carlos / platform Public

Four P2 findings. The L18 joint round does not pass. Reviewed model 295f31a6 against built HEAD 596fa8b1. No P1 finding established.

1. P2 — J2 loses source-region files protection during rollback. In movessources.go:491, restoring uses the newest admission’s region. After target admission and before a clean return, that is the target. The source’s park view consequently skips its marker and files pins.

A pending source-generation park can then retire objects its retained manifest still references, before clean rollback restores that source generation. The model explicitly protects the source throughout restoring at regionha_test.go:2156.

Preserve source protection through this interval and test the pending-park interleaving. This is a latent retirement defect: current production park providers refuse behind the missing Plan 12 integration; destructive production execution was not established.

1. P2 — The model omits the built completion protocol. regionha_test.go:1329 opens the row while the probe remains running. Then moves_test.go:1402 replaces the operation with serving, retaining no completion record.

The build instead requires probe-stop evidence, then C10 discharge → hold release → owned-fence lift → completion mark, followed by N6’s separate serving wake. See relocationowners.go:425.

The model therefore cannot exercise failed discharge, failed mark, another owner’s fence, successor moves/relocations blocked by unfinished completion, or recovery with region HA off under ruling 82. These need modeled states and crash/refusal witnesses; implementation tests alone do not satisfy this joint-round requirement.

1. P2 — Task 10b can miss the source hold until park-local removes the row. reconcile.go:138 only reaches the relocation hold path while the claim is relocating.

Once drain gates are satisfied, this schedule is possible: the source releases and closes its fence; source reconciliation is delayed; the target completes; subsequent source reconciliation sees serving on another box and refuses, leaving the old ready row until park-local succeeds. Completion requires no source-hold acknowledgement. The existing test explicitly installs the hold before completion at relocationsourcehold_test.go:255.

The model hides this race by holding synchronously before release. Guarantee the hold during release or retain a catch-up hold path after completion. This is a routing/availability defect, not demonstrated simultaneous writing.

1. P2 — The model does not represent the current probe-refusal profile. regionha_test.go:1258 permits a live failed target to release and begin a nested relocation. Production rejects that release outside source releasing at relocationrelease.go:7, eventually reaching stuck.

Similarly, the model permits subsequent cold probe attempts. With C11 open, production refuses them before incrementing the attempt count at participant.go:257.

These are intentional C1/C11 fallbacks. Model them explicitly, including root-capability refusal without an attempt, no failed-target obligation, and deadline → stuck.

J3’s conversion primitive matches: it checks the committed record again inside the transition, refuses before commit, preserves the operation ID and obligations, and validates the target’s termination evidence. The verified @home mapping preserves region scope. M1/M2 remain documented cleanup limitations, not newly discovered findings.

The built release follows ruling 28’s stop → flush → recorded positions → root fence/drain order. The model holds earlier. Drains must remain off until C1/C4; the remaining activation record still applies.

Targeted Go tests in both worktrees were blocked by the read-only filesystem when creating build directories. Findings are static traces; both worktrees remain unchanged.

---

FIRST PROMPT: Follow the L18 final joint review brief against the specified model and built HEAD.

WHAT: Assess whether relocation may merge dormant.

STATUS: Review complete; four P2 findings remain.

NEEDED: Nothing for this review.

RECOMMENDED: Address the findings, update the model, and rerun the joint round and branch gate.

SESSION: Safe to close; no files changed or processes left running.

Verdict: relocation may not merge dormant on this evidence.