carlos / platform Public

rootfs apps: Astra plan review round 2 (accept with fixes, 6 P2)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

claude 12 hours ago f063a27e85594bd3246fa3b1327cb4a0b2e85cfe parent 97c7930

1 file changed, +64 −0

docs/superpowers/plans/CODEX-FINDINGS-ROOTFS-PLANS-R2.md +64 −0

CI passed — run details

CI log

=== gate ===
.amadan/test-gate.sh
=== launchctx (0 s)
ok  	amadan.net/carlos/platform.git/launchctx	0.016s
?   	amadan.net/carlos/platform.git/launchctx/controlname	[no test files]
?   	amadan.net/carlos/platform.git/launchctx/wireid	[no test files]
=== vet (1 s)
=== gofmt (1 s)
gofmt -l .: clean
=== rest (148 s)
?   	github.com/carlosframework/platform/cmd/changelog	[no test files]
ok  	github.com/carlosframework/platform/cmd/console	3.761s
ok  	github.com/carlosframework/platform/cmd/moveprobe	11.959s
ok  	github.com/carlosframework/platform/cmd/zddprobe	0.804s
ok  	github.com/carlosframework/platform/internal/activator	59.316s
ok  	github.com/carlosframework/platform/internal/agentsock	0.019s
ok  	github.com/carlosframework/platform/internal/alerting	0.003s
ok  	github.com/carlosframework/platform/internal/analytics	0.021s
ok  	github.com/carlosframework/platform/internal/appconfig	3.018s
ok  	github.com/carlosframework/platform/internal/apperr	0.137s
ok  	github.com/carlosframework/platform/internal/applog	0.213s
ok  	github.com/carlosframework/platform/internal/awsinv	0.004s
ok  	github.com/carlosframework/platform/internal/boxchoice	0.004s
ok  	github.com/carlosframework/platform/internal/boxid	1.307s
?   	github.com/carlosframework/platform/internal/boxid/boxidtest	[no test files]
?   	github.com/carlosframework/platform/internal/boxid/internal/signtest	[no test files]
ok  	github.com/carlosframework/platform/internal/boxvolumes	0.009s
ok  	github.com/carlosframework/platform/internal/caps	0.021s
ok  	github.com/carlosframework/platform/internal/certwarm	0.002s
ok  	github.com/carlosframework/platform/internal/cgroup	0.825s
ok  	github.com/carlosframework/platform/internal/changelog	0.727s
ok  	github.com/carlosframework/platform/internal/claimactivation	1.346s
ok  	github.com/carlosframework/platform/internal/clamd	0.064s
?   	github.com/carlosframework/platform/internal/cliflag	[no test files]
?   	github.com/carlosframework/platform/internal/controlname	[no test files]
?   	github.com/carlosframework/platform/internal/controlsock	[no test files]
ok  	github.com/carlosframework/platform/internal/dbdoor	8.023s
ok  	github.com/carlosframework/platform/internal/dbdoor/dbdoortest	0.012s
ok  	github.com/carlosframework/platform/internal/dbquery	0.012s
ok  	github.com/carlosframework/platform/internal/dbreads	2.199s
?   	github.com/carlosframework/platform/internal/dbreads/dbreadstest	[no test files]
ok  	github.com/carlosframework/platform/internal/dbverify	0.010s
ok  	github.com/carlosframework/platform/internal/dnsrec	0.006s
ok  	github.com/carlosframework/platform/internal/docsite	0.008s
ok  	github.com/carlosframework/platform/internal/domains	3.048s
ok  	github.com/carlosframework/platform/internal/doorkey	0.012s
ok  	github.com/carlosframework/platform/internal/economics	0.004s
ok  	github.com/carlosframework/platform/internal/edge	45.673s
?   	github.com/carlosframework/platform/internal/edgeproof	[no test files]
ok  	github.com/carlosframework/platform/internal/edgesfile	0.017s
ok  	github.com/carlosframework/platform/internal/fleetapi	0.165s
ok  	github.com/carlosframework/platform/internal/gate	1.888s
ok  	github.com/carlosframework/platform/internal/genselect	0.030s
ok  	github.com/carlosframework/platform/internal/geo	0.015s
ok  	github.com/carlosframework/platform/internal/geoip	0.038s
ok  	github.com/carlosframework/platform/internal/historyreadback	0.285s
ok  	github.com/carlosframework/platform/internal/host	144.505s
ok  	github.com/carlosframework/platform/internal/hostactors	6.707s
ok  	github.com/carlosframework/platform/internal/hostactors/awsmembership	0.006s
ok  	github.com/carlosframework/platform/internal/hostbox	3.269s
ok  	github.com/carlosframework/platform/internal/hostclaim	0.791s
ok  	github.com/carlosframework/platform/internal/hostenv	0.006s
ok  	github.com/carlosframework/platform/internal/hostevidence	0.005s
ok  	github.com/carlosframework/platform/internal/hostexec	5.575s
ok  	github.com/carlosframework/platform/internal/hostfence	0.041s
ok  	github.com/carlosframework/platform/internal/hostfiles	10.309s
ok  	github.com/carlosframework/platform/internal/hostfloor	0.020s
ok  	github.com/carlosframework/platform/internal/hostguard	1.097s
ok  	github.com/carlosframework/platform/internal/hostops	2.282s
?   	github.com/carlosframework/platform/internal/hostops/fencerelease	[no test files]
ok  	github.com/carlosframework/platform/internal/hostops/internal/fencerelease	0.003s
ok  	github.com/carlosframework/platform/internal/hostquarantine	0.004s
ok  	github.com/carlosframework/platform/internal/hostrelocate	0.644s
ok  	github.com/carlosframework/platform/internal/hostresolve	0.184s
ok  	github.com/carlosframework/platform/internal/hostwrite	0.003s
ok  	github.com/carlosframework/platform/internal/infraview	0.006s
ok  	github.com/carlosframework/platform/internal/instancectl	5.230s
ok  	github.com/carlosframework/platform/internal/instanceexec	2.812s
ok  	github.com/carlosframework/platform/internal/instancefs	0.006s
ok  	github.com/carlosframework/platform/internal/instancekey	0.003s
ok  	github.com/carlosframework/platform/internal/instanceupdates	0.008s
ok  	github.com/carlosframework/platform/internal/layout	1.927s
ok  	github.com/carlosframework/platform/internal/lbhealth	0.007s
ok  	github.com/carlosframework/platform/internal/lease	10.141s
ok  	github.com/carlosframework/platform/internal/lease/leasetest	0.601s
ok  	github.com/carlosframework/platform/internal/ledger	0.016s
ok  	github.com/carlosframework/platform/internal/mail	0.205s
ok  	github.com/carlosframework/platform/internal/maintenance	0.105s
ok  	github.com/carlosframework/platform/internal/maintenanceexec	5.594s
ok  	github.com/carlosframework/platform/internal/maintenanceguard	0.073s
ok  	github.com/carlosframework/platform/internal/metrics	0.006s
ok  	github.com/carlosframework/platform/internal/moves	21.392s
ok  	github.com/carlosframework/platform/internal/moves/archive	1.058s
ok  	github.com/carlosframework/platform/internal/objstore	0.237s
ok  	github.com/carlosframework/platform/internal/ops	0.179s
ok  	github.com/carlosframework/platform/internal/park	0.260s
ok  	github.com/carlosframework/platform/internal/plans	0.009s
ok  	github.com/carlosframework/platform/internal/privatefile	0.004s
ok  	github.com/carlosframework/platform/internal/provision	14.511s
ok  	github.com/carlosframework/platform/internal/publicrelease	0.010s
?   	github.com/carlosframework/platform/internal/regionname	[no test files]
ok  	github.com/carlosframework/platform/internal/registry	5.622s
ok  	github.com/carlosframework/platform/internal/relay	7.241s
ok  	github.com/carlosframework/platform/internal/release	25.368s
ok  	github.com/carlosframework/platform/internal/rollout	3.785s
ok  	github.com/carlosframework/platform/internal/rolloutwords	0.004s
ok  	github.com/carlosframework/platform/internal/rootaws	0.007s
ok  	github.com/carlosframework/platform/internal/rootparticipation	0.058s
ok  	github.com/carlosframework/platform/internal/rootstate	0.029s
ok  	github.com/carlosframework/platform/internal/runs	0.567s
ok  	github.com/carlosframework/platform/internal/s3compat	0.005s
ok  	github.com/carlosframework/platform/internal/safefile	0.005s
ok  	github.com/carlosframework/platform/internal/schedule	2.731s
ok  	github.com/carlosframework/platform/internal/seeds	0.014s
ok  	github.com/carlosframework/platform/internal/sim/engines	2.782s
ok  	github.com/carlosframework/platform/internal/sim/hostlife	11.102s
ok  	github.com/carlosframework/platform/internal/sim/litestreamfacts	3.846s
ok  	github.com/carlosframework/platform/internal/status	0.079s
ok  	github.com/carlosframework/platform/internal/steering	0.012s
ok  	github.com/carlosframework/platform/internal/stopevidence	0.182s
ok  	github.com/carlosframework/platform/internal/svcrole	0.003s
ok  	github.com/carlosframework/platform/internal/telemetry	0.005s
ok  	github.com/carlosframework/platform/internal/termfence	0.008s
ok  	github.com/carlosframework/platform/internal/tunnelclient	0.010s
ok  	github.com/carlosframework/platform/internal/unixdial	0.003s
ok  	github.com/carlosframework/platform/internal/updatewords	0.007s
ok  	github.com/carlosframework/platform/internal/usage	0.009s
ok  	github.com/carlosframework/platform/internal/version	0.002s
ok  	github.com/carlosframework/platform/internal/vet	1.801s
=== internal_console@0 (85 s)
ok  	github.com/carlosframework/platform/internal/console	83.225s
=== internal_console@1 (44 s)
ok  	github.com/carlosframework/platform/internal/console	42.020s
=== internal_console@2 (41 s)
ok  	github.com/carlosframework/platform/internal/console	39.205s
=== internal_console@3 (41 s)
ok  	github.com/carlosframework/platform/internal/console	38.528s
=== internal_console@4 (44 s)
ok  	github.com/carlosframework/platform/internal/console	41.212s
=== internal_console@5 (41 s)
ok  	github.com/carlosframework/platform/internal/console	39.141s
=== internal_console@6 (37 s)
ok  	github.com/carlosframework/platform/internal/console	35.162s
=== internal_console@7 (47 s)
ok  	github.com/carlosframework/platform/internal/console	44.675s
=== root@0 (110 s)
ok  	github.com/carlosframework/platform	107.716s
=== root@1 (84 s)
ok  	github.com/carlosframework/platform	82.049s
=== root@2 (92 s)
ok  	github.com/carlosframework/platform	89.548s
=== cross ===
--- shard 0 of 5 ---
cross-compiling darwin/arm64
--- shard 1 of 5 ---
cross-compiling darwin/amd64
--- shard 2 of 5 ---
cross-compiling linux/arm64
linux/arm64 carlos binary: 50528418 bytes (ceiling 52000000)
--- shard 3 of 5 ---
cross-compiling windows/amd64
--- shard 4 of 5 ---
cross-compiling windows/arm64
=== minio-contract ===
minio contract: arm64, minio RELEASE.2025-09-07T16-13-09Z, mc RELEASE.2025-08-13T08-35-41Z
  minio: cached, digest verified
  mc: cached, digest verified
  minio healthy on 127.0.0.1:20999
Added `local` successfully.
Bucket created successfully `local/contract-bucket`.
Bucket created successfully `local/denied-bucket`.
Created policy `contract-only` successfully.
Added user `scopeduser` successfully.
Attached Policies: [contract-only]
To User: scopeduser
  buckets and scoped user ready
=== RUN   TestDeliveredContractMinio
=== RUN   TestDeliveredContractMinio/put
=== RUN   TestDeliveredContractMinio/get_round-trips_the_body
=== RUN   TestDeliveredContractMinio/list_shows_the_key
=== RUN   TestDeliveredContractMinio/head_and_list_agree_on_the_version
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_its_own_object
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/not_by_PutObjectTagging
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/and_not_by_x-amz-tagging_on_upload
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CreateMultipartUpload
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CopyObject_with_a_REPLACE_tagging_directive
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/but_multipart_itself_is_allowed
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_copy_itself_is_allowed
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/a_POST-policy_forged_tag_with_a_matching_version_is_still_not_a_verdict
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_an_ordinary_tagged-with-something-else_upload_is_allowed
=== RUN   TestDeliveredContractMinio/delete_removes_it
=== RUN   TestDeliveredContractMinio/cross-bucket_denial
--- PASS: TestDeliveredContractMinio (0.02s)
    --- PASS: TestDeliveredContractMinio/put (0.00s)
    --- PASS: TestDeliveredContractMinio/get_round-trips_the_body (0.00s)
    --- PASS: TestDeliveredContractMinio/list_shows_the_key (0.00s)
    --- PASS: TestDeliveredContractMinio/head_and_list_agree_on_the_version (0.00s)
    --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/not_by_PutObjectTagging (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/and_not_by_x-amz-tagging_on_upload (0.00s)
    --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route (0.01s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CreateMultipartUpload (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CopyObject_with_a_REPLACE_tagging_directive (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/but_multipart_itself_is_allowed (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_copy_itself_is_allowed (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/a_POST-policy_forged_tag_with_a_matching_version_is_still_not_a_verdict (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_an_ordinary_tagged-with-something-else_upload_is_allowed (0.00s)
    --- PASS: TestDeliveredContractMinio/delete_removes_it (0.00s)
    --- PASS: TestDeliveredContractMinio/cross-bucket_denial (0.00s)
PASS
ok  	github.com/carlosframework/platform/internal/objstore	0.025s
=== RUN   TestT4StorageProbeMinio
2026/10/24 18:29:37 moves: T4: STORE: list: operation error S3: ListObjectsV2, https response error StatusCode: 403, RequestID: 18E18AA754F76416, HostID: 7c420053e0fbcd7f41653fdd92ffa2802c903d05303b1aa15adc2e8bb65d183f, api error SignatureDoesNotMatch: The request signature we calculated does not match the signature you provided. Check your key and signing method.
--- PASS: TestT4StorageProbeMinio (0.01s)
PASS
ok  	github.com/carlosframework/platform/internal/host	0.022s
=== RUN   TestS3StoreMinioContract
=== RUN   TestS3StoreMinioContract/conditional_get_and_etag_listing
=== RUN   TestS3StoreMinioContract/bump_through_every_mutation_path
--- PASS: TestS3StoreMinioContract (0.03s)
    --- PASS: TestS3StoreMinioContract/conditional_get_and_etag_listing (0.01s)
    --- PASS: TestS3StoreMinioContract/bump_through_every_mutation_path (0.02s)
PASS
ok  	github.com/carlosframework/platform/internal/release	0.032s
Bucket created successfully `local/dbf-deploy`.
Bucket created successfully `local/dbf-data-ie`.
Bucket created successfully `local/dbf-data-uk`.
local/dbf-deploy versioning is enabled
Created policy `dbf-console` successfully.
Created policy `dbf-ukbox` successfully.
Added user `dbfconsole` successfully.
Added user `dbfukbox` successfully.
Attached Policies: [dbf-console]
To User: dbfconsole
Attached Policies: [dbf-ukbox]
To User: dbfukbox
=== RUN   TestDBForwardMinio
2026/10/24 18:29:40 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000000 txid.db=0000000000000001
2026/10/24 18:29:40 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000001 maxTXID=0000000000000001 size=720
2026/10/24 18:29:40 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000001
2026/10/24 18:29:40 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000002
2026/10/24 18:29:40 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000002 maxTXID=0000000000000002 size=370
2026/10/24 18:29:40 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000002 txid.db=0000000000000002
2026/10/24 18:29:40 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000002 txid.db=0000000000000003
2026/10/24 18:29:40 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000003 maxTXID=0000000000000003 size=454
2026/10/24 18:29:40 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000003 txid.db=0000000000000003
2026/10/24 18:29:40 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000000 txid.db=0000000000000001
2026/10/24 18:29:40 INFO ltx file uploaded system=store db=source.db replica=file level=0 minTXID=0000000000000001 maxTXID=0000000000000001 size=720
2026/10/24 18:29:40 INFO replica sync system=store db=source.db replica=file txid.replica=0000000000000001 txid.db=0000000000000001
2026/10/24 18:29:40 console: CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically
2026/10/24 18:29:40 console: could not notify member@example.com of a CLI token issue: keymail: lookup member@example.com: keymail: GET /api/federation/lookup?addr=member%40example.com&from=console%40127.0.0.1%3A35099: could not determine target mailbox
    agent.go:135: dbreads: dbr_6ufgqgr7l7qyjyixoqxacqeujq: planned 1 files (720 bytes) and restored to 1 in 9ms
    agent.go:135: dbreads: dbr_6ufgqgr7l7qyjyixoqxacqeujq: output 5 bytes in 1 confirmed chunks in 1ms
2026/10/24 18:29:41 console: db read dbr_6ufgqgr7l7qyjyixoqxacqeujq: relayed 1 chunks (102 bytes) in 1.004s, ended done
    agent.go:135: dbreads: dbr_u5vokf43xoclcdujnr5lkxejfa: planned 3 files (1544 bytes) and restored to 3 in 9ms
    agent.go:135: dbreads: dbr_u5vokf43xoclcdujnr5lkxejfa: output 5 bytes in 1 confirmed chunks in 1ms
2026/10/24 18:29:42 console: db read dbr_u5vokf43xoclcdujnr5lkxejfa: relayed 1 chunks (102 bytes) in 1.004s, ended done
    agent.go:135: dbreads: dbr_etaf7sx5rd3taw2uknbc37yhua: planned 3 files (1544 bytes) and held through 3 in 9ms
    agent.go:135: dbreads: dbr_etaf7sx5rd3taw2uknbc37yhua: output 1544 bytes in 1 confirmed chunks in 1ms
2026/10/24 18:29:43 console: db read dbr_etaf7sx5rd3taw2uknbc37yhua: relayed 1 chunks (1641 bytes) in 1.003s, ended done
=== RUN   TestDBForwardMinio/by_disconnect
=== NAME  TestDBForwardMinio
    agent.go:135: dbreads: dbr_6fqa6nsrwohffl67nykqmenfa4: planned 3 files (1544 bytes) and restored to 3 in 10ms
2026/10/24 18:29:43 console: db read dbr_6fqa6nsrwohffl67nykqmenfa4: relayed 0 chunks (0 bytes) in 12ms, ended client gone
    agent.go:135: dbreads: dbr_6fqa6nsrwohffl67nykqmenfa4: output 5 bytes in 1 confirmed chunks in 47ms
=== RUN   TestDBForwardMinio/by_timeout
=== NAME  TestDBForwardMinio
    agent.go:135: dbreads: dbr_6jsmtm2v73rjvjwmduxbtf2s3i: planned 3 files (1544 bytes) and restored to 3 in 10ms
2026/10/24 18:30:03 console: db read dbr_6jsmtm2v73rjvjwmduxbtf2s3i: relayed 0 chunks (0 bytes) in 19.346s, ended no-result
    agent.go:135: dbreads: dbr_6jsmtm2v73rjvjwmduxbtf2s3i: output 5 bytes in 1 confirmed chunks in 19.33s
--- PASS: TestDBForwardMinio (22.72s)
    --- PASS: TestDBForwardMinio/by_disconnect (0.17s)
    --- PASS: TestDBForwardMinio/by_timeout (19.46s)
PASS
ok  	github.com/carlosframework/platform/internal/console	22.737s
minio contract: PASS

diff --git a/docs/superpowers/plans/CODEX-FINDINGS-ROOTFS-PLANS-R2.md b/docs/superpowers/plans/CODEX-FINDINGS-ROOTFS-PLANS-R2.md

new file mode 100644

index 000000000..2f3e8d07d

--- /dev/null

+++ b/docs/superpowers/plans/CODEX-FINDINGS-ROOTFS-PLANS-R2.md

@@ -0,0 +1,64 @@

+Reviewed `948b9df6766736d97ec0f4f2ac1c284cc9553dea`. These are plan-level findings; no files were changed or implementation tests run. The later copy-deck commit is excluded.

+| R1 finding | Disposition | Evidence |

+|---|---|---|

+| 1. Binary polling/stopping of rootfs commands | Fixed | Runtime-aware polling, stopping and cgroup proof are assigned together. [Plan 2:2851](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-rootfs-apps/docs/superpowers/plans/2026-10-24-rootfs-apps-2-box-isolation.md:2851) |

+| 2. Cold release outlives its lease | Fixed | Ownership gates, deadline supervision and stop/proof retries cover cold wakes and swaps. [Plan 3:726](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-rootfs-apps/docs/superpowers/plans/2026-10-24-rootfs-apps-3-lifecycle.md:726) |

+| 3. Box public/global addresses reachable | Fixed | Local-address denies precede readiness, refresh periodically and have behavioural probes. [Plan 2:2120](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-rootfs-apps/docs/superpowers/plans/2026-10-24-rootfs-apps-2-box-isolation.md:2120) |

+| 4. Failed revocation leaves access open | Fixed | Root persists pending changes; the agent retries unsettled requests, including empty ones. [Plan 5:613](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-rootfs-apps/docs/superpowers/plans/2026-10-24-rootfs-apps-5-egress-allow.md:613), [Plan 5:831](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-rootfs-apps/docs/superpowers/plans/2026-10-24-rootfs-apps-5-egress-allow.md:831) |

+| 5. Successor lowers overlap memory limit | Fixed | Generation, worker and command starts preserve populated parent limits. [Plan 2:1036](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-rootfs-apps/docs/superpowers/plans/2026-10-24-rootfs-apps-2-box-isolation.md:1036) |

+| 6. Parser rejects stop/reset | Fixed | Launch and termination shapes are distinct. [Plan 2:1586](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-rootfs-apps/docs/superpowers/plans/2026-10-24-rootfs-apps-2-box-isolation.md:1586) |

+| 7. Explicit argv loses working directory/PATH | Fixed | Explicit commands inherit the selected image’s web environment and working directory. [Plan 2:1044](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-rootfs-apps/docs/superpowers/plans/2026-10-24-rootfs-apps-2-box-isolation.md:1044) |

+| 8. Unused SQLite database prevents restart | Fixed | First wake creates the placeholder under its lease and subsequently replicates it. [Plan 3:452](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-rootfs-apps/docs/superpowers/plans/2026-10-24-rootfs-apps-3-lifecycle.md:452) |

+| 9. Concurrent first ships establish different kinds | Fixed | Create-only kind establishment precedes artifact publication on both ship paths. The ship/create race below is separate. [Plan 1:599](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-rootfs-apps/docs/superpowers/plans/2026-10-24-rootfs-apps-1-ship.md:599) |

+| 10. Concurrent interactive admissions succeed | Fixed | Hub reservation precedes admission; reserved IDs count as live. [Plan 6:793](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-rootfs-apps/docs/superpowers/plans/2026-10-24-rootfs-apps-6-interactive.md:793) |

+| 11. Run chunks exceed frame limit | Fixed | Run-specific framing accommodates a full chunk and header at both ends. [Plan 6:163](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-rootfs-apps/docs/superpowers/plans/2026-10-24-rootfs-apps-6-interactive.md:163), [Plan 6:1229](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-rootfs-apps/docs/superpowers/plans/2026-10-24-rootfs-apps-6-interactive.md:1229) |

+| 12. Fleet pickup lacks boot identity | Fixed | Defined hello, pickup acknowledgement and record readback distinguish boot identity from incarnation. [Plan 6:1271](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-rootfs-apps/docs/superpowers/plans/2026-10-24-rootfs-apps-6-interactive.md:1271) |

+| 13. Fleet-owner publication cannot be retried | Fixed | Same-owner creation retries repair publication before responding. [Plan 4:592](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-rootfs-apps/docs/superpowers/plans/2026-10-24-rootfs-apps-4-console-and-docs.md:592) |

+| 14. Slice assertion contradicts composite templates | Fixed | Ordinary templates, composite drop-ins and effective slice checks are tested separately. [Plan 5:573](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-rootfs-apps/docs/superpowers/plans/2026-10-24-rootfs-apps-5-egress-allow.md:573) |

+New findings:

+1. **P2 — JIT cleanup can leave the next command using cached JIT settings. Plan 2 Task 5; consumed by Plan 6.**

+ Cleanup deletes the JIT drop-in without assigning a daemon reload. The next non-JIT command finds no file to remove, so `writeJITDropIn` reports no change and startup skips reload. If systemd retains that unit in memory—for example, through an IPC reference—it still has `MemoryDenyWriteExecute=no`. The command starts with that setting, then the post-start check kills it. Loaded unit configuration requires an explicit reload: [https://www.freedesktop.org/software/systemd/man/257/systemd.unit.html](https://www.freedesktop.org/software/systemd/man/257/systemd.unit.html).

+ Evidence: the reload condition at [Plan 2:1013](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-rootfs-apps/docs/superpowers/plans/2026-10-24-rootfs-apps-2-box-isolation.md:1013), cleanup at [Plan 2:1040](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-rootfs-apps/docs/superpowers/plans/2026-10-24-rootfs-apps-2-box-isolation.md:1040). The test plants an existing file, which misses this already-deleted-file case.

+ **Smallest fix:** require a successful reload after removal or before reuse. Test JIT start → cleanup → non-JIT start while retaining the loaded unit.

+2. **P2 — Instance creation can race first-kind establishment. Plan 1 Task 3; Plan 4 Tasks 2/3/5.**

+ Even after correcting finding 3 below, pause the first rootfs ship after its zero-instance check and kind-marker publication, before its manifest publication. Instance creation reads no release, classifies the app as binary and writes an immutable binary record. The rootfs ship then finishes successfully, leaving an instance that cannot serve the app. The new marker protects competing ships but is invisible to `AppKind` and instance minting.

+ Evidence: manifest-only `AppKind` and marker publication at [Plan 1:597](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-rootfs-apps/docs/superpowers/plans/2026-10-24-rootfs-apps-1-ship.md:597); no-release classification at [Plan 4:216](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-rootfs-apps/docs/superpowers/plans/2026-10-24-rootfs-apps-4-console-and-docs.md:216); record stamping at [Plan 4:376](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-rootfs-apps/docs/superpowers/plans/2026-10-24-rootfs-apps-4-console-and-docs.md:376).

+ **Smallest fix:** coordinate first-kind establishment and instance creation through a common mutation boundary, rechecking under that coordination. Creation must honour the marker while publication is incomplete. Test both interleavings.

+3. **P2 — The first-rootfs-ship refusal is wired into an unreachable path. Plan 4 Task 5.**

+ Task 5 places its check beside `CheckShipProgram`, before the existing `release.Ship` call. Plan 1’s rootfs branch calls `shipRootfsParts` and returns before reaching that code. Consequently, shipping rootfs over existing binary instances bypasses the new refusal.

+ Evidence: placement at [Plan 4:515](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-rootfs-apps/docs/superpowers/plans/2026-10-24-rootfs-apps-4-console-and-docs.md:515), early return at [Plan 1:1021](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-rootfs-apps/docs/superpowers/plans/2026-10-24-rootfs-apps-1-ship.md:1021).

+ **Smallest fix:** put the refusal in `shipRootfsParts`, after its identical-reship short circuit and before `ShipSpooled`. Retain the specified real-door test.

+4. **P2 — Rootfs startup bypasses the egress readiness hook. Plan 5 Task 7; Plan 3 Tasks 10/11.**

+ The hook is assigned only to binary `spawnUnitFrom` and seed execution. Rootfs web startup uses a separate function, and release commands execute before web startup. A deployment introducing a granted private database can therefore run its migration before the next egress pass opens access. A fast connection failure is recorded as a failed release build despite valid configuration.

+ Evidence: hook sites at [Plan 5:747](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-rootfs-apps/docs/superpowers/plans/2026-10-24-rootfs-apps-5-egress-allow.md:747), separate rootfs launch sequence at [Plan 2:2585](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-rootfs-apps/docs/superpowers/plans/2026-10-24-rootfs-apps-2-box-isolation.md:2585), release-before-web ordering and failure treatment at [Plan 3:818](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-rootfs-apps/docs/superpowers/plans/2026-10-24-rootfs-apps-3-lifecycle.md:818).

+ **Smallest fix:** invoke the bounded readiness pass before rootfs launches, including release commands. Test ordering with the periodic pass deliberately delayed.

+5. **P2 — The first copy gate cannot parse its supplied deck. Plan 1 Task 1.**

+ The proposed regular expression accepts exactly two digits after `C`; the requested commit’s deck contains 36 three-digit IDs, `RFS-4-C100` through `C135`. It also contains `struck` rows, while the reused parser accepts only `pending` and `approved`. The required initial passing gate therefore fails before copy review.

+ Evidence: regex and parser wiring at [Plan 1:243](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-rootfs-apps/docs/superpowers/plans/2026-10-24-rootfs-apps-1-ship.md:243), three-digit inventory at [Plan 4:1263](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-rootfs-apps/docs/superpowers/plans/2026-10-24-rootfs-apps-4-console-and-docs.md:1263), parser restrictions at [approved_moves_copy_test.go:192](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-rootfs-apps/approved_moves_copy_test.go:192).

+ **Smallest fix:** accept canonical two- and three-digit IDs, and reconcile struck rows before the first parser invocation. Exercise the actual deck.

+6. **P2 — Plan 1’s compatibility test contradicts Plan 2’s staging change. Plan 1 Task 2; Plan 2 Task 3.**

+ `TestAdoptStagesNothingFromARootfsOnlyManifest` calls the current `ensureStaged` and requires no artifact to be staged. Plan 2 changes that same path to select and stage the rootfs artifact on ARM64. The helper receives no route runtime with which to distinguish the test’s alleged binary row. On other architectures, the newly required missing-artifact key also contradicts the test’s expected error string.

+ Evidence: retained test at [Plan 1:466](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-rootfs-apps/docs/superpowers/plans/2026-10-24-rootfs-apps-1-ship.md:466), staging changes at [Plan 2:671](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-rootfs-apps/docs/superpowers/plans/2026-10-24-rootfs-apps-2-box-isolation.md:671), actual helper at [adopt.go:2315](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-rootfs-apps/internal/release/adopt.go:2315).

+ **Smallest fix:** test old-adopter compatibility against frozen old behaviour. Test current binary-row rejection at the adoption layer that actually receives the row.

+**Verdict: accept with fixes.**

\ No newline at end of file