| R5-1 — Creation does not guarantee an empty private store | **Fixed at spec level.** §4 applies the derived-environment rule to both doors, refuses existing stores, and permits reuse only when the grant names the same seed ID. |
4
5
1. **P2 — Seeded §§4, 5.6: abort leaves a private store that blocks re-import.**
6
7
Begin import A for an app with private storage, then abort—even before uploading. Section 5.6 deletes the snapshot and instance record but leaves A’s store. Import B at the same hostname derives the same environment, receives a new seed ID, and is therefore refused by §4. The same problem follows a failed `--from` creation after store provisioning.
8
9
Storage provisioning is a separate operation ([instanceprivatestore.go:250](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/run-and-seeded/internal/console/instanceprivatestore.go:250)). Deleting the instance record removes only that object ([provision.go:1844](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/run-and-seeded/internal/provision/provision.go:1844)); removing an environment’s store requires the separate teardown operation ([walk.go:559](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/run-and-seeded/internal/objstore/walk.go:559)). Thus successful rollback does not restore the ability to retry the conversion.
10
11
**Fix:** assign durable cleanup of seed-created stores to the console’s abort recovery, including failures before swap. Guard cleanup by seed ID and binding ownership, preserve pre-existing stores and bindings, and retain the reservation until cleanup finishes. Test abort followed by re-import with private storage enabled.
12
13
Seeded instances: **revise**.
14
15
`carlos run`: **accept**, carried forward from round 4; not re-reviewed.
amadan