**ACCEPT**

Reviewed `37ffe34b..4a134a2b` against spec rev 17, the round-2 findings, ledger, and fix-wave-2 report. Read-only: no builds, tests, or mutants rerun. The worktree is clean; `git diff --check` passes.

- **R2-1 — ADDRESSED.** Before calling the refused child’s Stop, cleanup transfers its process and build identity to `e.shed` under `a.mu` ([activator.go:2571](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/zdd-3-swap/internal/activator/activator.go:2571)). The generations snapshot includes that identity ([generations_file.go:114](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/zdd-3-swap/internal/activator/generations_file.go:114)). Both the terminal-stop path and pending-stop sweep refuse completion while the respawn remains in flight or its shed child remains retained ([activator.go:2957](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/zdd-3-swap/internal/activator/activator.go:2957), [activator.go:3032](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/zdd-3-swap/internal/activator/activator.go:3032)). Neither original sequence—failed shed Stop or Stop blocked beyond the respawn wait—can now close replication, delete the entry, or drop the replacement’s pin prematurely.

- **R2-2 — ADDRESSED.** Retry registration and the transition to stopping share `a.mu`; retries require the entry still to be current and awake ([opset.go:379](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/zdd-3-swap/internal/activator/opset.go:379)). The barrier joins `restoreDone`, and pending cleanup independently refuses release while `restoring` remains true ([opset.go:125](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/zdd-3-swap/internal/activator/opset.go:125), [opset.go:473](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/zdd-3-swap/internal/activator/opset.go:473)). Thus a paused old retry prevents entry replacement until its backend write finishes; it cannot resume inside a later entry’s overlap.

**New breakage:** none found in the fix diff.

The indefinitely blocked shed Stop is **acceptable fail-closed behaviour** within this scope. Its cleanup operation has not finished, so releasing the entry on a timer would recreate the ownership escape. The reaper deliberately waits for that operation before taking over ([activator.go:3104](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/zdd-3-swap/internal/activator/activator.go:3104)). A Stop that returns without proving exit remains retryable; a Stop that never returns leaves the host unavailable. This change provides safety, not recovery from an indefinitely wedged backend.

Lock discipline is sound: Stop calls, parent writes, channel waits, and generations-file persistence run outside `a.mu`; ownership transfers and retry registration run under it. Clearing `restoring` before closing its completion channel is safe because the backend write has already returned.

The R2-1 flag-off changes are necessary corrections to worker cleanup. R2-2 adds no flag-off parent-write path. The supplied regression tests cover both original sequences; the report records passing focused race checks, the 3,000-seed sweep, and nine caught mutants.

**Out-of-scope observations:** the previously deferred F6 descendant-proof limitation remains unchanged. No additional observations to park.