carlos / platform Public

P2 — Source files lose protection before rollback is ruled out. regionha_test.go:2141

The landing branch stops protecting the source region when the target’s admission changes holder.Gen. Admission does not commit the move; a clean rollback remains possible.

The reachable sequence is:

1. Use the new stopped-move witness’s setup: a source restart queues a generation park, while the older generation holds the keyed manifest.
2. Delay that park until the target probe is admitted, before commit. filesHome now returns false for the source, allowing the sibling to archive its manifest and referenced object.
3. Roll back cleanly. moves_test.go:1509 restores the source generation.
4. The unchanged-files publisher can skip republication at regionha_test.go:2014. A subsequent source failure leaves failover without the keyed manifest.

At a2ef0203, the region-blind chain lookup preserved that source manifest. This is a regression introduced by the regional restriction. It is established by static tracing, not an executed reproduction.

Fix: preserve the source rollback files and their references until rollback is ruled out. Add a witness that delays the queued park until after target admission, rolls back cleanly, then requires source-region failover to succeed.

The other answers to the brief:

• Original late-PUT defect: the region-qualified lookup addresses it, and the revised witness covers both the manifest and object.
• Phase table: “no home” for creating, deleting, parking and purging agrees with §5.1. Keeping the source region throughout relocation agrees with claim §6.2a’s unchanged-region rule, including pinning without an executor. The landing condition follows the table’s current-generation authority, but that alone does not preserve the files needed for rollback.
• Optional invariant: add independent preservation coverage, including rollback files. Keep the existing INV-3 scenarios as separate liveness evidence; their expected failure strings should not prevent a safety check. An invariant derived from the same filesHome predicate would miss this defect.
• J2/J3: unchanged by this fix.

git diff --check and package formatting passed. Go tests could not run because the sandbox refused creation of the build directory. The supplied sweep results and identity hashes remain independently unverified.

---

FIRST PROMPT: Review the J1 fix at dfab457c against the R2 brief and stage A fe144bab.

WHAT: Check J1 closure, phase semantics and regressions.

STATUS: Review complete; one P2 rollback-preservation finding.

NEEDED: Nothing from you.

RECOMMENDED: Preserve rollback files and add the post-admission rollback witness.

SESSION: Safe to close. No files changed or processes left running; the read-only workspace prevented saving a handoff file.

Verdict: J1 is not closed.