| Round-3 finding | Disposition | Why |
|---|---|---|
| R3-1: stale instance catch-all ownership | Fixed | §4.2 requires complete domain reconciliation, including label-count reads and registry writes; §12 tests exact-claim replacement during failures. |
| R3-2: primary hostname’s path-routing exclusion | Fixed | Primary hostnames now share the domain-confirmation bound; §12 tests a gated path target added during failed domain reads. |
| R3-3: unbounded waiters and fill duration | Fixed | Fills abandon caching after 60 seconds and release reservations; waiters have a 32-request cap and 10-second deadline. |
| R3-4: cacheable HTML fallbacks | Fixed | Admission explicitly excludes HTML, including sniffed HTML without a content type; tests include a year-long cacheable fallback. |
| R3-5: rollout test before home arming | Fixed | §10 now arms the test app’s home before the far edge and runs the acceptance gate before expansion. |

No new findings at commit `287a59c4`.

accept