carlos / platform Public

| Prior finding | Disposition at 81f25b6c | |---|---| | R7-1 | Resolved. /sweep enumerates and stops the three templates by unit name, including orphaned hashed identifiers and pending jobs (§§5.3, 6.7). Retain §5.4’s process authentication. | | R6-1 | Resolved. Identifier domains remain separate; collisions refuse execution as conflict. §10 now agrees. | | R5-2 | Resolved at spec level. The downgrade guard checks every row’s paths regardless of flags, and unflagging nested rows is refused (§8.2). | | R5-3 | Resolved. Directory, socket, unit and slice names consistently use InstanceID(host). | | R2-4 | Resolved. Blocking seed execution and RemainAfterExit=yes retain identity and results through capture (§§4.2, 5.3, 6.5). systemd service semantics. | | R2-5 | Resolved. Completion requires terminal state and cgroup emptiness; uncertain stops retain replication and the lease. | | R2-7 | Resolved. Recovery derives both endpoints from the journal’s direction, completes that transaction, then converges to current intent. | | R2-9 | Resolved for the reported downgrade defects. Flat minting, explicit reversal and the expanded downgrade guard cover them. | | R2-14 | Resolved at spec level. The IPv6 exception is explicit, bounded, rechecked and reported. | | R1-4 | Resolved. Completion is independent of log EOF; blocking observations remain outside the activator mutex. | | R1-5 | Resolved. Preparation, execution budget, cancellation, result retention and termination-before-cleanup are specified. | | R1-8 | Resolved under the recorded decision. Shared tier limits remain; per-service OOM families are an explicit difference. | | R1-12 | Resolved for the reported partial-migration failure. Consumer fences and bidirectional recovery cover interrupted transactions. R8-1 concerns admission after completion. | | R1-13 | Resolved for the reported rollback defects. Reverse recovery and the expanded downgrade guard address them. | | R1-15 | Resolved at spec level. No unsafe PID-namespace fallback; the behavioural gate and bounded IPv6 exception remain. | | R1-18 | Resolved under the recorded ruling. Remote reporting and layout operations are specified; the foreign repair residual remains explicitly accepted. |

R8-1 — P1 — §§6, 8.1–8.2: A completed migration can admit a stale flat-layout wake.

Step 9 releases the migration fence before the edge’s next registry poll. During that interval, the edge still supplies the old route. The activator copies that route into its new entry; the unchanged doWake then restores using that copy and replicates its DBPath. The existing admission check tests only whether the host is fenced.

Consequently, immediately after flat→nested migration, a request can restore a second database at the vacated flat path and select §8.1’s unisolated childProc path. The registry already reports nested. Reloading subsequently does not retire this process: RetireExcept retains entries by hostname, which did not change. Writes can advance the flat copy while the next correctly routed wake trusts the older nested copy.

Correction: assign a route-freshness check to wake admission, coordinated with the layout fence. Before restore, seed, spawn or replication, reject or refresh a supplied route whose paths differ from the committed row; use one consistent route throughout the wake. Refresh routing before releasing the fence, while also rejecting requests that retained an older route before that refresh. Pin the case by delivering a saved flat route after migration completes and asserting that it neither recreates flat artifacts nor starts childProc.

Verdict: request changes.