| Earlier finding | Disposition at `de35b5b5` |
|---|---|
| R4.1 — Recovery bypasses empty-bucket safeguard | **Fixed:** §2 applies the tripwire to absence-based finalization. |
| R4.2 — Trash UI/API promises 30 days | **Fixed:** §5 specifies one effective deadline across displays. |
| R5.1 — Route-only permanent service can become temporary | **Fixed for the reported paths:** §3 requires namespace enforcement before fleet inspection and enablement. |
| R5.2 — Expiry markers defeat the tripwire | **Fixed:** markers do not establish nonempty-bucket evidence. |
| R6.1 — Local inventory misses remote routes | **Fixed:** rollout requires fleet-wide enforcement and inspection. |
| R6.2 — Reconciliation can reassign permanent routes | **Fixed for the reported counterexample:** the reserved namespace excludes its conflicting permanent route. |
| R7.1 — Older writers invalidate the rollout scan | **Fixed within the stated scope:** upgrade every box before scanning and enabling; deliberately retained old binaries remain excluded. |
| R7.2 — Grant/backfill bypasses reservation | **Fixed:** grant refuses reserved names; backfill skips them; rollout checks both tables. |
| R7.3 — Interrupted last-app purge cannot retry | **Fixed:** §2 permits matching-marker purge retries despite a tripped guard. |
| R7.4 — Direct delete overpromises recovery | **Fixed:** §5 reports possible deadlines from the original tombstone timestamp. |
| R8.1 — Failed manual-trash row update escapes recovery | **Fixed:** §5’s periodic settle sweep includes live temporary rows with markers, regardless of expiry. |
| R8.2 — Direct-mode retry promises extra recovery time | **Fixed:** retries retain the original clock and explicitly handle elapsed deadlines. |

No new findings after checking the revised mechanisms against the existing code.

Verdict: **accept**.