| R1 finding | Disposition | Evidence at `345255bf` |
|---|---|---|
| F1 — Moves regress behind live fallback | Addressed | Move steps use the live strict walk at [movespass.go:1098](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/s3-polling-336/internal/host/movespass.go:1098). Snapshot skipping requires prior idle state and no local work at [movespass.go:1307](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/s3-polling-336/internal/host/movespass.go:1307). |
| F2 — Sidecar placement cannot evacuate | Addressed | Placement uses the scanned manifest at [sidecar_reconcile.go:354](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/s3-polling-336/internal/provision/sidecar_reconcile.go:354); retirement rescans live and retains rows on read failure at [sidecar_reconcile.go:538](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/s3-polling-336/internal/provision/sidecar_reconcile.go:538). |
| F3 — Unbounded poll and frozen observation | Addressed | Both view entry points use the bounded poll at [recordview.go:201](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/s3-polling-336/internal/provision/recordview.go:201). Cancellation and lock give-up invalidate the watch at [changewatch.go:74](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/s3-polling-336/internal/release/changewatch.go:74). |
| F4 — Removal omits walk protections | Addressed | The shared scan protects invalid shapes and empty channels before scope checks, and collects by host. Retirement uses its live results at [reconcile.go:1614](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/s3-polling-336/internal/provision/reconcile.go:1614). |
| F5 — Disarmed telemetry memoization | Addressed | Nil-watch execution returns to independent per-app resolution at [telemetry_pass.go:87](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/s3-polling-336/internal/host/telemetry_pass.go:87). |
| F6 — Cross-channel restart suppression | Addressed | Each channel records its own head, generation and age; settlement checks them at [agent.go:2823](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/s3-polling-336/internal/host/agent.go:2823). |
| F7 — Failed certificate-copy retries skipped | Addressed | Unchanged polls retry pending local copies from the retained snapshot at [certsync.go:763](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/s3-polling-336/internal/edge/certsync.go:763). |

Two new P2 findings in `4512018a..25eac78c`:

1. **P2 — A failed-index tick can forget a newly observed canary head.**  
   [agent.go:2749](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/s3-polling-336/internal/host/agent.go:2749) disables the entire pointer gate, including its read-result callback. Suppose the saved head and live version are v1; an unbumped promotion writes v2; an index-error tick reads v2, but its restart fails and rolls back. The saved head remains v1. After index recovery at the unchanged generation and expiry of the restart hold, [agent.go:2825](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/s3-polling-336/internal/host/agent.go:2825) considers v1 settled and suppresses retries until another pass or the age bound.

   This concerns retrying an **already observed** promotion, rather than the accepted delay in discovering unbumped writes. Force reads on failed-index ticks while retaining their result callbacks, or invalidate the saved heads. Add this recovery-and-rollback regression.

2. **P2 — Moves now perform additional filesystem reads while disarmed.**  
   The end-of-pass assignment at [movespass.go:1296](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/s3-polling-336/internal/host/movespass.go:1296) calls `localMoveState()` even with no armed record view. An otherwise idle worker consequently enumerates `.moves` and its child directories through [movespass.go:1356](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/s3-polling-336/internal/host/movespass.go:1356), including when Phase 1 moves are disabled. This violates the brief’s explicit disarmed-equivalence requirement.

   Restrict the idle bookkeeping and its disk inspection to armed readers; verify the disarmed path performs no added directory reads.

Tests could not start: the read-only sandbox prevented Go from creating its build directory. Conclusions are from code and test inspection.

**Verdict: accept under the requested P1-blocker criterion. All four R1 P1s are addressed; no new Critical/P1 found. The two P2s above remain.**