| 1 | | Prior finding | Disposition at `81f25b6c` | |
| 2 | |---|---| |
| 3 | | R7-1 | **Resolved.** `/sweep` enumerates and stops the three templates by unit name, including orphaned hashed identifiers and pending jobs (§§5.3, 6.7). Retain §5.4’s process authentication. | |
| 4 | | R6-1 | **Resolved.** Identifier domains remain separate; collisions refuse execution as `conflict`. §10 now agrees. | |
| 5 | | R5-2 | **Resolved at spec level.** The downgrade guard checks every row’s paths regardless of flags, and unflagging nested rows is refused (§8.2). | |
| 6 | | R5-3 | **Resolved.** Directory, socket, unit and slice names consistently use `InstanceID(host)`. | |
| 7 | | R2-4 | **Resolved.** Blocking seed execution and `RemainAfterExit=yes` retain identity and results through capture (§§4.2, 5.3, 6.5). [systemd service semantics](https://raw.githubusercontent.com/systemd/systemd/v257/man/systemd.service.xml). | |
| 8 | | R2-5 | **Resolved.** Completion requires terminal state and cgroup emptiness; uncertain stops retain replication and the lease. | |
| 9 | | R2-7 | **Resolved.** Recovery derives both endpoints from the journal’s direction, completes that transaction, then converges to current intent. | |
| 10 | | R2-9 | **Resolved for the reported downgrade defects.** Flat minting, explicit reversal and the expanded downgrade guard cover them. | |
| 11 | | R2-14 | **Resolved at spec level.** The IPv6 exception is explicit, bounded, rechecked and reported. | |
| 12 | | R1-4 | **Resolved.** Completion is independent of log EOF; blocking observations remain outside the activator mutex. | |
| 13 | | R1-5 | **Resolved.** Preparation, execution budget, cancellation, result retention and termination-before-cleanup are specified. | |
| 14 | | R1-8 | **Resolved under the recorded decision.** Shared tier limits remain; per-service OOM families are an explicit difference. | |
| 15 | | R1-12 | **Resolved for the reported partial-migration failure.** Consumer fences and bidirectional recovery cover interrupted transactions. R8-1 concerns admission after completion. | |
| 16 | | R1-13 | **Resolved for the reported rollback defects.** Reverse recovery and the expanded downgrade guard address them. | |
| 17 | | R1-15 | **Resolved at spec level.** No unsafe PID-namespace fallback; the behavioural gate and bounded IPv6 exception remain. | |
| 18 | | R1-18 | **Resolved under the recorded ruling.** Remote reporting and layout operations are specified; the `foreign` repair residual remains explicitly accepted. | |
| 19 | |
| 20 | **R8-1 — P1 — §§6, 8.1–8.2: A completed migration can admit a stale flat-layout wake.** |
| 21 | |
| 22 | [Step 9 releases the migration fence before the edge’s next registry poll](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/docs/superpowers/specs/2026-09-11-isolated-exec-design.md:1449). During that interval, the edge still supplies the old route. The activator [copies that route into its new entry](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/internal/activator/activator.go:481); the unchanged `doWake` then [restores using that copy](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/internal/activator/activator.go:806) and [replicates its `DBPath`](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/internal/activator/activator.go:870). The existing admission check [tests only whether the host is fenced](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/internal/activator/maintenance.go:148). |
| 23 | |
| 24 | Consequently, immediately after flat→nested migration, a request can restore a second database at the vacated flat path and select §8.1’s unisolated `childProc` path. The registry already reports `nested`. Reloading subsequently does not retire this process: [`RetireExcept` retains entries by hostname](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/internal/activator/activator.go:1260), which did not change. Writes can advance the flat copy while the next correctly routed wake trusts the older nested copy. |
| 25 | |
| 26 | **Correction:** assign a route-freshness check to wake admission, coordinated with the layout fence. Before restore, seed, spawn or replication, reject or refresh a supplied route whose paths differ from the committed row; use one consistent route throughout the wake. Refresh routing before releasing the fence, while also rejecting requests that retained an older route before that refresh. Pin the case by delivering a saved flat route after migration completes and asserting that it neither recreates flat artifacts nor starts `childProc`. |
| 27 | |
| 28 | **Verdict: request changes.** |
amadan