amadan
Reconcile's OnRecords hands over a partial record map without saying so open
Found building the siblings-file pass for #162 (internal/host/siblings.go, branch replica-placements-162).
provision.Reconcile sets readFailed when a record's Get fails mid-pass and skips that record, but it still calls cfg.OnRecords(all) with the partial map, and OnRecords carries no way to say "this view is incomplete". The removal phase inside Reconcile guards itself with readFailed for exactly this reason (if !readFailed { ... }), so the pass already knows the distinction it is not passing on.
For the siblings writer that matters because the map is the only source of both sides of a home/replica pair: a transient bucket blip on one record drops one side out of the file until the next pass. The writer defends the worst case itself — an empty map is treated as "learned nothing" rather than "everything is gone", so an outage cannot wipe every key file — but a partial map still causes a transient.
The fix belongs in the reconcile signature, not in the consumer: either pass readFailed alongside the map (OnRecords(all map[string]Record, complete bool)), or do not call the callback at all on a failed pass. The second is simpler and matches what the removal phase already does with the same fact.
Not urgent, and not a correctness bug for the feature that found it — filing so the next consumer of OnRecords does not have to rediscover that the map is best-effort.