carlos / platform Public

| Prior finding | Disposition at c2d52695 | |---|---| | R6-1 | Resolved at spec level. Identifier domains are separate; collisions refuse execution as conflict. Align §10’s stale foreign expectation with that rule. | | R5-2 | Partially resolved. Completed reversal replaces intent checking, but the guard excludes rows that cease to be activator-managed. SetHibernate(false) preserves nested paths, including when provisioning invokes it. §8.2 then classifies the row as external and skips reversal, while the downgrade guard checks only activator-managed rows. Mount removal can therefore invalidate a still-used nested path. Check mount dependence across all rows, regardless of current hibernation eligibility; retain a reversal or refusal requirement for formerly migrated rows. | | R5-3 | Resolved. The control service constructs both unit and slice names from InstanceID(host) (§5.3). | | R2-4 | Resolved. Blocking seed execution and RemainAfterExit=yes retain identity and results through capture (§§4.2, 5.3, 6.5). systemd service semantics. | | R2-5 | Resolved. Completion requires terminal state and cgroup emptiness; uncertain stops retain replication and the lease. | | R2-7 | Resolved. Recovery derives both endpoints from the journal’s direction, completes that transaction, then converges to current intent. | | R2-9 | Resolved for the previously reported defects. Flat minting and explicit reversal remain specified. The remaining downgrade defect is under R5-2. | | R2-14 | Resolved at spec level. The IPv6 exception is explicit, bounded, rechecked and reported. | | R1-4 | Resolved. Completion is independent of log EOF; blocking observations remain outside the activator mutex. | | R1-5 | Resolved. Preparation, execution budget, cancellation, result retention and termination-before-cleanup are specified. | | R1-8 | Resolved under the recorded decision. Shared tier limits remain; per-service OOM families are an explicit difference. | | R1-12 | Resolved. Named consumer fences and bidirectional recovery cover the reported partial-migration failure. | | R1-13 | Partially resolved overall. Reverse recovery is specified; safe downgrade still depends on the incomplete guard under R5-2. | | R1-15 | Resolved at spec level. No unsafe PID-namespace fallback; the behavioural gate and bounded IPv6 exception remain. | | R1-18 | Resolved under the recorded ruling. Remote reporting and layout operations are specified; the foreign repair residual remains explicitly accepted. |

R7-1 — P2 — §§3.1, 5.3–5.4, 6.7: Retain the authenticated control service, but make orphan-unit cleanup expressible.

The startup sweep enumerates systemd units and jobs, then requires /stop for every remaining invocation before activation begins. However, the control protocol accepts only a valid full hostname and reconstructs its unit through InstanceID(host).

For a long hostname, the enumerated unit contains a truncated, hashed identifier. The new _ prefix deliberately makes that identifier invalid as a hostname. For example, applying the specified algorithm produces:

host: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.example.com
iid:  _aaaaaaaaaaaaaaaaaaaaaa-aeab2db4d462892c

Passing that iid as host fails validation. A registry lookup can recover the hostname while its row exists, but cannot cover an orphaned unit whose row has disappeared. The hash cannot reconstruct the missing hostname. Thus the required sweep cannot stop every discovered unit through its only authorized channel; it must stall startup or abandon its stated completion condition.

Correction: retain §5.4’s process authentication and assign enumeration-and-stop cleanup to the control service, restricted to the three exact templates. Alternatively, provide a stop-only operation accepting a validated instance identifier. Either mechanism must cover units and pending jobs without registry rows and require terminal state plus empty cgroups before completing.

Verdict: request changes.