# Findings on the Meet spec, revision 6

GPT-6 via `codex exec`, read-only, round 6, reviewing commit 61475ed against the five earlier findings files. Two runs completed (the first was relaunched after a kill and both finished); this is the later report, which also notes revision 7 already carried its corrections. Verbatim.

Reviewed revision 6 at `61475ed787d945b2e76ccff372ded6295d409c5d`. No files modified. **All R5 findings and remaining earlier residues are closed. Two new P3 corrections; no blocking finding.** “Closed” assesses the design against the reported failure, not implementation results.

| R5 finding | Status | Assessment |
|---|---|---|
| R5-1 cursor across generations | **Closed** | §4.6 preserves both sequence counters across resets. In the reported failure, B’s new offer now has `seq > 20`, so A’s old cursor cannot suppress it. The roster supplies the missed generation change, and §13 explicitly tests this case. |
| R5-2 waiting takeover departure | **Closed** | §4.2 branches on the old participation’s state: admitted produces `gone`; waiting produces `knock-gone` for admitted members only; unjoined produces nothing. An admitted guest learns nothing about the waiting departure. |
| R5-3 destructive GET | **Closed** | §4.2 requires a confirmation page and a CSRF-protected POST. Fresh-stream GETs conflict instead of replacing participation. §2.5 requires current standing and the session’s existing participation at execution. The erroneous test terminology below does not reopen the attack. |

The half-closed entries in R5’s two tables, checked individually:

| Earlier residue | Status | Assessment |
|---|---|---|
| R4-1 reset protocol | **Closed** | Typed reset operations, hub-owned generations, roster recovery and preserved sequence counters now work together. Losing `pair` no longer makes a retained new-generation offer invisible. |
| R3-7 downstream signalling loss | **Closed** | An accepted message lost downstream is replayed when retained; missing history triggers a coordinated reset recoverable through either `pair` or the roster. |
| R2-5 delivery | **Closed** | Ordered POSTs, receiver deduplication, replay and generation recovery answer the recorded delivery failures without restarting the cursor. |
| R1-10 negotiation | **Closed** | Perfect negotiation supports either offerer; reset recovery supplies the missing exchange; renewal completion remains tied to the replacement ICE generation. |

These closures follow the operative [replay rules](/home/paulca/amadan.net/oficina/meet-spec/docs/superpowers/specs/2026-09-07-meet-design.md:598) and [delivery rules](/home/paulca/amadan.net/oficina/meet-spec/docs/superpowers/specs/2026-09-07-meet-design.md:662), rather than §14’s dispositions.

The other entries in R5’s tables—R4-2, R4-3, R4-4, R3-9, R2-4 and R1-9—remain **closed**. Terminal replacement handling, fresh-entry conflicts, admission-branched resume, restart reconciliation and the corrected endpoint/continuation contracts survive the amendments. None is half-closed or worse.

**R6-1 — P3 — §13: The takeover gate specifies a CSRF token the reused middleware does not use.**

At the reviewed commit, line 1049 requires “a takeover POST without the CSRF token refused.” The scaffold mounts `csrf.Protect`, whose protection checks `Sec-Fetch-Site`, `Origin` or `Referer`. It neither issues nor checks a token. A legitimate same-origin confirmation succeeds without one. [Scaffold mounting](/home/paulca/amadan.net/oficina/meet-spec/internal/calls/app.go:55), [framework protection](/home/paulca/go/pkg/mod/amadan.net/rastrillo/rastrillo@v0.26.0/csrf/csrf.go:47).

**Correction:** Assert that a cross-origin takeover POST is refused without changing participation, and that an authorized same-origin confirmation succeeds without a token. Retain the cross-site GET navigation gate. This corrects the test contract; the POST mechanism already closes R5-3.

**R6-2 — P3 — §§4.2, 4.5: The replacement response requires a successor peer that may not exist.**

§4.2 now ends the old participation and redirects. The successor peer is allocated only when a later fresh stream opens. The old tab can resume between those requests—or after the destination tab closes without opening its stream—yet §4.5 still requires `410 {reason: "replaced", by: <peer>}`. No successor ID exists to populate `by`. [Takeover ordering](/home/paulca/amadan.net/oficina/meet-spec/docs/superpowers/specs/2026-09-07-meet-design.md:505), [410 contract](/home/paulca/amadan.net/oficina/meet-spec/docs/superpowers/specs/2026-09-07-meet-design.md:639).

**Correction:** Remove `by`; terminal handling needs only `reason: "replaced"`. The tombstone already establishes displacement without identifying a successor.

The source checks found no further blocking defect. The relay configuration and credential schedule match relay §2 at `dcf0cad`. The browser contracts support [ICE restart](https://www.w3.org/TR/webrtc/#dom-rtcpeerconnection-restartice) and the [candidate generation statistic](https://www.w3.org/TR/webrtc-stats/#dom-rtcicecandidatestats-usernamefragment) used to establish renewal. The scriptless floor remains buildable, and the amendments introduce no dependency on a later slice.

Verification limits remain for `rastrillo/rastrillo` discussion 17, `oficina/suite` discussion 5 and the claimed live relay deployment.

During review, the checkout advanced externally to revision 7 at `f467cd9`, which already contains both corrections above. This report’s findings and verdict concern revision 6 at `61475ed`; they are not an independent review of revision 7.

**Verdict: accept with corrections.**