| Round-1 finding | Disposition | Evidence and remaining work |
|---|---|---|
| **1. Incarnation check** | **FIXED; DECLINED-AGREE** on version pinning | [§8.2:538](/home/paulca/amadan.net/carlos/platform-db-region-forward/docs/superpowers/specs/2026-10-22-db-region-forward-design.md:538) now brackets downloads and retries, withholding query execution until check B. This addresses the reported recreation race against the identity checked by [provision.go:2777](/home/paulca/amadan.net/carlos/platform-db-region-forward/internal/provision/provision.go:2777) and [claim.go:192](/home/paulca/amadan.net/carlos/platform-db-region-forward/internal/hostclaim/claim.go:192). Deferring version pinning is acceptable for this fix. |
| **2. Socket on stdin** | **FIXED** | [§8.3:580](/home/paulca/amadan.net/carlos/platform-db-region-forward/docs/superpowers/specs/2026-10-22-db-region-forward-design.md:580) explicitly sets socket stdin/stdout and journal stderr, replacing the incompatible output configuration in [claimunit_template.go:19](/home/paulca/amadan.net/carlos/platform-db-region-forward/internal/host/claimunit_template.go:19). |
| **3. Progress versus completion ack** | **FIXED** | [§5.4:250](/home/paulca/amadan.net/carlos/platform-db-region-forward/docs/superpowers/specs/2026-10-22-db-region-forward-design.md:250) separates `ack` from digest-bound `done`. It no longer relies on the terminal-only acknowledgement semantics in [apirunsfollow.go:287](/home/paulca/amadan.net/carlos/platform-db-region-forward/internal/console/apirunsfollow.go:287). |
| **4. Late writes after `lost`** | **PARTLY — P2** | [§5.8:365](/home/paulca/amadan.net/carlos/platform-db-region-forward/docs/superpowers/specs/2026-10-22-db-region-forward-design.md:365) bounds client activity, but does not establish a storage fence. [S3Store.Put:787](/home/paulca/amadan.net/carlos/platform-db-region-forward/internal/release/store.go:787) conditions the target object only; it sends no enforceable ownership deadline. SDK retries honour cancellation, but an already-sent request can have an uncertain outcome—the existing code explicitly recognises this in [apirunsfollow.go:94](/home/paulca/amadan.net/carlos/platform-db-region-forward/internal/console/apirunsfollow.go:94). Neither sixty seconds nor the additional skew allowance proves that storage cannot commit later. **Fix:** use storage-enforced fencing, or define `lost` as logical closure, reject subsequent output, and retain durable cleanup state for late objects. Test a server-side commit after client timeout, not merely a delayed client return. |
| **5. Cleanup reopens election** | **FIXED**, subject to finding 4 | [§5.8:390](/home/paulca/amadan.net/carlos/platform-db-region-forward/docs/superpowers/specs/2026-10-22-db-region-forward-design.md:390) retains `picked` until both completion and the acceptance-window margin. A twenty-minute read therefore retains it beyond five minutes. Create-only election uses the existing conditional-write mechanism in [store.go:794](/home/paulca/amadan.net/carlos/platform-db-region-forward/internal/release/store.go:794). The separate metadata-lifetime defects are new findings below. |
| **6. “Showed none” after rejection** | **FIXED** | [§5.4:250](/home/paulca/amadan.net/carlos/platform-db-region-forward/docs/superpowers/specs/2026-10-22-db-region-forward-design.md:250) buffers and verifies before stdout. That avoids exposing the immediate writes made by today’s runner at [db.go:427](/home/paulca/amadan.net/carlos/platform-db-region-forward/db.go:427) and [db.go:447](/home/paulca/amadan.net/carlos/platform-db-region-forward/db.go:447). |
| **7. Stored-ciphertext bound** | **PARTLY — P2** | [§5.7:356](/home/paulca/amadan.net/carlos/platform-db-region-forward/docs/superpowers/specs/2026-10-22-db-region-forward-design.md:356) deletes acknowledged keys, but the deployment bucket has versioning enabled at [deployment-buckets/main.tf:23](/home/paulca/amadan.net/carlos/platform-db-region-forward/infra/modules/deployment-buckets/main.tf:23). [S3Store.Delete:970](/home/paulca/amadan.net/carlos/platform-db-region-forward/internal/release/store.go:970) supplies no version ID, so ciphertext remains as noncurrent versions. The configured noncurrent-expiration rule covers only GeoIP, at [main.tf:35](/home/paulca/amadan.net/carlos/platform-db-region-forward/infra/modules/deployment-buckets/main.tf:35). Thus neither the physical storage bound nor the one-hour retention promise holds. **Fix:** design version-aware permanent reclamation, including scoped permissions and failure ordering, and test with bucket versioning enabled. S3’s deletion semantics are explicit: [https://docs.aws.amazon.com/AmazonS3/latest/userguide/DeletingObjectVersions.html](https://docs.aws.amazon.com/AmazonS3/latest/userguide/DeletingObjectVersions.html). |
| **8. Disk reservations** | **PARTLY — P2** | The mutex fixes concurrent admission, but [§5.7:351](/home/paulca/amadan.net/carlos/platform-db-region-forward/docs/superpowers/specs/2026-10-22-db-region-forward-design.md:351) permits admission after two minutes even if old workers remain active. Their stated runtime limit is twenty minutes. Existing computation stops through its context—[db.go:418](/home/paulca/amadan.net/carlos/platform-db-region-forward/db.go:418), [check.go:57](/home/paulca/amadan.net/carlos/platform-db-region-forward/internal/lease/check.go:57)—rather than automatically when an unrelated socket closes. **Fix:** remove the two-minute escape; keep reservations/admission blocked until worker termination and scratch cleanup are confirmed. Specify disconnect monitoring that cancels restore/query work, and release reservations only after that cleanup. |
| **9. Worker readiness** | **PARTLY — P2** | The real-unit probe improves on inode existence, consistent with the armed-worker precedent at [movesoffline.go:254](/home/paulca/amadan.net/carlos/platform-db-region-forward/internal/host/movesoffline.go:254). But [§7.1:451](/home/paulca/amadan.net/carlos/platform-db-region-forward/docs/superpowers/specs/2026-10-22-db-region-forward-design.md:451) sends probes through the same socket whose [§8.3:574](/home/paulca/amadan.net/carlos/platform-db-region-forward/docs/superpowers/specs/2026-10-22-db-region-forward-design.md:574) limit is two connections. Two legitimate reads cause the probe to be refused, withdrawing capability until a subsequent successful probe. **Fix:** coordinate probes with worker slots; treat occupied slots as busy, and probe promptly when one becomes available. Add a saturated-box test. `MaxConnections` explicitly refuses excess connections: [https://www.freedesktop.org/software/systemd/man/257/systemd.socket.html](https://www.freedesktop.org/software/systemd/man/257/systemd.socket.html). |
| **10. Incomplete snapshot evidence** | **PARTLY — P2** | [§7.1:466](/home/paulca/amadan.net/carlos/platform-db-region-forward/docs/superpowers/specs/2026-10-22-db-region-forward-design.md:466) still returns DBF-1 using `Complete` alone. A fresh status snapshot without an edges file sets only `BoxesComplete=false`, at [snapshot.go:182](/home/paulca/amadan.net/carlos/platform-db-region-forward/internal/edgesfile/snapshot.go:182). With no other capable file, rule 1 wins before rule 3 can admit the request. **Fix:** give incomplete evidence precedence over both negative conclusions; require `Complete && BoxesComplete` before DBF-1 as well as DBF-2. Test an empty edges listing with a fresh status snapshot. |
| **11. Separate store endpoints** | **DECLINED-AGREE** | [§12:808](/home/paulca/amadan.net/carlos/platform-db-region-forward/docs/superpowers/specs/2026-10-22-db-region-forward-design.md:808) withdraws the unsupported deployment shape. The shared endpoint is confirmed by [store.go:712](/home/paulca/amadan.net/carlos/platform-db-region-forward/internal/release/store.go:712), [endpoint.go:146](/home/paulca/amadan.net/carlos/platform-db-region-forward/internal/lease/endpoint.go:146), and [s3compat.go:40](/home/paulca/amadan.net/carlos/platform-db-region-forward/internal/s3compat/s3compat.go:40). A platform-wide endpoint change can remain separate. |
| **12. Census classifications** | **FIXED** | [§13:833](/home/paulca/amadan.net/carlos/platform-db-region-forward/docs/superpowers/specs/2026-10-22-db-region-forward-design.md:833) now names supported classes, both runner callers, removal rows and required rulings. These match [plan14_root_reads_test.go:465](/home/paulca/amadan.net/carlos/platform-db-region-forward/internal/provision/plan14_root_reads_test.go:465), [line 480](/home/paulca/amadan.net/carlos/platform-db-region-forward/internal/provision/plan14_root_reads_test.go:480), and the existing runner disposition at [plan14-root-reads.tsv:202](/home/paulca/amadan.net/carlos/platform-db-region-forward/internal/provision/testdata/plan14-root-reads.tsv:202). |

13. **P2 — Completion deletes the only durable evidence that the read ended.**

    **Spec:** [§5.8:372](/home/paulca/amadan.net/carlos/platform-db-region-forward/docs/superpowers/specs/2026-10-22-db-region-forward-design.md:372), together with its lost and tombstone rules.

    A query finishes after one minute; `done` deletes `result.json` but retains `picked` and the request. After a console restart, that object set is indistinguishable from an unfinished picked read. The tombstone’s “a result exists” condition is false, and the lost rule eventually manufactures a `lost` result for a successfully acknowledged query.

    The copied run implementation avoids this ambiguity by clearing persistent execution state **before** deleting objects: [apirunsfollow.go:335](/home/paulca/amadan.net/carlos/platform-db-region-forward/internal/console/apirunsfollow.go:335). Its sweep also reads persistent run state when deciding whether a run is lost: [runsweep.go:98](/home/paulca/amadan.net/carlos/platform-db-region-forward/internal/console/runsweep.go:98). This design removes that record state without replacing it.

    **Fix:** persist completion before deleting the result—for example, a separate create-only completion marker containing the verified result digest. Have expiry, concurrency accounting and cleanup recognise it across console restarts. Test `done` followed immediately by restart and a sweep past the fence.

14. **P2 — Tombstone cleanup removes the identity needed to fetch retained results.**

    **Spec:** [§5.8:390](/home/paulca/amadan.net/carlos/platform-db-region-forward/docs/superpowers/specs/2026-10-22-db-region-forward-design.md:390) and [§9.1:660](/home/paulca/amadan.net/carlos/platform-db-region-forward/docs/superpowers/specs/2026-10-22-db-region-forward-design.md:660).

    Once a read older than five minutes produces a result, the sweep may delete its request immediately, even though the CLI has not fetched or acknowledged the result. The request is the only specified retained object that binds the read ID to its host. Neither the stated `picked` fields nor the result schema carries that binding. Consequently, the follow routes cannot enforce their mandatory host check while serving the remaining result and chunks.

    The existing transport checks this binding through `requestOnHost`, which reads the retained request: [apirunsfollow.go:80](/home/paulca/amadan.net/carlos/platform-db-region-forward/internal/console/apirunsfollow.go:80). Its deletion ordering deliberately retains the request until after the result: [runs/store.go:128](/home/paulca/amadan.net/carlos/platform-db-region-forward/internal/runs/store.go:128).

    **Fix:** retain immutable account/app/host identity until completion acknowledgement or retention cleanup has removed all deliverable objects. Either keep the request that long or introduce separate metadata, allowing SQL to be deleted earlier. Test a result produced after five minutes with a sweep before the next CLI poll.

15. **P2 — Applying the full db gate to follow routes hides the promised record-change result.**

    **Spec:** [§9.1:660](/home/paulca/amadan.net/carlos/platform-db-region-forward/docs/superpowers/specs/2026-10-22-db-region-forward-design.md:660), against [§8.2:525](/home/paulca/amadan.net/carlos/platform-db-region-forward/docs/superpowers/specs/2026-10-22-db-region-forward-design.md:525).

    The spec places all five routes behind the db door’s gate order. That gate resolves the **current** instance and returns 404 if it was deleted, or 409 if its class changed: [apidb.go:132](/home/paulca/amadan.net/carlos/platform-db-region-forward/internal/console/apidb.go:132). Therefore, after admission followed by deletion or a class change, the box can correctly publish `record-changed`, yet the CLI cannot fetch that result—or send cancellation/completion—through the specified gate.

    Existing run-follow routes separate membership and request identity from current instance eligibility: [apirunsfollow.go:35](/home/paulca/amadan.net/carlos/platform-db-region-forward/internal/console/apirunsfollow.go:35), with fallback to retained request identity when the record is gone at [line 126](/home/paulca/amadan.net/carlos/platform-db-region-forward/internal/console/apirunsfollow.go:126).

    **Fix:** restrict current-record eligibility checks to admission and box execution. Follow, ack, done and cancel should check current membership, budget and immutable job identity without requiring the original instance to remain eligible or exist.

Reviewed at `8c118ae7`; static review, no runtime acceptance tests. Current flagship module references and deployment-state assertions remain unverified: GitHub retrieval failed, and the available infrastructure checkout predates this design. Referenced platform module code was inspected at both release tags.

REVISE