| 1 | | Previous finding | Round 10 assessment | |
| 2 | |---|---| |
| 3 | | R1-1: flat tenant borrows a nested socket | Fixed by peer-cgroup authentication (§5.4). | |
| 4 | | R1-2: aliases and path routes remain public | Fixed by checking the final upstream (§5.1). | |
| 5 | | R1-3: new box starts public | Reported case fixed by classification before serving (§5.1). | |
| 6 | | R1-4: revoked grants return after restart | Fixed with retained state; fresh-box replay is an explicit residual (§5.3). | |
| 7 | | R1-5: door exceptions fail across routing | Resolved by removing the owner exception and defining the identity transition (§5.4). | |
| 8 | | R1-6: socket lifecycle conflicts | Fixed by instance-level ownership (§5.4). | |
| 9 | | R1-7: transport and body limits | Resolved at spec level (§5.5). | |
| 10 | | R2-1: stamp follows serving | Reported ordering fixed by the admission barrier (§5.1). | |
| 11 | | R2-2: upgrade serves unclassified engines | Reported case fixed by startup classification and refusal of `NULL` (§5.1). | |
| 12 | | R2-3: flat callers borrow door credentials | Fixed by the door’s UID restriction (§§5.4, 6.2). | |
| 13 | | R2-4: deployment verification fails | Fixed by watch tickets (§5.8). | |
| 14 | | R2-5: port-80 refusal cannot work remotely | Resolved by the narrowed contract (§5.1). | |
| 15 | | R3-1: previously admitted requests cross the mark | Fixed when the barrier completes: acknowledgement waits for cancellation and completion (§5.1). | |
| 16 | | R3-2: flat tenant injects into a nested caller | Fixed by excluding unisolated execution while armed; historical compromise is explicitly excluded (§6.2). | |
| 17 | | R3-3: grant-only routes lack watch tickets | Fixed: every deploy target receives a ticket (§5.8). | |
| 18 | | R4-1: foreign instances and workers remain unisolated | Fixed by arming prerequisites and launch refusals (§6.2). | |
| 19 | | R4-2: path routing widens an engine grant | Fixed by exact-host engine dispatch (§5.4). | |
| 20 | | R4-3: watch tickets expire mid-watch | Fixed by renewal (§5.8). | |
| 21 | | R5-1: platform-minted hostnames cannot classify | Fixed by execution-owner inheritance (§5.1). | |
| 22 | | R5-2: arming rejects isolated unit-backed routes | Fixed by distinguishing backing from layout (§6.2). | |
| 23 | | R5-3: home edge lacks the probe path | Fixed by signing the probe path (§5.8). | |
| 24 | | R6-1: minted row’s own grant is ignored | Fixed by aggregating group grants (§5.1). | |
| 25 | | R6-2: static platform domains are refused | Fixed by restricting inheritance to minted instance rows (§5.1). | |
| 26 | | R7-1: clearing exposes a still-serving generation | Fixed by stopping the group and proving its cgroups empty (§5.1). | |
| 27 | | R7-2: TCP-backed minted rows have no owner | Fixed by explicit ownership and unique non-empty backend matching (§5.1). | |
| 28 | | R8-1: upgrade classifies a running declaring build public | Reported case fixed by scanning staged manifests; missing-manifest exposure remains an explicit residual (§5.1). | |
| 29 | | R8-2: sleeping unit-backed route cannot clear | Resolved by operator-controlled stop-and-clear (§5.1). | |
| 30 | | R9-1: recovery launches a declaring `GoodVersion` after clearing | First launch under `0` fixed by the launch gate (§5.1). An already-`1`, unfenced state remains uncovered below. | |
| 31 | |
| 32 | Reviewed `267c0ee6` against locally available amadan `origin/main` at `f550afa2`. The implementation files cited below match that revision. No files changed. |
| 33 | |
| 34 | **1. P1 — A pending internal mark lets a later recovery launch skip the fence while I1 holds (§§5.1, 6.3).** |
| 35 | |
| 36 | The [launch rule](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-fleet-internal-engines/docs/superpowers/specs/2026-10-21-fleet-internal-engines-design.md:263) requires writing `1` and waiting for the fence **when the group’s mark is `0`**. But `1` does not establish that the fence completed: the [timeout rule](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-fleet-internal-engines/docs/superpowers/specs/2026-10-21-fleet-internal-engines-design.md:298) deliberately leaves it set after an unsuccessful wait. |
| 37 | |
| 38 | A concrete sequence: |
| 39 | |
| 40 | 1. A sleeping nested instance has declaring build A as `GoodVersion`, non-declaring B installed, and an overlap-mode failure record that selects A for recovery. With no grant remaining, `--public` stops the group and clears its mark. |
| 41 | 2. Adoption attempts declaring build C. It writes `1`, but the edge’s reload fails. After 30 seconds adoption returns without repointing. The registry says `1`; the serving map still says `0`; B remains installed. |
| 42 | 3. While reload remains unsuccessful, a public request passes the old map’s admission check and wakes the instance. Recovery selects A. |
| 43 | 4. A’s launch reads its declaring manifest and the already-set mark `1`. The specified conditional does not require this launch to finish the outstanding fence. A starts, and the admitted public request reaches it. |
| 44 | |
| 45 | These are existing execution paths. A failed alias read aborts reload before replacing the serving map ([edge.go:925](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-fleet-internal-engines/internal/edge/edge.go:925), [edge.go:993](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-fleet-internal-engines/internal/edge/edge.go:993)). A blocked installed build selects `GoodVersion` directly ([rollout/wakeplan.go:97](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-fleet-internal-engines/internal/rollout/wakeplan.go:97)), and the activator launches that selected build ([activator/wakeplan.go:388](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-fleet-internal-engines/internal/activator/wakeplan.go:388)). Once wake succeeds, the waiting request invokes its proxy ([activator.go:5404](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-fleet-internal-engines/internal/activator/activator.go:5404)), which selects the actual serving generation ([genproxy.go:255](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-fleet-internal-engines/internal/edge/genproxy.go:255)). |
| 46 | |
| 47 | **I1 holds throughout:** A runs only while the registry mark is `1`. Public access nevertheless remains possible because the edge has not fenced that mark. |
| 48 | |
| 49 | **Suggested fix:** Every declaring launch must require acknowledgement of the group’s current internal admission epoch, including when it finds `1` already set. A pending or timed-out transition must remain a launch refusal until its fence completes. Add a test that holds reload unsuccessful, times out adoption, and then requests a recovery wake; no declaring process may start. |
| 50 | |
| 51 | **Overall verdict: reject.** I1 alone permits a declaring process behind an internal registry mark that the serving edge has not yet enforced. |
amadan