carlos / platform Public

| Round-5 finding | Disposition at 0ef3e715 | |---|---| | R5-1 — Creation does not guarantee an empty private store | Fixed at spec level. §4 applies the derived-environment rule to both doors, refuses existing stores, and permits reuse only when the grant names the same seed ID. |

1. P2 — Seeded §§4, 5.6: abort leaves a private store that blocks re-import.

Begin import A for an app with private storage, then abort—even before uploading. Section 5.6 deletes the snapshot and instance record but leaves A’s store. Import B at the same hostname derives the same environment, receives a new seed ID, and is therefore refused by §4. The same problem follows a failed --from creation after store provisioning.

Storage provisioning is a separate operation (instanceprivatestore.go:250). Deleting the instance record removes only that object (provision.go:1844); removing an environment’s store requires the separate teardown operation (walk.go:559). Thus successful rollback does not restore the ability to retry the conversion.

Fix: assign durable cleanup of seed-created stores to the console’s abort recovery, including failures before swap. Guard cleanup by seed ID and binding ownership, preserve pre-existing stores and bindings, and retain the reservation until cleanup finishes. Test abort followed by re-import with private storage enabled.

Seeded instances: revise.

carlos run: accept, carried forward from round 4; not re-reviewed.