1. **F1 — NOT ADDRESSED (R12).** Clearing `workerServing` at [activator.go:1972](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/zdd-4-release-side/internal/activator/activator.go:1972) ends the retry loop but does not protect captured builds. Worker A can still lose its staged copy after promotions to B and C remove its live-link and registry pins. An absent generations file still supplies no pins at [pins.go:194](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/zdd-4-release-side/internal/release/pins.go:194). Sweep/restage can therefore destroy A’s recovery artifact. R12 does not satisfy §4.2’s requirement that referenced copies remain unchanged; it also introduces defect N1 below.
6
7
2. **F2 — ADDRESSED, with a new pacing defect (R13).** Same-build respawns preserve `staleSince` at [activator.go:1993](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/zdd-4-release-side/internal/activator/activator.go:1993), and crash/max-run recycling evaluates drift at [workerbuild.go:64](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/zdd-4-release-side/internal/activator/workerbuild.go:64). Those changes remove the reported starvation. R13’s unconditional convergence is nevertheless incompatible with §7.9’s admission requirement; see N2.
8
9
3. **F3 — ADDRESSED for the reported chained-link case (R14).** [pins.go:60](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/zdd-4-release-side/internal/release/pins.go:60) pins every returned hop, and [staged.go:101](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/zdd-4-release-side/internal/release/staged.go:101) captures the terminal path. The added restage-refusal test covers the original `live → operator-current → staged executable` case. However, R14’s exclusion of parent-directory resolution introduces N3.
10
11
4. **R11 note — ADDRESSED (R15).** [adopt.go:1739](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/zdd-4-release-side/internal/release/adopt.go:1739) no longer promises that the next full pass will restage a held version. Recovery is conditional on a pass actually restaging that version, or shipping a new name. The conservative refusal remains consistent with §4.2.
12
13
**New defects introduced by the fix diff:**
14
15
- **N1 — P1: A digest refusal becomes acceptance on the next retry.** [activator.go:1972](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/zdd-4-release-side/internal/activator/activator.go:1972). Suppose live still names A, but A’s executable has changed from its retained digest. The first recycle correctly refuses it, then discards the retained identity. The next retry passes `onto=nil`; `StartWorkerStaged` calls `ResolveLive`, hashes the damaged bytes as a fresh identity, and executes them. No promotion is required. §4.2’s refusal therefore lasts only one retry. **Smallest fix:** retain the captured identity after refusal; permit a different build only through explicit convergence/adoption admission. Address F1 through complete pins or conservative suppression of destructive staging and eviction.
16
17
- **N2 — P2: Recycles bypass convergence pacing and a negative coalescing decision.** [workerbuild.go:64](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/zdd-4-release-side/internal/activator/workerbuild.go:64). Multiple workers with overdue drift and synchronized `max_run` deadlines all execute the installed build in one sweep. None consumes `cycled`, so the existing one-per-sweep limit is ineffective for this path. Moreover, when `CoalesceRecycle` returns false because another canary is running, this branch still changes builds after the grace period—contrary to §7.9. Replacing one spawn with one spawn does not preserve rollout pacing. **Smallest fix:** share the sweep’s convergence budget with these paths; when scheduler admission is present, require it before changing builds. Otherwise recycle the captured build while preserving drift age.
18
19
- **N3 — P2: Relative chained links can resolve to the wrong executable.** [staged.go:64](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/zdd-4-release-side/internal/release/staged.go:64). Consider `live/h → /opt/carlos/alias/current`, where `alias → /opt/carlos/versions/v1/links` and `current → ../app`. Filesystem resolution reaches `/opt/carlos/versions/v1/app`. The new lexical join/clean instead produces `/opt/carlos/app`. Previously, hashing and executing the intermediate path followed the filesystem correctly; now startup fails or executes the wrong file, and the real staged copy remains unpinned. **Smallest fix:** resolve each symlink’s containing directory before interpreting relative targets, retain intermediate pins, and fail closed when resolution is uncertain.
20
21
Out of scope: unchanged deferred findings and later-plan scheduler/generation integration were not re-reviewed.
22
23
Static review only; no files modified or tests run. `git diff --check acc6de7a..HEAD` passed.
amadan