| Prior finding | Disposition at `c5393728` |
|---|---|
| R10-1 | **Resolved for the credential exposure.** All tenant roles hide `/etc/carlos`; §9 extends the audit to credential reads. The new probe setup has a separate defect below. |
| R5-2 | **Resolved.** Downgrade checks every row’s paths regardless of flags and requires completed reversal; unflagging nested rows is refused (§8.2). |
| R5-3 | **Resolved.** Directory, socket, unit and slice names consistently use bounded `InstanceID(host)` (§§3.1, 5.3). |
| R2-4 | **Resolved.** Blocking seed execution and `RemainAfterExit=yes` retain invocation identity and results through capture (§§4.2, 5.3). |
| R2-5 | **Resolved.** Completion requires terminal state and cgroup emptiness, including foreign invocations; uncertain stops retain the lease (§§6.3, 6.5). |
| R2-7 | **Resolved.** Recovery derives both endpoints from journal direction, completes that transaction, then converges to current intent (§8.2). |
| R2-9 | **Resolved.** Flat minting, explicit reversal, env asides and completed-reversal downgrade guards cover the reported failures (§§8.1–8.2). |
| R2-14 | **Resolved at spec level.** The IPv6 exception is explicit, bounded, rechecked and reported (§8.5). |
| R1-4 | **Resolved.** Log EOF does not establish termination; blocking observations remain outside the activator mutex (§§6.4–6.7). |
| R1-5 | **Resolved.** Seed preparation, execution budget, cancellation, result retention and termination-before-cleanup are specified (§§6.1–6.5). |
| R1-8 | **Resolved under the recorded decision.** Shared tier limits remain; per-service OOM families are an explicit difference (§4.3). |
| R1-12 | **Resolved.** Named consumer fences and bidirectional journal recovery cover interrupted migration (§8.2). |
| R1-13 | **Resolved.** Reverse recovery and completed-reversal downgrade guards address the reported defects (§8.2). |
| R1-15 | **Resolved for the reported PID/IMDS defects.** No unsafe fallback remains; the behavioural gate is specified (§8.5). |
| R1-18 | **Resolved under the recorded ruling.** Remote operations and reporting are specified; the `foreign` repair residual remains explicitly accepted (§§8.3–8.4). |

**R11-1 — P2 — §§5.2, 8.5: The control service’s sandbox prevents creation of the new probe fixture.**

Retain §5.4’s process-authenticated control service.

[§8.5 requires the control service to stage `/etc/carlos/probe-secret`](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/docs/superpowers/specs/2026-09-11-isolated-exec-design.md:1664) as `root:carlos 0640` before running the probe. But [the supplied control-service unit](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/docs/superpowers/specs/2026-09-11-isolated-exec-design.md:857) sets `ProtectSystem=strict` without a writable exception for that path. This makes `/etc` read-only inside the service; ordinary file creation fails with `EROFS` despite running as root. [systemd execution semantics](https://raw.githubusercontent.com/systemd/systemd/v257/man/systemd.exec.xml).

On a clean rollout, the mandatory fixture therefore cannot be prepared as specified. Honouring the setup failure prevents readiness; proceeding without the fixture makes its unreadability check vacuous.

**Correction:** assign fixture creation to root bootstrap/tmpfiles, ordered before the probe. Have the control service verify that the fixture exists with the required ownership and mode before accepting the probe result. Keep `/etc/carlos` inaccessible in every tenant template.

**Verdict: accept with corrections.**