something to audit to the cent.

## What to check

Verify against the code, not the spec's description of it. Cite
`file:line` for every claim about existing code. The places that matter:

- `internal/release/store.go` (Store, prefixStore, ModLister, S3Store
  Put/Get/ListMod, DirStore), `internal/release/serial.go`,
  `internal/console/serialbump.go`.
- `internal/provision/reconcile.go` (`Reconcile`, `knownAccounts`,
  `ListAllRecords*`, `listAppSubtree`, the per-app trash and manifest
  reads), `sidecar_reconcile.go`, `record_sequence.go` (`WriteRecord`),
  `provision.go` (`DeleteRecord`).
- `internal/host/agent.go` (`reconcileMu`, `fastTick`, `fullPass`,
  `fastMembers`, `PassFilter` call, `configGenLoop`, `genPollPass`,
  `instancesLoop`), `movespass.go`, `moveshold.go`, `movesoffline*.go`,
  `steering_loop.go`, `telemetry_pass.go`, `runs.go`, `seedwiring.go`.
- `internal/console/runsweep.go`, `seedsweep.go`, `apiruns*.go`.
- `internal/edge/certsync.go`, `homemap.go`, `storedoor.go`.
- `cli.go` (`openStore`), `appconfig_cli.go`, every
  `release.NewS3Store`/`NewS3StoreIn` call site.
- `internal/hostops` mutation boundary and classifier.

Questions worth your time:

1. **Missed changes.** Is there any write that a reader acts on whose key
   §3.2 maps to no scope, or to the wrong scope? Any reader input outside
   the scopes (for example something Reconcile or the moves pass reads
   that is not under `apps/<a>/<b>/` or `accounts/<a>/`)? Any data prefix
   wrongly excluded?
2. **Ordering.** Does bump-after-write plus re-list hold under every
   interleaving with concurrent writers, the backstop walk (§4.4) and the
   moves pass's separate lock (§4.3)? Can a view ever move backwards, or a
   strict consumer get an incomplete view as complete?
3. **Removal safety.** Reconcile removes rows whose host is missing;
   moves and seed sweep act on absence. Can a stale or partially refreshed
   view cause a removal, a lost grant, a wrong move step or a snapshot
   delete that today's walk would not?
4. **The writer hook.** Does wrapping at the store level actually catch
   every writer (hostops boundary, prefix stores, store doors for fleet
   boxes, writers that use `S3Store` directly, CAS helpers)? Does the
   wrapper break any caller that type-asserts optional extensions? What
   happens with contention on one index object under bursts (deploys,
   purges, run churn)?
5. **The GET loops** (§5): can gating `configGenLoop`, canary
   `PassFilter`, telemetry, the cert mirror or the home map on generations
   lose a change, a challenge token or a canary adoption that today's
   polling catches?
6. **Rollout** (§7): is a mixed fleet (old writers, new readers armed)
   safe given the flag, and is disarm really a clean fallback?
7. Anything the spec relies on that does not exist, or exists with a
   different shape.

## Output

A numbered list of findings, each with severity (P1 = correctness or
data loss, P2 = goal failure or significant gap, P3 = minor), the spec
section, the code evidence with `file:line`, and the change you would
require. End with a verdict: accept, or reject with the P1s that block.