carlos / platform Public

moves: restoring keeps the source region authoritative until a clean return or the commit (J2/F4, L18 finding 1)

At restoring/releasing and released the newest admission is the target's,
so the source's park view named the target and dropped its marker and
files pins: a source-generation park queued before the target's
admission could retire objects the source's retained manifest names,
before a clean return restores that generation. Seen from the source's
region, restoring now names the source while the target releases, as
landing does before the commit; the target's view is unchanged.

From the source's return CAS the newest admission decides again: a
clean return is admitted in the source, and a dirty one's install parks
the pre-move generations (D6). A dirty release is still protected until
then, because a declared loss turns it clean (MoveRollbackLossCommitted).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Paul Campbell pushed by claude 1 week ago a5e8c13fe8272df54f2116b5204ad2b760f62b00 parent 8916558

2 files changed, +163 −0

internal/host/movesfileslive_test.go +142 −0
internal/host/movessources.go +21 −0

CI passed — run details

CI log

=== gate ===
cd launchctx && go vet ./... && go test ./... -count=1
ok  	amadan.net/carlos/platform.git/launchctx	0.011s
?   	amadan.net/carlos/platform.git/launchctx/controlname	[no test files]
?   	amadan.net/carlos/platform.git/launchctx/wireid	[no test files]
go vet ./...
gofmt -l .: clean
go test ./... -count=1 -timeout 30m
ok  	github.com/carlosframework/platform	338.427s
?   	github.com/carlosframework/platform/cmd/changelog	[no test files]
ok  	github.com/carlosframework/platform/cmd/console	3.396s
ok  	github.com/carlosframework/platform/cmd/moveprobe	92.486s
ok  	github.com/carlosframework/platform/internal/activator	237.921s
ok  	github.com/carlosframework/platform/internal/agentsock	0.020s
ok  	github.com/carlosframework/platform/internal/alerting	0.006s
ok  	github.com/carlosframework/platform/internal/analytics	0.021s
ok  	github.com/carlosframework/platform/internal/appconfig	2.375s
ok  	github.com/carlosframework/platform/internal/apperr	0.132s
ok  	github.com/carlosframework/platform/internal/applog	0.190s
ok  	github.com/carlosframework/platform/internal/awsinv	0.005s
ok  	github.com/carlosframework/platform/internal/boxchoice	0.009s
ok  	github.com/carlosframework/platform/internal/boxid	0.710s
?   	github.com/carlosframework/platform/internal/boxid/boxidtest	[no test files]
?   	github.com/carlosframework/platform/internal/boxid/internal/signtest	[no test files]
ok  	github.com/carlosframework/platform/internal/boxvolumes	0.011s
ok  	github.com/carlosframework/platform/internal/caps	0.013s
ok  	github.com/carlosframework/platform/internal/certwarm	0.002s
ok  	github.com/carlosframework/platform/internal/cgroup	0.223s
ok  	github.com/carlosframework/platform/internal/changelog	0.315s
ok  	github.com/carlosframework/platform/internal/clamd	0.058s
?   	github.com/carlosframework/platform/internal/cliflag	[no test files]
ok  	github.com/carlosframework/platform/internal/console	364.221s
?   	github.com/carlosframework/platform/internal/controlname	[no test files]
?   	github.com/carlosframework/platform/internal/controlsock	[no test files]
ok  	github.com/carlosframework/platform/internal/dbdoor	5.779s
ok  	github.com/carlosframework/platform/internal/dbdoor/dbdoortest	0.010s
ok  	github.com/carlosframework/platform/internal/dbverify	0.004s
ok  	github.com/carlosframework/platform/internal/dnsrec	0.003s
ok  	github.com/carlosframework/platform/internal/docsite	0.005s
ok  	github.com/carlosframework/platform/internal/domains	2.082s
ok  	github.com/carlosframework/platform/internal/doorkey	0.006s
ok  	github.com/carlosframework/platform/internal/economics	0.004s
ok  	github.com/carlosframework/platform/internal/edge	26.152s
?   	github.com/carlosframework/platform/internal/edgeproof	[no test files]
ok  	github.com/carlosframework/platform/internal/edgesfile	0.007s
ok  	github.com/carlosframework/platform/internal/fleetapi	0.141s
ok  	github.com/carlosframework/platform/internal/gate	1.728s
ok  	github.com/carlosframework/platform/internal/genselect	0.017s
ok  	github.com/carlosframework/platform/internal/geo	0.026s
ok  	github.com/carlosframework/platform/internal/geoip	0.034s
ok  	github.com/carlosframework/platform/internal/host	60.173s
ok  	github.com/carlosframework/platform/internal/hostactors	0.397s
ok  	github.com/carlosframework/platform/internal/hostbox	1.409s
ok  	github.com/carlosframework/platform/internal/hostclaim	0.306s
ok  	github.com/carlosframework/platform/internal/hostevidence	0.022s
ok  	github.com/carlosframework/platform/internal/hostexec	0.336s
ok  	github.com/carlosframework/platform/internal/hostfence	0.049s
ok  	github.com/carlosframework/platform/internal/hostfiles	4.148s
ok  	github.com/carlosframework/platform/internal/hostfloor	0.026s
ok  	github.com/carlosframework/platform/internal/hostguard	0.158s
ok  	github.com/carlosframework/platform/internal/hostops	1.457s
?   	github.com/carlosframework/platform/internal/hostops/fencerelease	[no test files]
ok  	github.com/carlosframework/platform/internal/hostops/internal/fencerelease	0.002s
ok  	github.com/carlosframework/platform/internal/hostquarantine	0.005s
ok  	github.com/carlosframework/platform/internal/hostresolve	0.143s
ok  	github.com/carlosframework/platform/internal/hostwrite	0.002s
ok  	github.com/carlosframework/platform/internal/infraview	0.003s
ok  	github.com/carlosframework/platform/internal/instancectl	1.707s
ok  	github.com/carlosframework/platform/internal/instanceexec	2.712s
ok  	github.com/carlosframework/platform/internal/instancefs	0.004s
ok  	github.com/carlosframework/platform/internal/instancekey	0.003s
ok  	github.com/carlosframework/platform/internal/instanceupdates	0.009s
ok  	github.com/carlosframework/platform/internal/layout	1.448s
ok  	github.com/carlosframework/platform/internal/lease	9.454s
ok  	github.com/carlosframework/platform/internal/lease/leasetest	0.008s
ok  	github.com/carlosframework/platform/internal/ledger	0.020s
ok  	github.com/carlosframework/platform/internal/mail	0.154s
ok  	github.com/carlosframework/platform/internal/maintenance	0.075s
ok  	github.com/carlosframework/platform/internal/maintenanceexec	5.561s
ok  	github.com/carlosframework/platform/internal/maintenanceguard	0.071s
ok  	github.com/carlosframework/platform/internal/metrics	0.005s
ok  	github.com/carlosframework/platform/internal/moves	21.262s
ok  	github.com/carlosframework/platform/internal/moves/archive	0.777s
ok  	github.com/carlosframework/platform/internal/objstore	0.162s
ok  	github.com/carlosframework/platform/internal/ops	0.161s
ok  	github.com/carlosframework/platform/internal/park	0.193s
ok  	github.com/carlosframework/platform/internal/privatefile	0.004s
ok  	github.com/carlosframework/platform/internal/provision	3.310s
ok  	github.com/carlosframework/platform/internal/publicrelease	0.007s
?   	github.com/carlosframework/platform/internal/regionname	[no test files]
ok  	github.com/carlosframework/platform/internal/registry	3.966s
ok  	github.com/carlosframework/platform/internal/relay	7.216s
ok  	github.com/carlosframework/platform/internal/release	18.913s
ok  	github.com/carlosframework/platform/internal/rollout	3.287s
ok  	github.com/carlosframework/platform/internal/rolloutwords	0.003s
ok  	github.com/carlosframework/platform/internal/rootaws	0.007s
ok  	github.com/carlosframework/platform/internal/s3compat	0.005s
ok  	github.com/carlosframework/platform/internal/safefile	0.004s
ok  	github.com/carlosframework/platform/internal/schedule	2.368s
ok  	github.com/carlosframework/platform/internal/sim/hostlife	2.561s
ok  	github.com/carlosframework/platform/internal/sim/litestreamfacts	4.295s
ok  	github.com/carlosframework/platform/internal/status	0.044s
ok  	github.com/carlosframework/platform/internal/steering	0.011s
ok  	github.com/carlosframework/platform/internal/stopevidence	0.161s
ok  	github.com/carlosframework/platform/internal/svcrole	0.008s
ok  	github.com/carlosframework/platform/internal/telemetry	0.013s
ok  	github.com/carlosframework/platform/internal/termfence	0.008s
ok  	github.com/carlosframework/platform/internal/tunnelclient	0.009s
ok  	github.com/carlosframework/platform/internal/unixdial	0.005s
ok  	github.com/carlosframework/platform/internal/updatewords	0.004s
ok  	github.com/carlosframework/platform/internal/usage	0.006s
ok  	github.com/carlosframework/platform/internal/version	0.002s
ok  	github.com/carlosframework/platform/internal/vet	1.577s
=== cross ===
--- shard 0 of 5 ---
cross-compiling darwin/arm64
--- shard 1 of 5 ---
cross-compiling darwin/amd64
--- shard 2 of 5 ---
cross-compiling linux/arm64
--- shard 3 of 5 ---
cross-compiling windows/amd64
--- shard 4 of 5 ---
cross-compiling windows/arm64
=== minio-contract ===
minio contract: arm64, minio RELEASE.2025-09-07T16-13-09Z, mc RELEASE.2025-08-13T08-35-41Z
  minio: downloading https://github.com/minio/minio/releases/download/RELEASE.2025-09-07T16-13-09Z/minio.linux-arm64.RELEASE.2025-09-07T16-13-09Z
  minio: downloaded, digest verified
  mc: downloading https://github.com/minio/mc/releases/download/RELEASE.2025-08-13T08-35-41Z/mc.linux-arm64.RELEASE.2025-08-13T08-35-41Z
  mc: downloaded, digest verified
  minio healthy on 127.0.0.1:20999
Added `local` successfully.
Bucket created successfully `local/contract-bucket`.
Bucket created successfully `local/denied-bucket`.
Created policy `contract-only` successfully.
Added user `scopeduser` successfully.
Attached Policies: [contract-only]
To User: scopeduser
  buckets and scoped user ready
=== RUN   TestDeliveredContractMinio
=== RUN   TestDeliveredContractMinio/put
=== RUN   TestDeliveredContractMinio/get_round-trips_the_body
=== RUN   TestDeliveredContractMinio/list_shows_the_key
=== RUN   TestDeliveredContractMinio/head_and_list_agree_on_the_version
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_its_own_object
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/not_by_PutObjectTagging
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/and_not_by_x-amz-tagging_on_upload
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CreateMultipartUpload
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CopyObject_with_a_REPLACE_tagging_directive
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/but_multipart_itself_is_allowed
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_copy_itself_is_allowed
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/a_POST-policy_forged_tag_with_a_matching_version_is_still_not_a_verdict
=== RUN   TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_an_ordinary_tagged-with-something-else_upload_is_allowed
=== RUN   TestDeliveredContractMinio/delete_removes_it
=== RUN   TestDeliveredContractMinio/cross-bucket_denial
--- PASS: TestDeliveredContractMinio (0.02s)
    --- PASS: TestDeliveredContractMinio/put (0.00s)
    --- PASS: TestDeliveredContractMinio/get_round-trips_the_body (0.00s)
    --- PASS: TestDeliveredContractMinio/list_shows_the_key (0.00s)
    --- PASS: TestDeliveredContractMinio/head_and_list_agree_on_the_version (0.00s)
    --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/not_by_PutObjectTagging (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_its_own_object/and_not_by_x-amz-tagging_on_upload (0.00s)
    --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route (0.01s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CreateMultipartUpload (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/not_by_CopyObject_with_a_REPLACE_tagging_directive (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/but_multipart_itself_is_allowed (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_copy_itself_is_allowed (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/a_POST-policy_forged_tag_with_a_matching_version_is_still_not_a_verdict (0.00s)
        --- PASS: TestDeliveredContractMinio/the_app_cannot_tag_by_any_other_route/and_an_ordinary_tagged-with-something-else_upload_is_allowed (0.00s)
    --- PASS: TestDeliveredContractMinio/delete_removes_it (0.00s)
    --- PASS: TestDeliveredContractMinio/cross-bucket_denial (0.00s)
PASS
ok  	github.com/carlosframework/platform/internal/objstore	0.022s
=== RUN   TestT4StorageProbeMinio
2026/10/12 19:04:21 moves: T4: STORE: list: operation error S3: ListObjectsV2, https response error StatusCode: 403, RequestID: 18DDDD958F7C3F61, HostID: 7c420053e0fbcd7f41653fdd92ffa2802c903d05303b1aa15adc2e8bb65d183f, api error SignatureDoesNotMatch: The request signature we calculated does not match the signature you provided. Check your key and signing method.
--- PASS: TestT4StorageProbeMinio (0.01s)
PASS
ok  	github.com/carlosframework/platform/internal/host	0.020s
minio contract: PASS

diff --git a/internal/host/movesfileslive_test.go b/internal/host/movesfileslive_test.go

index 9885ddd8b..fab2fbacc 100644

--- a/internal/host/movesfileslive_test.go

+++ b/internal/host/movesfileslive_test.go

@@ -15,6 +15,7 @@ import (

"github.com/carlosframework/platform/internal/lease"

"github.com/carlosframework/platform/internal/park"

"github.com/carlosframework/platform/internal/provision"

+ "github.com/carlosframework/platform/internal/release"

)

// The files live set (J2/F4, Paul's #236 ruling; M10): every moves park

@@ -249,6 +250,147 @@ func TestReturnResidueParkKeepsTheFilesLiveSet(t *testing.T) {

}

+// TestRestoringKeepsTheSourcesFilesLiveSetUntilTheReturn (J2/F4; L18 joint

+// round, finding 1): a park of an older source generation is queued in the

+// source's region before the target's probe is admitted; then the target is

+// admitted and the landing is rolled back. While the target releases

+// (restoring/releasing, released) the newest admission is the target's, but

+// a clean return restores the source's retained generation, so seen from the

+// source's region the source stays authoritative: its marker and files pins

+// hold, the chore is refused and nothing the retained manifest names is

+// retired. A dirty release is protected the same way (a declared loss turns

+// it clean). The target's region still names the target. From the return CAS

+// on the newest admission decides, as before: a clean return is admitted in

+// the source, and a dirty one names the target until the source's probe is

+// admitted, so the source pins nothing and the chore parks the pre-move

+// generation (D6).

+func TestRestoringKeepsTheSourcesFilesLiveSetUntilTheReturn(t *testing.T) {

+ for _, dirty := range []bool{false, true} {

+ t.Run(fmt.Sprintf("dirty %v", dirty), func(t *testing.T) {

+ ctx := t.Context()

+ f := newVwFixture(t)

+ markerVer, snapshot := f.marker(t, "cur", f.inc)

+ snapKey := f.location + "/g-cur/0009/0000000000000001-0000000000000005.ltx"

+ old := map[string]string{}

+ for _, k := range []string{f.location + "/files/g-old/objects/0000000000000001-aa", f.location + "/g-old/0000/db"} {

+ old[k] = f.bucket.Put("data", k, []byte("old"))

+ }

+ named := f.location + "/files/g-old/objects/0000000000000001-aa"

+ filesManifest(t, func(k string, b []byte) { f.bucket.Put("data", k, b) }, f.location, "cur", "a.txt="+named)

+ f.move(provision.MoveLanding)

+ // The chore, queued in the source's region at landing, before

+ // the target's probe is admitted.

+ claims := release.NewDirStore(t.TempDir())

+ chore := hostclaim.Obligation{ID: "park-old", Op: vwMove, Kind: "park-generation", Region: "ie", Owner: "region:ie", Generation: "old", Retirement: "ret-1",

+ Park: &hostclaim.ParkScope{Location: f.location, Incarnation: f.inc, EvidenceAt: evAt, RequestLimit: hostbox.RequestLimit}}

+ update := func(step func(*hostclaim.Claim) error) {

+ t.Helper()

+ obs, err := hostclaim.Read(ctx, claims, vwHost)

+ if err != nil {

+ t.Fatal(err)

+ }

+ if _, err := hostclaim.Update(ctx, claims, obs, step); err != nil {

+ t.Fatal(err)

+ }

+ update(func(c *hostclaim.Claim) error {

+ c.Host, c.Holder = vwHost, f.holder("cur", "cur@ie")

+ c.Op = hostclaim.Op{Kind: hostclaim.KindLanding, ID: vwMove, Phase: provision.LandProbing, Exec: "uk-box", Participants: []string{"ie-box", "uk-box"},

+ Intent: map[string]string{"source": "ie-box", "target": "uk-box", "from": "ie", "to": "uk"},

+ Journal: map[string]string{hostclaim.JournalSourceStamp: "3", hostclaim.JournalSrcGen: "cur"}}

+ c.Obligations = []hostclaim.Obligation{chore}

+ return nil

+ })

+ // The target's probe's admission, then the rollback.

+ update(func(c *hostclaim.Claim) error {

+ c.Holder.Admissions = append(c.Holder.Admissions, hostclaim.AdmissionRecord{Session: 2, Box: "uk-box", Generation: vwMove, Predecessor: "cur", Mode: "cold", Region: "uk", PredecessorRegion: "ie"})

+ c.Holder.Generation = vwMove

+ return nil

+ })

+ f.rec.Move.State = provision.MoveRollingBack

+ f.rec.Move.Rollback = &provision.MoveRollback{ID: vwRb, TargetPhase: provision.RbTargetReleasing}

+ update(hostclaim.RollBack(vwMove, vwRb))

+ seq := 0

+ engine := park.Engine{Store: f.bucket, Claims: claims, Bucket: "data", Region: "ie", Leases: evLeases{}, Now: func() time.Time { return evNow },

+ NewID: func() string { seq++; return fmt.Sprintf("id%d", seq) }, View: f.view("ie"), Authorize: allowParkAuthorize}

+ observe := func() hostclaim.Observed {

+ t.Helper()

+ obs, err := hostclaim.Read(ctx, claims, vwHost)

+ if err != nil {

+ t.Fatal(err)

+ }

+ return obs

+ }

+ intact := func() bool {

+ for k, ver := range old {

+ if _, ok := f.bucket.Current("data", k); !ok || f.bucket.LatestID("data", k) != ver {

+ return false

+ }

+ return true

+ }

+ protectedOnSource := func(when string) {

+ t.Helper()

+ if err := engine.Run(ctx, park.Work{Host: vwHost, ID: chore.ID, Op: vwMove}); !errors.Is(err, park.ErrUnsafe) {

+ t.Fatalf("%s: the source's park of a generation its retained manifest names: %v", when, err)

+ }

+ if !intact() {

+ t.Fatalf("%s: an object the retained manifest names was retired", when)

+ }

+ v, err := f.view("ie")(ctx, observe())

+ if err != nil {

+ t.Fatalf("%s: the source's view: %v", when, err)

+ }

+ if v.AuthoritativeRegion != "ie" || v.MarkerGeneration != "cur" || v.Marker != (park.Ref{Key: f.location + "/generation.json", VersionID: markerVer}) ||

+ !v.Pinned[park.Ref{Key: named, VersionID: old[named]}] || !v.Pinned[park.Ref{Key: snapKey, VersionID: snapshot}] {

+ t.Fatalf("%s: the source's view %+v", when, v)

+ }

+ targetView := func(when, want string) {

+ t.Helper()

+ if v, err := f.view("uk")(ctx, observe()); err != nil || v.AuthoritativeRegion != want {

+ t.Fatalf("%s: the target's view %+v, %v; want %s", when, v, err, want)

+ }

+ protectedOnSource("releasing")

+ targetView("releasing", "uk")

+ f.rec.Move.Rollback.TargetPhase, f.rec.Move.Rollback.Dirty = provision.RbTargetReleased, dirty

+ update(hostclaim.TargetReleased(vwMove, "uk-box", "uk", "stopped-target", hostclaim.ParkScope{Location: f.location, Incarnation: f.inc, EvidenceAt: evAt, RequestLimit: hostbox.RequestLimit},

+ func() string { seq++; return fmt.Sprintf("id%d", seq) }))

+ if op := observe().Claim.Op; op.Phase != hostclaim.PhaseReleased || op.Exec != "" {

+ t.Fatalf("the release: %+v", op)

+ }

+ protectedOnSource("released")

+ targetView("released", "uk")

+ // The source's return CAS.

+ update(hostclaim.ReturnToSource(vwMove, "ie-box", !dirty, hostclaim.ReturnFence{}))

+ if !dirty {

+ protectedOnSource("after the clean return")

+ targetView("after the clean return", "ie")

+ return

+ }

+ v, err := f.view("ie")(ctx, observe())

+ if err != nil || v.AuthoritativeRegion != "uk" || len(v.Pinned) != 0 || v.MarkerKnown {

+ t.Fatalf("after the dirty return the source's view %+v, %v", v, err)

+ }

+ targetView("after the dirty return", "uk")

+ if err := engine.Run(ctx, park.Work{Host: vwHost, ID: chore.ID, Op: vwMove}); err != nil && !errors.Is(err, park.ErrPending) {

+ t.Fatalf("the dirty return's park of the pre-move generation: %v", err)

+ }

+ for k := range old {

+ if _, ok := f.bucket.Current("data", k); ok {

+ t.Fatalf("%s was not parked after the dirty return", k)

+ }

+ })

+ }

// TestFilesLiveSetFollowsTheLiveChain (fix round 1, I2): with the marker

// lagging, park.protected treats the whole unfinished chain g3 -> g2 -> g1

// as live, and the view reads every one of those generations' manifests. An

diff --git a/internal/host/movessources.go b/internal/host/movessources.go

index 73c975bbc..7dcae6483 100644

--- a/internal/host/movessources.go

+++ b/internal/host/movessources.go

@@ -395,6 +395,12 @@ func readMarker(ctx context.Context, data genselect.Reader, bucket, host, locati

// the source's or the target's (a clean return's CAS names the source's

// generation again, a dirty return keeps the target's until the source's

// probe is admitted); no admission is the source's pre-move generation.

+// Seen from the source's own region, the source stays authoritative

+// while the target releases (releasing, released), until the source's

+// return (J2/F4, L18 finding 1: a clean return restores the source's

+// retained generation, so its files live set stays protected there).

+// A dirty return's install parks the pre-move generations (D6), so

+// from its return CAS on the newest admission decides again.

// For a move kind the record must carry the op's move, or have closed it

// (the record-first close, M4), when the newest admission decides alone. A

@@ -493,6 +499,21 @@ func movesAuthoritative(ctx context.Context, records MovesRecordReader, obs host

return "", err

}

if known {

+ returned := c.Op.Phase != hostclaim.PhaseReleasing && c.Op.Phase != hostclaim.PhaseReleased

+ if park.SameRegion(c.Op.Intent["home_region"], admitted, to) && park.SameRegion(c.Op.Intent["home_region"], region, from) && !returned {

+ // J2/F4 (Paul's #236 ruling; L18 finding 1): the

+ // newest admission is still the target's, but until

+ // the source takes the host back a clean return may

+ // name the source's retained generation again (a

+ // dirty release declared lost becomes clean,

+ // MoveRollbackLossCommitted), so seen from the

+ // source's region the source stays authoritative, as

+ // at landing before the commit. Once the return is

+ // written, a clean one is admitted in the source

+ // already, and a dirty one's install parks the

+ // pre-move generations (D6).

+ return from, nil

+ }

return admitted, nil

}

return from, nil