| 1 | | Prior finding | Disposition at `0236be94` | |
| 2 | |---|---| |
| 3 | | R4-1 | **Resolved for the reported failure.** Removing the root-peer rejection preserves systemd-created application listeners. The replacement path restriction introduces R5-1 below. | |
| 4 | | R4-2 | **Resolved.** The raw directory and confined directory-fd renames provide endpoints on one mount. The changed storage location introduces the downgrade defect in R5-2. | |
| 5 | | R4-3 | **Resolved.** Custom paths are excluded from migration; the remaining forward sources follow their existing file contracts. | |
| 6 | | R4-4 | **Resolved.** The probe no longer requires a forbidden netlink route query. | |
| 7 | | R2-4 | **Partially resolved.** The seed-record outcome rule is now explicit. However, [`start --no-block` followed by `show`](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/docs/superpowers/specs/2026-09-11-isolated-exec-design.md:809) does not retain invocation identity. `--no-block` only enqueues the job: the subsequent query can precede activation or follow completion and unloading. “Immediately” supplies no synchronization. Retain the unit through completion and result capture, or provide equivalent request-to-invocation correlation. [systemctl semantics](https://raw.githubusercontent.com/systemd/systemd/v257/man/systemctl.xml), [unit garbage collection](https://raw.githubusercontent.com/systemd/systemd/v257/man/systemd.unit.xml). | |
| 8 | | R2-5 | **Resolved.** Foreign invocations are stopped, and completion still requires terminal state and an empty cgroup. Unproven stops retain replication and the lease. | |
| 9 | | R2-7 | **Partially resolved.** Forward recovery now recognizes both row endpoints and changed fleet intent. But the [new validation](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/docs/superpowers/specs/2026-09-11-isolated-exec-design.md:1405) requires `from` to be flat even for a reverse journal. A legitimate nested→flat transaction therefore fails validation. Derive **both** endpoints from the journal’s direction, including artifact sources. Also reconcile §3.3’s remaining requirement that journal direction equal current fleet intent with §8.2’s explicit opposite rule. | |
| 10 | | R2-9 | **Resolved for the original first-upgrade defect.** Flat minting preserves compatibility before migration. The newly introduced mount-removal defect is R5-2. | |
| 11 | | R2-14 | **Resolved at spec level.** IPv6 evidence remains explicitly unverified when unavailable; the exception has a five-minute bound, rechecks and status reporting. | |
| 12 | | R1-4 | **Resolved.** Completion is independent of log EOF, blocking observations stay outside the mutex, and the foreign-invocation completion exception is removed. | |
| 13 | | R1-5 | **Partially resolved.** Preparation, execution budget, cancellation and termination-before-cleanup are specified. Seed invocation correlation remains defective under R2-4. | |
| 14 | | R1-8 | **Resolved.** Shared tier limits and the deliberate per-service OOM-family difference are specified. | |
| 15 | | R1-12 | **Partially resolved.** Consumer fences are specified; reverse-journal recovery remains defective under R2-7. | |
| 16 | | R1-13 | **Partially resolved.** Explicit reversal and collision refusal replace the original history-selection defect, but reverse validation remains inconsistent under R2-7. | |
| 17 | | R1-15 | **Resolved at spec level.** There is no unsafe PID-namespace fallback; the probe and bounded IPv6 exception are specified. | |
| 18 | | R1-18 | **Resolved under the recorded ruling.** Remote reporting and layout operations are specified. The box-local `foreign` repair residual is explicitly accepted. | |
| 19 | |
| 20 | **R5-1 — P2 — §§5.4, 6.1, 8.3: Retain the authenticated control service, but preserve supported custom socket paths.** |
| 21 | |
| 22 | The new rule rejects every application dial outside `/run/carlos/`. An existing route with `Socket=/run/titogo/example.sock` therefore loses public traffic and health checks on upgrade, even though §8.3 promises that `foreign` routes keep running unchanged. |
| 23 | |
| 24 | The existing CLI accepts an explicit socket pathname, and the edge uses it without this directory restriction. The reviewed Tito precedent itself binds beneath `/run/titogo`. |
| 25 | |
| 26 | Evidence: [new dial restriction](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/docs/superpowers/specs/2026-09-11-isolated-exec-design.md:878), [compatibility promise](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/docs/superpowers/specs/2026-09-11-isolated-exec-design.md:1451), [CLI socket input](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/cli.go:76), [edge dispatch](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/internal/edge/edge.go:536). |
| 27 | |
| 28 | **Correction:** retain process authentication and the actual-peer-address check. Reserve and reject the broker endpoint explicitly while permitting existing ordinary upstream paths. Verify a legitimate custom socket outside `/run/carlos/` alongside direct and symlinked attempts to proxy to the broker. |
| 29 | |
| 30 | **R5-2 — P2 — §§3.2, 8.2, 9: Removing the new bind mounts invalidates the downgrade recovery claim.** |
| 31 | |
| 32 | This revision stores the database physically under `/data/.instances` and exposes it through `/data/instances`. An ordinary downgrade to a pre-layout release removes the new mount units: `installUnits` executes `systemctl disable --now` for every removed unit before deleting its file. |
| 33 | |
| 34 | Consequently, the old backend’s nested `DBPath` no longer reaches the database. The same change removes the nested runtime-directory view immediately, rather than only after reboot as §8.2 claims. |
| 35 | |
| 36 | There is also a second-copy path: the old backend sees the database as absent and invokes restore. Litestream creates missing parent directories, so it can restore into the uncovered `/data/instances/<host>/` while the original remains under `/data/.instances/<host>/`. Reinstalling the bind mount hides that restored copy from the specified collision check. |
| 37 | |
| 38 | Evidence: [new mount source](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/docs/superpowers/specs/2026-09-11-isolated-exec-design.md:380), [downgrade claim](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/docs/superpowers/specs/2026-09-11-isolated-exec-design.md:1438), [removed-unit handling](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/internal/host/systemapply.go:522), [missing-database handling](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/internal/activator/backend_exec.go:220), [restore directory creation](/home/paulca/go/pkg/mod/github.com/benbjohnson/litestream@v0.5.14/replica.go:654). |
| 39 | |
| 40 | **Correction:** make completed reversal a checked prerequisite for removing these mounts and starting a pre-layout binary. Define recovery for an already-unmounted layout, including checking the uncovered mountpoint before remounting. Verify through the actual updater’s unit-removal path. |
| 41 | |
| 42 | **R5-3 — P1 — §§3.1, 6.1, 8.2: The longer socket paths make previously working hosts unwakeable after migration.** |
| 43 | |
| 44 | For a valid 80-byte hostname, the current application socket is 97 bytes and its control socket is 105 bytes. The proposed paths become: |
| 45 | |
| 46 | - Application: `/run/carlos/instances/<host>/app.sock` — **111 bytes**. |
| 47 | - Control: the same path plus `.control` — **119 bytes**. |
| 48 | - Sidecar log: `/run/carlos/logs/<host>.sidecar.sock` — **110 bytes**. |
| 49 | |
| 50 | Linux’s Unix socket address has a 108-byte pathname field; Go requires room for the terminating NUL. These new addresses cannot bind. Migration nevertheless accepts the flat row and commits the nested paths, after which the application cannot wake. |
| 51 | |
| 52 | Evidence: [runtime layout](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/docs/superpowers/specs/2026-09-11-isolated-exec-design.md:279), [existing hostname validation](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/internal/controlname/names.go:18), [Go’s address-length rejection](/usr/local/go/src/syscall/syscall_linux.go:547), [Linux Unix socket limits](https://man7.org/linux/man-pages/man7/unix.7.html). |
| 53 | |
| 54 | **Correction:** specify a bounded per-host runtime identifier consistently across socket paths, unit bind paths and log endpoints. Preflight every resulting Unix socket address before moving files. Include a hostname that fits the current application and control sockets but exceeds the proposed limits. |
| 55 | |
| 56 | **Verdict: request changes.** |
amadan