| 1 | | Prior finding | Disposition at `58276fc3` | |
| 2 | |---|---| |
| 3 | | R5-1 | **Resolved.** Custom socket paths remain supported; the reserved-endpoint and peer-address checks remain. Retain the authenticated control service (§5.4). | |
| 4 | | R5-2 | **Partially resolved.** The [downgrade guards](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/docs/superpowers/specs/2026-09-11-isolated-exec-design.md:1478) check `layout_mode` and journals. But `layout_mode` records requested intent, not completed reversal. A revert refused at quiescence or the [destination collision check](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/docs/superpowers/specs/2026-09-11-isolated-exec-design.md:1403), before journal creation, leaves a nested row with flat intent and no journal. Both guards permit downgrade, and [unit removal still unmounts its database](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/internal/host/systemapply.go:522). Require verified completion of reversal, including absence of nested rows, before removing the mounts. | |
| 5 | | R5-3 | **Partially resolved.** Socket paths are bounded, but [§5.3 explicitly constructs unit and slice names using `escape(host)`](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/docs/superpowers/specs/2026-09-11-isolated-exec-design.md:854), whereas §4 requires `escape(InstanceID(host))`. For hosts longer than 40 bytes, the requested unit’s bind sources differ from the directories preparation created. Use `InstanceID(host)` consistently in both constructions. | |
| 6 | | R2-4 | **Resolved.** Blocking seed execution and `RemainAfterExit=yes` retain the invocation and result until capture (§§4.2, 5.3, 6.5). [systemd service semantics](https://raw.githubusercontent.com/systemd/systemd/v257/man/systemd.service.xml). | |
| 7 | | R2-5 | **Resolved.** Terminal state and cgroup emptiness are required; foreign invocations are stopped; uncertain stops retain replication and the lease. | |
| 8 | | R2-7 | **Resolved.** Both endpoints and artifact sources follow the journal’s own direction. Recovery completes that transaction before converging to current intent (§§3.3, 8.2). | |
| 9 | | R2-9 | **Resolved for the previously reported defects.** Flat minting and explicit reversal remain specified. The remaining mount-removal defect is under R5-2. | |
| 10 | | R2-14 | **Resolved at spec level.** The IPv6 exception remains explicit, bounded, rechecked and reported. | |
| 11 | | R1-4 | **Resolved.** Completion is independent of log EOF, and blocking observations remain outside the activator mutex. | |
| 12 | | R1-5 | **Resolved.** Preparation, execution budget, cancellation, result retention and termination-before-cleanup are specified. | |
| 13 | | R1-8 | **Resolved under the recorded decision.** Shared tier limits remain; per-service OOM families are an explicit difference. | |
| 14 | | R1-12 | **Resolved.** Named consumer fences and bidirectional journal recovery cover the reported partial-migration failure. | |
| 15 | | R1-13 | **Partially resolved overall.** Reverse-journal validation is fixed; safe downgrade still depends on the incomplete prerequisite under R5-2. | |
| 16 | | R1-15 | **Resolved at spec level.** No unsafe PID-namespace fallback; the behavioural gate and bounded IPv6 exception remain. | |
| 17 | | R1-18 | **Resolved under the recorded ruling.** Remote operations and reporting are specified; the `foreign` repair residual remains explicitly accepted. | |
| 18 | |
| 19 | **R6-1 — P1 — §§3.1, 8.1: An identifier collision switches an already-isolated instance to unisolated execution.** |
| 20 | |
| 21 | The new [collision rule](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/docs/superpowers/specs/2026-09-11-isolated-exec-design.md:303) classifies both colliding hosts as `foreign`. The [spawn table](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/docs/superpowers/specs/2026-09-11-isolated-exec-design.md:1336) runs `foreign` hosts through the existing unisolated `childProc` path. |
| 22 | |
| 23 | Consequently, adding a colliding row after the first host has migrated causes that existing host’s next wake to run without its isolation namespace. |
| 24 | |
| 25 | This requires no hash search. The short-name and hashed-name branches overlap. Applying the specified function gives: |
| 26 | |
| 27 | ```text |
| 28 | H = aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.example.com |
| 29 | S = aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-aeab2db4 |
| 30 | |
| 31 | InstanceID(H) = S |
| 32 | InstanceID(S) = S |
| 33 | ``` |
| 34 | |
| 35 | Both names pass the repository’s [hostname-shape validator](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/internal/controlname/names.go:18). I verified the hash and collision against the specified algorithm. |
| 36 | |
| 37 | **Correction:** an identity conflict must refuse execution, particularly for an already-nested row; it must never select the unisolated fallback. Separate the short and hashed identifier domains if retaining the claim that collisions require an unlikely hash collision. Verify adding the second row after the first has migrated. |
| 38 | |
| 39 | **Verdict: request changes.** |
amadan