| 1 | **ACCEPT for a dormant merge. No additional code blocker to flag-on found; the outstanding real-box checks remain required.** |
| 2 | |
| 3 | | Round-1 finding / triage item | Verdict | Evidence | |
| 4 | |---|---|---| |
| 5 | | **1. Registry/kernel observation races** | **ADDRESSED** | [inflight.go:103](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/zdd-flag-readiness-3/internal/cgroup/inflight.go:103) records placements present at the start or changing during a read. Cleanup uses this for population and membership. [gen.go:217](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/zdd-flag-readiness-3/internal/cgroup/gen.go:217) captures existing placements and excludes new registrations through the cold-parent writes. | |
| 6 | | **2. Inherited ignored signals** | **ADDRESSED** | [shim_linux.go:143](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/zdd-flag-readiness-3/internal/cgroup/shim_linux.go:143) captures the agent’s ignored set; [shim_linux.go:517](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/zdd-flag-readiness-3/internal/cgroup/shim_linux.go:517) restores and verifies it before exec. | |
| 7 | | **3. Cancellation identity and member text** | **ADDRESSED** | [cgroup.go:535](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/zdd-flag-readiness-3/internal/cgroup/cgroup.go:535) returns the context sentinel directly, keeping placement detail in the operator log. | |
| 8 | | **4. Unconditional deadline claim** | **ADDRESSED** | [verify_linux.go:30](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/zdd-flag-readiness-3/internal/cgroup/verify_linux.go:30) and [shim_linux.go:298](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/zdd-flag-readiness-3/internal/cgroup/shim_linux.go:298) explicitly describe the prompt-termination assumption and unbounded synchronous reap. This is the documentation remedy permitted by round 1. | |
| 9 | | **5. Shared scratch-directory cleanup** | **ADDRESSED** | [Roll notes:738](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/zdd-flag-readiness-3/docs/superpowers/plans/2026-10-07-zero-downtime-deploys-6-roll-notes.md:738) allocates a unique directory with `mktemp -d` and removes only that allocation. | |
| 10 | | **Before merge: inherited-state coverage** | **ADDRESSED** | [shim_kernel_linux_test.go:290](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/zdd-flag-readiness-3/internal/cgroup/shim_kernel_linux_test.go:290) adds ignored SIGTERM and SIGUSR1; line 372 compares the complete observed state against a direct start. | |
| 11 | | **Before merge: cancellation classification/rendering** | **ADDRESSED** | [gen_test.go:912](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/zdd-flag-readiness-3/internal/cgroup/gen_test.go:912) requires the exact context error. [logsink_test.go:254](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/zdd-flag-readiness-3/internal/activator/logsink_test.go:254) checks classification, existing member wording, and execution attribution. | |
| 12 | | **Before merge: misleading `KillAndEmpty` guarantee** | **ADDRESSED** | [cleanup_linux.go:335](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/zdd-flag-readiness-3/internal/cgroup/cleanup_linux.go:335) now says the kill occurs once and a late placement can leave the proof unproven until its deadline. | |
| 13 | | **Before dev re-check: activator recipe and strict-subtest separation** | **ADDRESSED** | [Roll notes:688](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/zdd-flag-readiness-3/docs/superpowers/plans/2026-10-07-zero-downtime-deploys-6-roll-notes.md:688) supplies compilation and invocation commands. Lines 698–703 run shim cases with `RestrictNamespaces=yes`; line 719 runs the strict clone3 case separately without it. Execution on the dev box remains owed. | |
| 14 | |
| 15 | **New findings: none.** |
| 16 | |
| 17 | The synchronization closes both reported interleavings. A registration or completion during a cleanup read invalidates its empty result; an existing placement captured by `ensureParent` remains conservatively counted even if it finishes during the kernel read. New registrations cannot proceed until the parent writes finish. The hold ends before `startIn`, and the shim ends its registration before invoking `before` ([shim_linux.go:238](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/zdd-flag-readiness-3/internal/cgroup/shim_linux.go:238)). I found no callback/shim-wait lock cycle. Waiting registrations are not context-cancellable, so stalled cgroupfs operations can still stall them; this is not an unconditional latency guarantee. |
| 18 | |
| 19 | For the agent’s stable signal dispositions, the restored set matches direct execution. In the installed Go runtime, [`clearSignalHandlers`](/home/paulca/.local/go-dist/src/runtime/signal_unix.go:268) resets signals marked runtime-handled; [`sigignore`](/home/paulca/.local/go-dist/src/runtime/signal_unix.go:244) clears that mark when installing an ignore. The shim restores ignores lost during its runtime startup. The new field comes from the agent’s `/proc/self/status`, not tenant arguments or environment. Capture and fork are not atomic against concurrent signal-disposition changes, so this is not a guarantee for arbitrary concurrent handler mutation. |
| 20 | |
| 21 | The cancellation probe does not spawn under the inspected Go implementation: [`Cmd.Start`](/home/paulca/.local/go-dist/src/os/exec/exec.go:702) checks the ended context before allocating child descriptors or starting a process. Its deferred cleanup can close pipe objects retained by the shallow copy, but this path follows a proven pre-exec failure and shim reaping. I found no descriptor leak or tenant execution from it. Successful or uncertain execution returns through the earlier success branch, before cancellation relabeling ([cgroup.go:526](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/zdd-flag-readiness-3/internal/cgroup/cgroup.go:526)). No new member-facing wording was introduced by this fix. |
| 22 | |
| 23 | **Containment and inherited authority:** I found no path through the shim that executes tenant code before verified cgroup placement. Placement and identity verification precede acknowledgment; tenant exec additionally requires release and a successful `R` write ([shim_linux.go:437](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/zdd-flag-readiness-3/internal/cgroup/shim_linux.go:437)). Internal descriptors are marked close-on-exec, and the cgroup directory descriptor is explicitly closed. I found no new descriptor or privilege leak. The authorized flat PID-move fallback still permits tenant execution before placement; required generation starts cannot reach it. Arming still declines when the real placement check fails. |
| 24 | |
| 25 | Reviewed `02472fe5..bf3a0deb` against the round-1 findings and surrounding code. No files changed or tests run; `git diff --check` passed. The implementer’s runtime-test receipts were not independently reproduced. |
amadan