1. **P2 — Minting can permanently override a key whose configuration has not arrived yet.** [instancekey.go:299](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/instance-key-provision/internal/activator/instancekey.go:299)  
   A missing local `<host>.config.env` is treated as no configured key. However, reconciliation publishes a ready route before the later `SyncExec` pass; the admission guard checks whether configuration can render, without delivering it. A first wake in that interval mints B even when the bucket already specifies A. Once configuration arrives, B continues winning from `<host>.env`. Require configuration delivery before deciding to mint, and test first launch with configuration delivery delayed.

2. **P2 — A flat env FIFO can block the entire startup backfill.** [ownenv_unix.go:18](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/instance-key-provision/internal/activator/ownenv_unix.go:18)  
   `O_NOFOLLOW` rejects symlinks but still opens FIFOs in blocking mode. A ready flat row whose `<host>.env` is a FIFO without a writer hangs here while holding `adminTokenMu`. Because the new backfill runs synchronously before `svc.Start`, one malformed file prevents startup from completing. The flat configuration-file read has the same problem. Use nonblocking opens followed by regular-file checks; extend the existing nested FIFO test to flat backfill.

3. **P3 — The adoption endpoint accepts malformed trailing JSON.** [keyadoption.go:96](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/instance-key-provision/internal/activator/keyadoption.go:96)  
   `Decoder.More()` does not establish EOF: it returns false for a trailing `}` or `]`, and suppresses reader errors. A valid adoption body followed by either delimiter therefore writes and publishes a record instead of returning 400. Require a second decode to return `io.EOF`, with tests asserting no write or publication on malformed input.

**Verdict: not ready to merge.**

Reviewed `0901e835..3e32533e`. Go formatting and Go-file whitespace checks passed. Focused tests could not start because the read-only sandbox prevented Go from creating its work directory. No files changed.

---

**FIRST PROMPT:**
“Follow the review brief docs/superpowers/plans/CODEX-REVIEW-INSTANCE-KEY-BUILD-BRIEF.md. Review the code diff 0901e835..HEAD on branch instance-key-build.”

**WHAT:**
Review the instance-key build against the brief and binding rulings.

**STATUS:**
Review complete: two P2 findings and one P3.

**NEEDED:**
Nothing.

**RECOMMENDED:**
Fix the findings, add regression coverage, and rerun the gate before merge.

**SESSION:**
Safe to close. Working tree unchanged; no background processes started. Handoff file could not be saved in the read-only sandbox.