carlos / platform Public

| Round-4 finding | Disposition at e47d04ee | |---|---| | R4-1 — Resumed rollback deletes a replacement seed | Fixed. §3.1 scopes snapshots to seed IDs; §5.6 retires the journal before deleting the aborted record, preserving the create-only reservation through cleanup (provision.go:845). | | R4-2 — Move strands an unplaced seed | Fixed at spec level. §5.8 assigns placement/commit checks to both move doors under the record CAS and to workers before effects. |

1. P1 — Seeded §2 ruling 4 and §4: ordinary creation does not guarantee an empty private store.

Create a canary with --from <source> --environment <source-environment>. Section 4 accepts the explicit environment and relies on ordinary creation to provide an empty private store. Existing creation preserves that environment (apiinstances.go:1096) and provisions storage by account, app and environment, without a host coordinate (instanceprivatestore.go:250). GrantIn retains an existing bucket and returns its existing provisioned store (walk.go:219, walk.go:289).

A plan following §4 therefore gives the canary access to the source’s populated store, violating the fixed empty-store ruling.

Fix: assign the seed doors a destination environment/store reservation that guarantees a fresh private store. Refuse the source’s per-host environment and existing shared-store bindings; allow reuse only for retries belonging to the same seed. Preserve existing stores and their bindings.

Seeded instances: revise.

carlos run: accept, carried forward from round 4; not re-reviewed.