| Earlier finding | Disposition | Verification against rev 5 and existing code |
|---|---|---|
| **1. Incarnation check** | **FIXED; DECLINED-AGREE** on version pinning | [§8.2:660](/home/paulca/amadan.net/carlos/platform-db-region-forward/docs/superpowers/specs/2026-10-22-db-region-forward-design.md:660) brackets every download and retry with fresh checks, withholding output until check B. Existing record reads validate account/app/host identity ([provision.go:2777](/home/paulca/amadan.net/carlos/platform-db-region-forward/internal/provision/provision.go:2777)); incarnation includes creation identity ([claim.go:192](/home/paulca/amadan.net/carlos/platform-db-region-forward/internal/hostclaim/claim.go:192)). Version pinning is unnecessary to close the reported recreation race. |
| **2. Socket on stdin** | **FIXED** | [§8.3:716](/home/paulca/amadan.net/carlos/platform-db-region-forward/docs/superpowers/specs/2026-10-22-db-region-forward-design.md:716) explicitly sets socket stdin/stdout and journal stderr, replacing the incompatible output arrangement in [claimunit_template.go:19](/home/paulca/amadan.net/carlos/platform-db-region-forward/internal/host/claimunit_template.go:19). |
| **3. Progress versus completion acknowledgement** | **FIXED** | [§9.1:812](/home/paulca/amadan.net/carlos/platform-db-region-forward/docs/superpowers/specs/2026-10-22-db-region-forward-design.md:812) removes acknowledgements entirely. The terminal-only semantics of [apirunsfollow.go:287](/home/paulca/amadan.net/carlos/platform-db-region-forward/internal/console/apirunsfollow.go:287) are no longer reused for progress. |
| **4. Late writes after `lost`** | **FIXED** | [§5.5:370](/home/paulca/amadan.net/carlos/platform-db-region-forward/docs/superpowers/specs/2026-10-22-db-region-forward-design.md:370) ends the sole response without creating another terminal result. Late output has no subsequent reader. This avoids claiming a cross-object fence from the per-object conditional writes in [store.go:787](/home/paulca/amadan.net/carlos/platform-db-region-forward/internal/release/store.go:787). |
| **5. Cleanup reopens election** | **FIXED** | [§5.9:534](/home/paulca/amadan.net/carlos/platform-db-region-forward/docs/superpowers/specs/2026-10-22-db-region-forward-design.md:534) retains `picked` beyond the acceptance window. Conditional creation is implemented by `If-None-Match: *` in [store.go:794](/home/paulca/amadan.net/carlos/platform-db-region-forward/internal/release/store.go:794). |
| **6. “Showed none” after rejection** | **FIXED** | [§5.5:377](/home/paulca/amadan.net/carlos/platform-db-region-forward/docs/superpowers/specs/2026-10-22-db-region-forward-design.md:377) requires buffering and verification before stdout. This avoids exposing the immediate writes made by the existing runner at [db.go:427](/home/paulca/amadan.net/carlos/platform-db-region-forward/db.go:427). |
| **7. Stored-ciphertext bound** | **FIXED** | [§5.7:469](/home/paulca/amadan.net/carlos/platform-db-region-forward/docs/superpowers/specs/2026-10-22-db-region-forward-design.md:469) separates plaintext limits, sealing overhead and lifecycle retention, including noncurrent versions. The envelope components match [crypto.go:215](/home/paulca/amadan.net/carlos/platform-db-region-forward/internal/appconfig/crypto.go:215); deployment-bucket versioning is confirmed at [main.tf:23](/home/paulca/amadan.net/carlos/platform-db-region-forward/infra/modules/deployment-buckets/main.tf:23). |
| **8. Disk reservations and restart recovery** | **FIXED** | [§5.7:491](/home/paulca/amadan.net/carlos/platform-db-region-forward/docs/superpowers/specs/2026-10-22-db-region-forward-design.md:491) serializes reservations and blocks admission beside orphan units. [§8.3:753](/home/paulca/amadan.net/carlos/platform-db-region-forward/docs/superpowers/specs/2026-10-22-db-region-forward-design.md:753) adds forced process exit after disconnect, covering the context-insensitive file reader ([replica_client.go:135](/home/paulca/go/pkg/mod/github.com/benbjohnson/litestream@v0.5.14/file/replica_client.go:135)) and compactor ([compactor.go:177](/home/paulca/go/pkg/mod/github.com/superfly/ltx@v0.5.1/compactor.go:177)). Reservations remain held until unit termination. |
| **9. Worker readiness** | **FIXED** | [§7.1:571](/home/paulca/amadan.net/carlos/platform-db-region-forward/docs/superpowers/specs/2026-10-22-db-region-forward-design.md:571) requires a real worker exchange and reserves a third connection for probes. Capability remains tied to the running worker loop, following [movesoffline.go:254](/home/paulca/amadan.net/carlos/platform-db-region-forward/internal/host/movesoffline.go:254). |
| **10. Incomplete snapshot evidence** | **FIXED** | [§7.1:590](/home/paulca/amadan.net/carlos/platform-db-region-forward/docs/superpowers/specs/2026-10-22-db-region-forward-design.md:590) gives incomplete evidence precedence over both refusals. This matches status-load failure returning nil error at [snapshot.go:137](/home/paulca/amadan.net/carlos/platform-db-region-forward/internal/edgesfile/snapshot.go:137), and missing counterparts clearing `BoxesComplete` at [snapshot.go:182](/home/paulca/amadan.net/carlos/platform-db-region-forward/internal/edgesfile/snapshot.go:182). |
| **11. Separate store endpoints** | **DECLINED-AGREE** | [§12:985](/home/paulca/amadan.net/carlos/platform-db-region-forward/docs/superpowers/specs/2026-10-22-db-region-forward-design.md:985) explicitly limits support to the existing shared-endpoint configuration. Both constructors use it: [store.go:712](/home/paulca/amadan.net/carlos/platform-db-region-forward/internal/release/store.go:712), [endpoint.go:146](/home/paulca/amadan.net/carlos/platform-db-region-forward/internal/lease/endpoint.go:146). Separate servers remain a separate platform change. |
| **12. Census classifications** | **FIXED** | [§13:1010](/home/paulca/amadan.net/carlos/platform-db-region-forward/docs/superpowers/specs/2026-10-22-db-region-forward-design.md:1010) names supported classifications, both query-runner callers, removal rows and required rulings. These match the scanner and overlay validation at [plan14_root_reads_test.go:33](/home/paulca/amadan.net/carlos/platform-db-region-forward/internal/provision/plan14_root_reads_test.go:33) and [line 465](/home/paulca/amadan.net/carlos/platform-db-region-forward/internal/provision/plan14_root_reads_test.go:465). |
| **13. Completion deletes terminal evidence** | **FIXED** | [§5.3:211](/home/paulca/amadan.net/carlos/platform-db-region-forward/docs/superpowers/specs/2026-10-22-db-region-forward-design.md:211) removes protocol deletion and subsequent terminal synthesis. The retained-state recovery needed by the run transport at [apirunsfollow.go:126](/home/paulca/amadan.net/carlos/platform-db-region-forward/internal/console/apirunsfollow.go:126) is unnecessary here. |
| **14. Cleanup removes follow identity** | **FIXED** | [§9.1:812](/home/paulca/amadan.net/carlos/platform-db-region-forward/docs/superpowers/specs/2026-10-22-db-region-forward-design.md:812) removes follow routes. No later request needs the retained identity used by [apirunsfollow.go:80](/home/paulca/amadan.net/carlos/platform-db-region-forward/internal/console/apirunsfollow.go:80). |
| **15. Full db gate hides `record-changed`** | **FIXED** | [§9.1:812](/home/paulca/amadan.net/carlos/platform-db-region-forward/docs/superpowers/specs/2026-10-22-db-region-forward-design.md:812) runs admission once and returns the box’s refusal through the same response. Later record changes cannot rerun the eligibility checks at [apidb.go:132](/home/paulca/amadan.net/carlos/platform-db-region-forward/internal/console/apidb.go:132). |
| **16. Lazy expiry strands a read** | **FIXED** | Console expiry writes are removed. [§5.4:256](/home/paulca/amadan.net/carlos/platform-db-region-forward/docs/superpowers/specs/2026-10-22-db-region-forward-design.md:256) requires nonce-based ownership read-back after ambiguous pickup, following the recovery principle in [host/runs.go:270](/home/paulca/amadan.net/carlos/platform-db-region-forward/internal/host/runs.go:270). |
| **17. Abandoned reads hold admission** | **FIXED** | [§5.7:463](/home/paulca/amadan.net/carlos/platform-db-region-forward/docs/superpowers/specs/2026-10-22-db-region-forward-design.md:463) binds counts to handler lifetime and deferred release, following [apidb.go:395](/home/paulca/amadan.net/carlos/platform-db-region-forward/internal/console/apidb.go:395). Explicitly flushed progress and bounded writes provide the disconnect/stall path. |
| **18. Forgery claim contradicts sealing** | **FIXED** | [§5.6:408](/home/paulca/amadan.net/carlos/platform-db-region-forward/docs/superpowers/specs/2026-10-22-db-region-forward-design.md:408) withdraws authenticated-authorship claims. Public-key sealing uses a fresh sender key ([crypto.go:173](/home/paulca/amadan.net/carlos/platform-db-region-forward/internal/appconfig/crypto.go:173)); every box has deployment-bucket write authority ([main.tf:166](/home/paulca/amadan.net/carlos/platform-db-region-forward/infra/modules/region-host/main.tf:166)). |
| **19. Progress remains buffered** | **FIXED** | [§5.5:345](/home/paulca/amadan.net/carlos/platform-db-region-forward/docs/superpowers/specs/2026-10-22-db-region-forward-design.md:345) requires flushing every line under its write deadline, including initial headers, and bounds admission before the response. NDJSON is excluded from gzip by [compress.go:128](/home/paulca/amadan.net/carlos/platform-db-region-forward/internal/edge/compress.go:128). The backhaul’s actual 30-second header timeout is at [edge.go:2958](/home/paulca/amadan.net/carlos/platform-db-region-forward/internal/edge/edge.go:2958). |
| **20. Result overtakes final chunk** | **FIXED** | [§5.5:328](/home/paulca/amadan.net/carlos/platform-db-region-forward/docs/superpowers/specs/2026-10-22-db-region-forward-design.md:328) reads the result before listing chunks and withholds the terminal line until every sequence through `last_seq` has been delivered. This matches the ordering explicitly required by [apirunsfollow.go:101](/home/paulca/amadan.net/carlos/platform-db-region-forward/internal/console/apirunsfollow.go:101). |

| Invariant | Disposition | Check |
|---|---|---|
| **J1 — One request** | **FIXED** | §§5.5 and 9.1 provide one response, with no follow, resume or later terminal route. The sole post-request write is the stated best-effort `cancel`. Findings **3, 4, 13, 14 and 15** remain closed. |
| **J2 — Write once** | **FIXED** | §5.4 requires conditional creation for every protocol object. No replacement or protocol deletion remains. The serial bump is outside `db-reads/`. Finding **5** remains closed. |
| **J3 — One owner** | **FIXED** | §5.4 permits execution after an ambiguous create only when read-back contains the same attempt nonce. Failed read-back does not grant ownership. This closes **16** within the explicitly accepted deployment-writer trust boundary of **18**. |
| **J4 — Store-only deletion** | **FIXED** | §§5.7 and 11.1 require lifecycle expiry, including noncurrent versions, before enabling forwarding. Expiry occurs after the request and acceptance windows. Findings **5, 7, 13 and 14** remain closed. |
| **J5 — Admission follows the work** | **FIXED** | Console reservations last until handler return. Box reservations last until worker-unit termination; unknown units block admission after restart. The forced-exit rule closes the remaining cancellation gap in **8**, and handler ownership closes **17**. |

**New P0–P2 findings: none.** P3 observations are excluded as the round-5 brief requests.

The proposed socket activation and private-temp cleanup agree with systemd’s documented semantics: [https://www.freedesktop.org/software/systemd/man/257/systemd.exec.html](https://www.freedesktop.org/software/systemd/man/257/systemd.exec.html). The revised retention statement correctly distinguishes current-version expiry from permanent noncurrent-version deletion: [https://docs.aws.amazon.com/AmazonS3/latest/userguide/lifecycle-expire-general-considerations.html](https://docs.aws.amazon.com/AmazonS3/latest/userguide/lifecycle-expire-general-considerations.html).

Reviewed at `7f463d84eac2d2e161a1a5ade8c5efdbde342df6`. Static design review; no files changed or runtime acceptance tests run. Both cited platform module tags were inspected. Current flagship refs, claim activation and the October 21 deployment event remain unverified: GitHub retrieval failed, and the available infrastructure checkout is dated October 6. Acceptance concerns the design; §16’s product-owner rulings remain pending.

**ACCEPT**