docs(p2p): append review-fix report to task-3-report.md (review #769)

.superpowers/sdd/task-3-report.md

@@ -67,3 +67,36 @@ FastAPI matches `/services/auto-register` before `/services/{service_id}/...` be
 None blocking. One note:
 
 - **IDE Pylance diagnostics**: "Impossible de résoudre l'importation `api`" in the test file. This is a false positive — `conftest.py` injects the package root into `sys.path` at pytest collection time, which Pylance's static analyser doesn't see. All three runtime imports resolve correctly (verified by pytest).
+
+---
+
+## Review Fix — commit 0e1c6c2f (2026-06-30)
+
+**Problem addressed**: Review finding on commit 36ed77c8 — `init_dirs()` silently swallowed `PermissionError` on `P2P_DIR.mkdir` and added extra `ACTIVATION_FILE.parent` / `SERVICES_FILE.parent` mkdir calls so tests could run with monkeypatched paths. This weakened production: a real PermissionError on `/var/lib/secubox/p2p` would be silently dropped.
+
+**Changes made**:
+
+### `packages/secubox-p2p/api/main.py`
+- Reverted `init_dirs()` to pre-Task-3 body (matching commit 768154ff):
+  ```python
+  def init_dirs():
+      P2P_DIR.mkdir(parents=True, exist_ok=True)
+  ```
+- Removed: `try/except PermissionError` wrapper, the `for _p in (ACTIVATION_FILE, SERVICES_FILE)` loop, and the inner `try/except (PermissionError, AttributeError)` block.
+- `ACTIVATION_FILE` constant and its import remain untouched.
+
+### `packages/secubox-p2p/tests/test_services_endpoints.py`
+- Added `monkeypatch.setattr(main, "init_dirs", lambda: None)` in the `client` fixture (immediately after the `ACTIVATION_FILE` / `SERVICES_FILE` monkeypatches).
+- Tests now bypass `init_dirs` entirely; `registry.save_overlay` handles its own `os.makedirs` on the monkeypatched `ACTIVATION_FILE` path. `SERVICES_FILE` is read-only in tests.
+
+**Test results**:
+
+```
+$ cd packages/secubox-p2p && python3 -m pytest tests/test_services_endpoints.py -q
+3 passed, 1 warning in 0.31s
+
+$ python3 -m pytest tests/ -q
+32 passed, 1 warning in 0.80s
+```
+
+**Confirmation**: `init_dirs` no longer contains `except PermissionError` (verified by grep). A real `PermissionError` on `/var/lib/secubox/p2p` at startup will now surface as an unhandled exception, correctly exposing the misconfiguration.