| 1 | | Earlier finding | Disposition at `e053a333` | |
| 2 | |---|---| |
| 3 | | R1-1 — Run/move admission race | **Fixed.** Run §5.1 puts both admissions on the instance record’s ETag and requires guards to be reapplied after a conflict. | |
| 4 | | R1-3 — Missing incarnation | **Fixed.** Run §§5.1–5.2 bind the request to the record incarnation and check it before launch. | |
| 5 | | R1-10 — Protected route columns | **Fixed.** Seeded §5.4 explicitly refuses `Backing`, `Tunnel`, `Caps`, `Platform` and `Canary`. | |
| 6 | | R1-15 — Abort safety outside HTTP | **Fixed.** The import gate, commit boundary and run refusal together cover the previously identified paths. | |
| 7 | | R1-18 — Historical timestamps | **Declined with an acceptable reason.** Seeded §4 limits this version to TXIDs; timestamp support is explicitly excluded. | |
| 8 | | R1-19 — Scratch bounds | **Fixed at spec level.** Seeded §4 names decoded-size admission, a shared reservation pool, shared concurrency limits and cancellation on overgrowth. | |
| 9 | | R2-1 — Local database survives abort/re-import | **Fixed for the reported local-data defect.** Seeded §§3.4 and 5.6 require matching installation identity and removal of local database artifacts. A distinct remote-cleanup defect appears below. | |
| 10 | | R2-2 — Run bypasses import gate | **Fixed.** Run §5.1 refuses uncommitted imports under the shared CAS and requires another check at launch. | |
| 11 | | R2-3 — Crash between swap and record CAS | **Fixed.** Seeded §§5.4 and 5.7 consult the identity-bound journal before applying legacy-row predicates and resume the record transition. | |
| 12 | | R2-4 — Verification wake during rollback | **Not fixed as an implementable rollback.** The durable gate closes admission, but §5.6’s retry instruction cannot work with the selected API: `FenceAndStopIfUnfenced` refuses **any** existing fence, including its own previous attempt ([maintenance.go:103](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/run-and-seeded/internal/activator/maintenance.go:103)). A never-woken import also lacks stop history and returns `ErrStopUnproven` ([maintenance.go:114](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/run-and-seeded/internal/activator/maintenance.go:114)); every subsequent attempt then returns `ErrFenceHeld`. **Fix:** define resumption of the journal’s own fence and cold/restarted stop proof. The existing layout caller handles these distinctions explicitly ([pass.go:654](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/run-and-seeded/internal/layout/pass.go:654)). | |
| 13 | | R2-5 — Seven-day expiration deletes needed seeds | **Fixed for the reported expiration defect.** Seeded §3.1 removes unconditional expiration. The replacement sweep introduces a separate publication race below. | |
| 14 | | R2-6 — Reported pickup failure leaves executable work | **Fixed.** Run §5.2 requires successful terminal expiry before reporting “not picked up”; §5.7 makes queued cancellation terminal. | |
| 15 | | R2-7 — Instance deletion bypasses rollback | **Fixed.** Seeded §5.6 refuses deletion after import admission becomes actionable, and journal recovery does not depend on the record remaining present. | |
| 16 | |
| 17 | 1. **P2 — Seeded §§5.6–5.7: rollback forgets unfinished replica cleanup.** |
| 18 | |
| 19 | Step 4 restores the original route and deletes the journal; step 6 deletes the remote replica. Crash between them. On restart, the surviving `aborted` record has no journal, so §§3.2 and 5.6 direct the box to delete only the seed snapshot and record. Nothing resumes deletion of the replica. |
| 20 | |
| 21 | Record deletion deliberately preserves replica data ([provision.go:1840](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/run-and-seeded/internal/provision/provision.go:1840)). The ordinary creation gate then refuses reuse of that hostname because replica data remains ([apiinstances.go:1146](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/run-and-seeded/internal/console/apiinstances.go:1146)). Thus an interrupted abort leaves the conversion unable to retry through the ordinary creation checks. |
| 22 | |
| 23 | **Fix:** retain the journal in a `route-restored/cleanup-pending` phase until remote cleanup and record retirement finish. Recovery from that phase must neither repeat the swap nor stop the restored legacy process. |
| 24 | |
| 25 | 2. **P2 — Seeded §§3.1, 4 step 7: the sweep can delete a snapshot during successful creation.** |
| 26 | |
| 27 | `--from` writes the snapshot before writing its record. The new sweep deletes snapshots when “no record names it.” A sweep between those two writes therefore deletes the snapshot, after which creation can successfully publish `ready`. Its first wake has neither a replica nor the required snapshot and must fail. |
| 28 | |
| 29 | These are independent conditional object writes: `PutFrom` conditions only the snapshot key ([store.go:800](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/run-and-seeded/internal/release/store.go:800)); `CreateRecord` separately creates the record key ([provision.go:845](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/run-and-seeded/internal/provision/provision.go:845)). Neither protects the interval from deletion. |
| 30 | |
| 31 | **Fix:** reserve the seed identity durably before uploading, using a non-minting record state or publication intent that the sweep honors. Retire abandoned reservations through an explicit terminal transition before deleting their objects. |
| 32 | |
| 33 | 3. **P2 — Run §§5.2, 5.8: a disconnected caller can leave queued work open indefinitely.** |
| 34 | |
| 35 | Let the console accept a run while its box is unavailable, then disconnect the CLI before its 60-second expiry request. Only the CLI initiates `queued → expired`. The sweep handles overdue `picked`/`cancel` runs and terminal runs, but never `queued`. Consequently `ActiveRun` remains non-terminal indefinitely and blocks subsequent runs and moves. |
| 36 | |
| 37 | The selected persistence mechanism is a conditional object write, with no expiry behavior ([store.go:767](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/run-and-seeded/internal/release/store.go:767)). Existing record transitions likewise occur through explicit mutations ([provision.go:1129](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/run-and-seeded/internal/provision/provision.go:1129)); storing `Deadline` does not perform a transition. |
| 38 | |
| 39 | **Fix:** assign overdue queued-run expiry to the console sweep, independently of the CLI. It must CAS `queued → expired` against pickup, publish the terminal result and audit outcome, and release the reservation. |
| 40 | |
| 41 | `carlos run`: **revise**. |
| 42 | |
| 43 | Seeded instances: **revise**. |
amadan