1. **ADDRESSED** — [internal/release/materializeheld.go:126](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/settings-2-promotion-records/internal/release/materializeheld.go:126) skips digestless entries on channels carrying digests and continues looking for evidence. The regression at `internal/release/heldauth_test.go:381` checks refusal and no downloads with the flag both off and on.
6
2. **ADDRESSED** — [internal/release/materializeheld.go:107](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/settings-2-promotion-records/internal/release/materializeheld.go:107) calls `Admit` before checking whether the pointer names the requested version, following R15. Naming-pointer retry behavior remains intact; `ratchet.go:168` remembers observations before persistence. The two-pass replay regression is at `internal/release/heldauth_test.go:418`.
7
3. **ADDRESSED** — [internal/edge/storedoor.go:451](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/settings-2-promotion-records/internal/edge/storedoor.go:451) grants only the exact five-segment promotion-record shape for the owning account, validating app and version. Listing, writes, and deletes remain denied. `internal/edge/fleetapi_e2e_test.go:628` exercises record-only authorization and digest-mismatch refusal through the actual door and fleet client.
8
4. **ADDRESSED** — [internal/updatewords/words_authorize.go:43](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/settings-2-promotion-records/internal/updatewords/words_authorize.go:43) now reports an unconfirmed write and advises retrying, without claiming nothing was signed.
9
10
## New findings
11
12
None. No new Critical or Important problem found in the fix diff.
13
14
## Out of scope
15
16
None.
17
18
Read-only source review of `98e3f164..2c3f0ad8`. Reviewed the reported test and mutation evidence; did not rerun tests or modify files.
amadan