| Finding | Disposition | Reason |
|---|---|---|
| 9 | **Closed for the specified 100 MiB configuration** | The recorded real-engine results address the reported truncation. Source inspection supports them: ClamAV accounts for the enclosing archive before checking the extracted member’s size, and checks limits before consulting the clean cache. See [`scanners.c:3918`](https://github.com/Cisco-Talos/clamav/blob/clamav-1.4.3/libclamav/scanners.c#L3918) and [`others.c:1081`](https://github.com/Cisco-Talos/clamav/blob/clamav-1.4.3/libclamav/others.c#L1081-L1126). |
| 7, remaining part | **Explicitly deferred, not fixed** | §11 acknowledges that increasing limits does not retry unchanged `skipped` objects. That matches `internal/objstore/clamav.go:249–258`. This is an identified follow-up outside the initial rollout, not a new finding. |

Reviewed `51985b0d`. No files changed or live scans performed.

10. **P2 — §§3.2, 6.3, 8: A failed self-test does not prevent the scanner passing the rollout’s readiness checks.**

    Step 6 starts clamd before step 7 runs the self-test. Exiting the bootstrap script non-zero does not stop that already-running service; cloud-init’s user-data stage does not block boot. See [cloud-init’s final-stage documentation](https://docs.cloud-init.io/en/latest/explanation/boot.html#final).

    The subsequent checks cannot distinguish this state from success: [`internal/objstore/clamav.go:108`](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/scanner-host/internal/objstore/clamav.go:108) obtains provenance using only `VERSION`; [`internal/console/apisystem.go:85`](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/scanner-host/internal/console/apisystem.go:85) uses that for status; enable checks only that a scanner is wired at line 133.

    Consequently, an engine that returns `OK` for an over-limit fixture can fail its self-test yet remain reachable, report fresh signatures, and pass Tito’s prescribed `status`/`enable` proof. Withholding the script’s final version line does not close this path.

    **Fix:** Require successful bootstrap and self-test completion on each scanner instance before §6 wiring, including Tito. Make self-test failure stop the scanner and prevent it restarting into service without a successful test.

11. **P2 — §§3.2–3.4: Fixed-size fixtures reject valid non-default limits.**

    §3.3 permits `max_scan_bytes = 33554432` with the default 25 MiB stream limit. But §3.4 requires the ZIP containing one 60 MiB member to return `OK`. With both engine limits at 32 MiB, its extraction instead encounters the limit: [`libclamav/unzip.c:209–227`](https://github.com/Cisco-Talos/clamav/blob/clamav-1.4.3/libclamav/unzip.c#L209-L227) trims the member, and [`libclamav/others.c:1081–1086`](https://github.com/Cisco-Talos/clamav/blob/clamav-1.4.3/libclamav/others.c#L1081-L1086) reports the exhausted aggregate budget.

    A correctly configured scanner therefore fails the mandatory self-test for an explicitly permitted module input. The recorded expectations apply to the 100 MiB default, not the full variable contract.

    **Fix:** Derive fixture sizes and expected outcomes from the configured limits, keeping compressed streams below `stream_max_bytes`; alternatively, restrict this release to the tested limits.

**Verdict: accept with fixes.**