carlos / platform Public

moves: restoring keeps the source region authoritative until the return (J2/F4, L18 finding 1)

Why. The region HA L18 joint round found this, and Paul asked region HA to fix it (#236, 2026-10-12). internal/host/movessources.go's restoring case took the authoritative region from the newest admission. After the target's admission, that is the target. The source's park view then skipped its marker and its files pins, so a park of a source generation that was already pending could retire objects the source's retained manifest still referenced, before a clean rollback put that generation back.

That breaks J2/F4, which moves accepted: the files live set stays protected on the source until the record commits. It was latent, because production park providers refuse until the Plan 12 integration.

The change. In restoring, seen from the source's region, the source stays authoritative while the op is in releasing or released. This mirrors the landing case's protection before the commit. A clean return then puts the source generation back, so the view names the source anyway. At a dirty return, protection ends, because the dirty return's own install parks the generations from before the move (D6). The target's view is unchanged, and so is every other case.

Tests. TestRestoringKeepsTheSourcesFilesLiveSetUntilTheReturn runs the real view and the real park engine, once clean and once dirty. A park queued before the target's admission, followed by a rollback, retires nothing until the return. Mutation checks: flipping the condition, or dropping the phase check, fails the tests. The whole internal/host, internal/moves/... and internal/park packages pass, as do the census and the moves copy gate.

Owner. This is moves' code, so the diff is posted on #236 for platform-d8 to review. Merging is Paul's call.