| Prior finding | Disposition at `0236be94` |
|---|---|
| R4-1 | **Resolved for the reported failure.** Removing the root-peer rejection preserves systemd-created application listeners. The replacement path restriction introduces R5-1 below. |
| R4-2 | **Resolved.** The raw directory and confined directory-fd renames provide endpoints on one mount. The changed storage location introduces the downgrade defect in R5-2. |
| R4-3 | **Resolved.** Custom paths are excluded from migration; the remaining forward sources follow their existing file contracts. |
| R4-4 | **Resolved.** The probe no longer requires a forbidden netlink route query. |
| R2-4 | **Partially resolved.** The seed-record outcome rule is now explicit. However, [`start --no-block` followed by `show`](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/docs/superpowers/specs/2026-09-11-isolated-exec-design.md:809) does not retain invocation identity. `--no-block` only enqueues the job: the subsequent query can precede activation or follow completion and unloading. “Immediately” supplies no synchronization. Retain the unit through completion and result capture, or provide equivalent request-to-invocation correlation. [systemctl semantics](https://raw.githubusercontent.com/systemd/systemd/v257/man/systemctl.xml), [unit garbage collection](https://raw.githubusercontent.com/systemd/systemd/v257/man/systemd.unit.xml). |
| R2-5 | **Resolved.** Foreign invocations are stopped, and completion still requires terminal state and an empty cgroup. Unproven stops retain replication and the lease. |
| R2-7 | **Partially resolved.** Forward recovery now recognizes both row endpoints and changed fleet intent. But the [new validation](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/docs/superpowers/specs/2026-09-11-isolated-exec-design.md:1405) requires `from` to be flat even for a reverse journal. A legitimate nested→flat transaction therefore fails validation. Derive **both** endpoints from the journal’s direction, including artifact sources. Also reconcile §3.3’s remaining requirement that journal direction equal current fleet intent with §8.2’s explicit opposite rule. |
| R2-9 | **Resolved for the original first-upgrade defect.** Flat minting preserves compatibility before migration. The newly introduced mount-removal defect is R5-2. |
| R2-14 | **Resolved at spec level.** IPv6 evidence remains explicitly unverified when unavailable; the exception has a five-minute bound, rechecks and status reporting. |
| R1-4 | **Resolved.** Completion is independent of log EOF, blocking observations stay outside the mutex, and the foreign-invocation completion exception is removed. |
| R1-5 | **Partially resolved.** Preparation, execution budget, cancellation and termination-before-cleanup are specified. Seed invocation correlation remains defective under R2-4. |
| R1-8 | **Resolved.** Shared tier limits and the deliberate per-service OOM-family difference are specified. |
| R1-12 | **Partially resolved.** Consumer fences are specified; reverse-journal recovery remains defective under R2-7. |
| R1-13 | **Partially resolved.** Explicit reversal and collision refusal replace the original history-selection defect, but reverse validation remains inconsistent under R2-7. |
| R1-15 | **Resolved at spec level.** There is no unsafe PID-namespace fallback; the probe and bounded IPv6 exception are specified. |
| R1-18 | **Resolved under the recorded ruling.** Remote reporting and layout operations are specified. The box-local `foreign` repair residual is explicitly accepted. |

**R5-1 — P2 — §§5.4, 6.1, 8.3: Retain the authenticated control service, but preserve supported custom socket paths.**

The new rule rejects every application dial outside `/run/carlos/`. An existing route with `Socket=/run/titogo/example.sock` therefore loses public traffic and health checks on upgrade, even though §8.3 promises that `foreign` routes keep running unchanged.

The existing CLI accepts an explicit socket pathname, and the edge uses it without this directory restriction. The reviewed Tito precedent itself binds beneath `/run/titogo`.

Evidence: [new dial restriction](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/docs/superpowers/specs/2026-09-11-isolated-exec-design.md:878), [compatibility promise](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/docs/superpowers/specs/2026-09-11-isolated-exec-design.md:1451), [CLI socket input](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/cli.go:76), [edge dispatch](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/internal/edge/edge.go:536).

**Correction:** retain process authentication and the actual-peer-address check. Reserve and reject the broker endpoint explicitly while permitting existing ordinary upstream paths. Verify a legitimate custom socket outside `/run/carlos/` alongside direct and symlinked attempts to proxy to the broker.

**R5-2 — P2 — §§3.2, 8.2, 9: Removing the new bind mounts invalidates the downgrade recovery claim.**

This revision stores the database physically under `/data/.instances` and exposes it through `/data/instances`. An ordinary downgrade to a pre-layout release removes the new mount units: `installUnits` executes `systemctl disable --now` for every removed unit before deleting its file.

Consequently, the old backend’s nested `DBPath` no longer reaches the database. The same change removes the nested runtime-directory view immediately, rather than only after reboot as §8.2 claims.

There is also a second-copy path: the old backend sees the database as absent and invokes restore. Litestream creates missing parent directories, so it can restore into the uncovered `/data/instances/<host>/` while the original remains under `/data/.instances/<host>/`. Reinstalling the bind mount hides that restored copy from the specified collision check.

Evidence: [new mount source](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/docs/superpowers/specs/2026-09-11-isolated-exec-design.md:380), [downgrade claim](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/docs/superpowers/specs/2026-09-11-isolated-exec-design.md:1438), [removed-unit handling](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/internal/host/systemapply.go:522), [missing-database handling](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/internal/activator/backend_exec.go:220), [restore directory creation](/home/paulca/go/pkg/mod/github.com/benbjohnson/litestream@v0.5.14/replica.go:654).

**Correction:** make completed reversal a checked prerequisite for removing these mounts and starting a pre-layout binary. Define recovery for an already-unmounted layout, including checking the uncovered mountpoint before remounting. Verify through the actual updater’s unit-removal path.

**R5-3 — P1 — §§3.1, 6.1, 8.2: The longer socket paths make previously working hosts unwakeable after migration.**

For a valid 80-byte hostname, the current application socket is 97 bytes and its control socket is 105 bytes. The proposed paths become:

- Application: `/run/carlos/instances/<host>/app.sock` — **111 bytes**.
- Control: the same path plus `.control` — **119 bytes**.
- Sidecar log: `/run/carlos/logs/<host>.sidecar.sock` — **110 bytes**.

Linux’s Unix socket address has a 108-byte pathname field; Go requires room for the terminating NUL. These new addresses cannot bind. Migration nevertheless accepts the flat row and commits the nested paths, after which the application cannot wake.

Evidence: [runtime layout](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/docs/superpowers/specs/2026-09-11-isolated-exec-design.md:279), [existing hostname validation](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/isolated-exec-spec/internal/controlname/names.go:18), [Go’s address-length rejection](/usr/local/go/src/syscall/syscall_linux.go:547), [Linux Unix socket limits](https://man7.org/linux/man-pages/man7/unix.7.html).

**Correction:** specify a bounded per-host runtime identifier consistently across socket paths, unit bind paths and log endpoints. Preflight every resulting Unix socket address before moving files. Include a hostname that fits the current application and control sockets but exceeds the proposed limits.

**Verdict: request changes.**