store: held-session op + O(1) named hold-slot reads

[gunbai-bot]

Summary

• Add local_store_held_session: acquire the family hold once, run many lookups and commits under LocalStoreFamilyHeld, release once. The admitted caller in this change is the wet inhabitance witness n_commits_under_one_held_session_acquire_the_hold_once_by_real_execution. The production consumer is gunbc#13482's typecheck store session, which lands next and is a declared frontier. local_store_commit is unchanged (still a per-commit bracket).
• Hold check and release use cas_verify_named_window_head (NamedWindowHeadCurrent | NamedWindowHeadMoved). G present and G+1 absent is the current-head proof because cas_reclaim_below sorts eligible generations and stops at the first Delete refusal. Named-window movement stays on windowed file-store assessment types (FileHoldWindowedReleaseAssessment / FileHoldWindowedRecoveryAssessment); std.durable_exclusive_hold and keep-all fabric/host consumers are byte-unchanged vs main. Acquire still lists.
• cas_observe_window is a fold over the cas_window_observation_attempts roster. Exhaustion is CasUnreadableObservationBoundExceeded { bound: count(roster) }, rendered unit-neutral as observation bound exceeded: N (pass count or fabric closure bound, never a generation). Named G with G+1 present is NamedWindowHeadMoved, not BoundExceeded.
• a_window_observation_at_generation_1500_terminates_by_real_execution is a termination regression control, not the hang's red. Against main's recursive cas_observe_window the two-file plant is GREEN (invocation 492a33d7-ff9a-4fcf-8007-4fd7029aa139): listed max 1501, successor absent, retry arm never runs. It does not reproduce hold-typed_module.1507/.1508.
• List-completeness frontier: if Filesystem.List on a live typecheck store persistently omits the true max, the bounded fold answers BoundExceeded and the store is Unavailable — a counted refusal, not a kill. Measured by gunbc#13482's real-route run after this lands.
• Leaked-hold after a clean release: a_hold_leaked_out_of_its_bracket_is_refused_as_stale_by_real_execution matches LocalStoreHoldNamedWindowHeadMoved.
• Integration claim a_leaked_hold_stays_stale_when_reclaim_cannot_remove_its_generation_by_real_execution (ioctl-IMMUTABLE pin + second acquire/release + leaked G) lives in its own BinWitnessWet file, dag/test/claim/materialization_store_local_immutable_pin_wet_witness_test.dag. No required CI lane executes it: a changed revision of it is counted DeclinedNoCiWetLane through the bounded edited_bin_witness_wet_rows_not_executed_by_ci population (it is declined before execution, not planned as a route gap). Cause: the CI wet runner lacks CAP_LINUX_IMMUTABLE. Non-CI receipt: BuildBuddy bbdf835a-b6fa-4a51-a93b-26b140398306 (independent deletes restored -> FAIL; stop-at-first-failure -> PASS). Restoration trigger: a wet lane that grants CAP_LINUX_IMMUTABLE, or a capability-free unlink-refusal construction. The required executing wall for the no-holes invariant remains reclaim_stops_before_a_later_generation_when_an_earlier_delete_fails_by_real_execution (ExpectedToHold on local_repo_wet_terminal).

Test plan

• n_commits_under_one_held_session_acquire_the_hold_once_by_real_execution (wet)
• gen-1500 termination control (GREEN on main recursive observe)
• leaked-hold NamedWindowHeadMoved after release
• ioctl leaked-hold integration: bbdf835a FAIL then PASS (not CI)
• floor / generated lanes on current head

[briansrls]

Blocking at exact requested head bfbcfe3.

The held-session bracket itself is coherent and the N-vs-2N wet control proves one acquire/release around N commits. The named-generation replacement is not a sound proof of the current windowed head, however.

cas_verify_named_window_head reports G as head when G is present and G+1 is absent. That is valid only if the remaining generation population is contiguous above every surviving old generation. cas_reclaim_below does not preserve that invariant: it attempts every eligible generation independently and can return CasReclamationIncomplete { removed, failed }, so an older generation may survive while a later eligible generation is removed. The hold acquire/release commits then inspect only file_compare_and_set_retained(...).outcome, discarding that reclamation result.

Concrete k=2 sequence:

1. A bracket acquires G, returns/leaks its LocalStoreFamilyHeld, then releases to G+1.
2. The next bracket acquires G+2. Its post-commit reclamation attempts G and G's deletion fails.
3. That bracket releases to G+3. Reclamation now attempts G and G+1 independently; G can fail again while G+1 succeeds.
4. The stale proof for G now observes G present and G+1 absent. The new named verifier reports ProbedHead { generation: G }; the old payload still names this process's owner, so local_store_hold_check can accept the stale proof and permit local_store_commit_under while the real slot head is G+3.

This regresses the existing construction and wet claim that a hold leaked out of its bracket is always refused as stale. It can re-authorize a superseded hold and break family exclusivity.

Required repair: either keep actual-head discovery for check/release, or establish a structural no-holes invariant before using the two-read proof (for example, reclamation must stop at the first failed generation in ascending order and never remove a later generation while an earlier one survives). Add a discriminating control that leaks G, advances through another acquire/release with partial reclamation leaving G present and G+1 absent, then requires the G proof to refuse and no object/index mutation to occur.

The exact-head CI and ordinary-path wet evidence are green, but the new control only measures acquire count under successful reclamation and does not exercise this failure state. Do not enqueue this revision.

[gunbai-bot]

review 77885 (claude/opus, dashboard artifact /api/reviews/77885/artifacts/stdout.log): both findings were already cut over on f209e9f.

• observe_file_hold_windowed and file_hold_release_assess_windowed are gone; check/release go only through *_windowed_at. Acquire still lists via file_hold_acquire_windowed because a reclaimed prefix is not a presence sequence from generation 1.
• observe_cas_slot_state_windowed_at no longer takes a window it does not read. file_hold_release_assess_windowed_at still takes window because that value is stored on the release plan as KeepGenerationWindow.

The open GitHub CHANGES_REQUESTED on named-window holes is a separate defect: addressed in 32a76a07d1 (cas_reclaim_below stops at the first failed generation in ascending order; wet reclaim_stops_before_a_later_generation_when_an_earlier_delete_fails_by_real_execution).

— sent from bright-dove-288

[gunbai-bot]

On the GitHub CHANGES_REQUESTED at bfbcfe (named-window holes): agreed. Independent reclaim could remove G+1 while G survived, so cas_verify_named_window_head would mint G as head.

32a76a07d1 changes cas_reclaim_below to delete eligible generations in ascending order and stop at the first host refusal, leaving later eligible generations in place. Named verify of a leaked G then sees G+1 still present and answers Unsettled rather than ProbedHead.

Discriminating wet control reclaim_stops_before_a_later_generation_when_an_earlier_delete_fails_by_real_execution plants G as a nonempty directory (unlink refuses) with G+1 a file, reclaims at head 4 / k=2, and requires G+1 still readable. Remote wet PASS (cpu=2ms, eval_steps=793). Please re-review that commit.

— sent from bright-dove-288

[gunbai-bot]

review 77956 (cursor/auto, dashboard artifact /api/reviews/77956/artifacts/stdout.log): the named-head hole is the same finding as the GitHub CHANGES_REQUESTED at bfbcfe. It was a real defect on that head; it is not still open at 28c4fc8155.

cas_reclaim_below no longer deletes eligible generations independently. It walks ascending min-generation and stops at the first Filesystem.Delete refusal (32a76a07d1, durable_cas_file_store.dag cas_reclaim_below / CasReclaimProgress). That keeps the surviving eligible prefix contiguous, so cas_verify_named_window_head (G present ∧ G+1 absent) cannot mint leaked G as head while a later generation is live.

Wet red controls, not the acquire-count row:

• store: reclaim_stops_before_a_later_generation_when_an_earlier_delete_fails_by_real_execution (G as nonempty dir, G+1 must still read present)
• inhabitance: a_leaked_hold_stays_stale_when_reclaim_cannot_remove_its_generation_by_real_execution (6a4621cb04) — pin leaked G with ext2 IMMUTABLE, run another bracket’s reclaim, local_store_commit_under the leaked session; expected occupancy_unavailable / stale, no object

a_hold_leaked_out_of_its_bracket_is_refused_as_stale_by_real_execution is still the successor-present stale case (G+1 remains). It is not this hole’s red.

DESIGN §3b’s listing sentence is the unknown-head window read (cas_observe_window / acquire / index). Check/release already name G (LocalStoreFamilyHeld.generation); they verify that name, they do not discover a head. The comment at materialization_store_local.dag that previously said the two-read “preserves the existing argument” without naming hole-freedom is restated at 28c4fc8155 to cite the reclaim stop.

— sent from bright-dove-288

[gunbai-bot]

review 77992 (claude/opus, dashboard artifact /api/reviews/77992/artifacts/stdout.log): agreed on the cost shape. cas_reclaim_below no longer min-and-filters remaining on every fold step.

054db538e1 sorts the eligible set once (sort_by on cas_generation_count) and walks that list, still stopping at the first Filesystem.Delete refusal. Same contiguous-prefix guarantee; cas_window_min_generation deleted as unused. The wet red reclaim_stops_before_a_later_generation_when_an_earlier_delete_fails_by_real_execution is unchanged.

— sent from bright-dove-288

[gunbai-bot]

review 77994 (claude/opus, dashboard artifact /api/reviews/77994/artifacts/stdout.log): agreed. typecheck_module_store_lookup and typecheck_module_store_commit_under were nicknames for unsealed functions.

d901050724 deletes them. The wet session witness now calls local_store_lookup / local_store_commit_under directly. typecheck_module_store_session stays as the admit_callers seal on local_store_held_session; neat-carp-75 remains the named frontier on that fold.

— sent from bright-dove-288

[briansrls]

Blocking at current head 2ecde15.

The original bfbcfe3 finding is closed. cas_reclaim_below now walks the eligible population in ascending generation order and stops at the first host deletion refusal, so the reclaimer cannot delete G+1 while a failed G remains. The leaked-hold wet control exercises the right end-to-end sequence and the revert discrimination is relevant.

One state-space defect remains in the bounded-observation recut. cas_observe_window now has a declared eight-pass observation budget and exhausts it as ProbedWindowHeadUnsettled, but cas_window_head_unsettled renders that as CasUnreadableReadRefused. No host read was refused. std.durable_compare_and_set already has the exact interface arm for this fact: CasUnreadableObservationBoundExceeded { bound }, whose documented meaning is that a realization ran out of head-discovery capacity while the slot may be well formed. This PR makes the file realization bounded again, so the standing comment that the file store cannot produce that arm is no longer true.

The current leaked-hold control compounds the mismatch: hold_refusal_is_named_window_unsettled parses the exact CasUnreadableReadRefused detail string and explicitly rejects CasUnreadableObservationBoundExceeded. That turns a typed fact back into prose and pins the wrong remedy.

Required repair:

1. General cas_observe_window exhaustion must produce CasUnreadableObservationBoundExceeded with the actual pass bound.
2. The named-generation G/G+1 verifier's successor-present case must be typed as a moved/stale named head, not a host read refusal. This can be a hold-private named-head verification outcome, or a properly modeled shared cause if it belongs at the CAS interface.
3. The wet control must match that typed arm, never its rendered sentence.
4. Keep one authority for the bound: derive the reported bound from the attempt roster (or derive the roster from the bound) rather than maintaining both literal 8 and [1..8].

The requested exact head 28c4fc8 closed the no-holes finding, but the branch advanced during review through 6b39172 and 2ecde15; this review is anchored to the queueable current head. CI status does not affect this modeling blocker.

[gunbai-bot]

review 78014 (claude/opus, dashboard artifact /api/reviews/78014/artifacts/stdout.log):

• Attempt bound: agreed. a7900ee995 deletes cas_window_observation_attempt_bound. ProbedWindowHeadUnsettled now reports count(cas_window_observation_attempts), the same roster the fold walks.
• Aliases: already gone at d901050724. This module is only typecheck_module_store_session, the admit_callers seal. Header no longer uses the neat-carp-75 nickname; the frontier trigger is the typecheck compile driver switching per-write local_store_commit brackets to this session. Inhabitance is already n_commits_under_one_held_session_acquire_the_hold_once_by_real_execution.

— sent from bright-dove-288

[briansrls]

Blocking at exact head 6b39172.

The original bfbcfe3 stale-hold defect is closed. Reclaim now walks eligible generations in ascending order and stops at the first failed delete, so it cannot remove G+1 while G survives. The strengthened wet control is also better: it requires the leaked hold to fail specifically through the named-window successor-present path, not through any generic stale/refusal route.

One modeling blocker remains in that exact assertion. cas_verify_named_window_head returns ProbedWindowHeadUnsettled { attempts: 1 } when G is present and G+1 is present. cas_probe_as_observation then maps that through cas_window_head_unsettled to CasUnreadableReadRefused { detail: ... }. No host read was refused. The observer established that the named generation is not the head because its successor exists.

The control now cements the conflation by parsing the exact CasUnreadableReadRefused sentence and explicitly rejecting CasUnreadableObservationBoundExceeded. That turns a state which already has typed vocabulary back into prose matching.

Required repair:

• The general eight-pass moving-head exhaustion must return CasUnreadableObservationBoundExceeded { bound }, with one authority for the bound and the attempt roster.
• The named G/G+1 verifier should return a typed named-head-moved/stale outcome (hold-private is sufficient) rather than a host read refusal.
• The leaked-hold red should match that constructor, not an error string.

The 28c4fc8 -> 6b39172 delta also includes the semantics-preserving one-sort/one-walk reclaim recut; I have no objection to that change. This review is anchored to 6b39172 as requested. Do not enqueue this exact head.

[gunbai-bot]

review 78014 (claude/opus, dashboard artifact /api/reviews/78022/artifacts/stdout.log): the session wrapper finding is noted and not applied on this head.

typecheck_module_store_session is a pass-through. Lookup/commit aliases are already gone (d901050724). The remaining function exists so local_store_held_session admit_callers names gunbc.typecheck_module_store rather than the wet witness — that was the original held-session brief (seal to the typecheck store module). Production still writes through local_store_commit; the frontier comment names a driver cutover that is not in this PR.

Side-chat freeze (royal-moth-86): no more pushes on #13569 until a relayed verdict. Cutting the typecheck driver over here, or dropping the module and sealing the witness alone, both move HEAD. Not doing either until that verdict.

— sent from bright-dove-288

[briansrls]

Blocking at exact head 1d8f95b.

The prior finding is closed on the intended mutation path: window exhaustion is CasUnreadableObservationBoundExceeded from count(cas_window_observation_attempts); named G with G+1 present becomes ProbedNamedWindowHeadMoved, observe_file_hold_windowed_at projects it to HoldNamedWindowHeadMoved, and local_store_hold_check refuses it as stale. The no-hole reclaim and leaked-hold red remain sound.

Two related representation defects remain.

1. HoldNamedWindowHeadMoved carries the stale named generation G, but the generic protocol maps it to refusals that claim G was the OTHER observed generation:

• durable_hold_release_assess -> HoldReleaseAgainstAnotherGeneration { acquired: acquired_generation, observed: g }
• durable_hold_recovery_assess -> HoldRecoverySlotMoved { reported: report.generation, observed: g }

On the real path acquired/report.generation == g, so the receipt says “another generation” while carrying acquired=observed. The verifier established only “a successor of G exists”; it did not observe the current head. Preserve that fact with dedicated moved-beyond-named-generation release/recovery refusals, or carry the actually observed successor as a lower-bound fact. Do not populate an exact-current-generation field with G.

2. The named-moved result is not actually private. ProbedNamedWindowHeadMoved is added to the general CasSlotProbe union, and the still-present observe_cas_slot_state_windowed_at plus cas_probe_as_observation / cas_compare_and_set_outcome / cas_owner_only_failed_publication map it back to CasUnreadableObservationBoundExceeded { bound: 1 }. Thus the same established fact has two projections: the desired HoldNamedWindowHeadMoved route and the old wrong BoundExceeded route. The current hold caller chooses the first, but the second remains writable and observe_cas_slot_state_windowed_at is now a dead second entry point admitted to that caller.

The clean recut is a realization-private named-window verification type, e.g. NamedWindowHeadCurrent { observation } | NamedWindowHeadMoved { named_generation }, consumed directly by local_store_hold_check and file_hold_release_assess_windowed_at. Then DurableHoldObservation and CasSlotProbe do not grow impossible arms, unrelated keep-all hold consumers do not owe matches, and the generic CAS projection cannot misclassify the fact. Alternatively make it an honestly shared interface fact with dedicated, semantically correct release/recovery refusals and delete every BoundExceeded projection of it.

Add controls that (a) the moved release/recovery receipt cannot carry equal acquired/reported and observed generations under an “another generation” constructor, and (b) named-head movement has no route to CasUnreadableObservationBoundExceeded.

The PR body/helper name still say named-window “Unsettled”; recut them to “Moved” with the representation fix. No objection remains to the held-session acquire count, ordered stop-on-first-failure reclaim, bounded general observation, alias deletion, or gen-1500 evidence description.

[gunbai-bot]

review 78038: both findings fixed at 662ca06 (BoundExceeded fork at b99601f; dangling observe deleted there too).

1. ProbedNamedWindowHeadMoved is gone from CasSlotProbe. Named verify returns CasNamedWindowVerify (NamedWindowVerified | NamedWindowHeadMoved). cas_probe_as_observation / write-path matches have no BoundExceeded { bound: 1 } of a moved head. Hold maps NamedWindowHeadMoved to HoldNamedWindowHeadMoved only.

2. observe_cas_slot_state_windowed_at is deleted. Its only listed caller never called it. Seal fixture now refuses a direct cas_verify_named_window_head (the remaining sealed producer, admitted only to observe_file_hold_windowed_at).

Also closed the GitHub REQUEST_CHANGES on 1d8f95b: release/recovery no longer stuff G into HoldReleaseAgainstAnotherGeneration / HoldRecoverySlotMoved as if G were the live head. Those are HoldReleaseNamedWindowHeadMoved / HoldRecoveryNamedWindowHeadMoved { named }. Controls: named_window_head_moved_release_does_not_claim_an_observed_current_generation, named_window_head_moved_recovery_does_not_claim_an_observed_current_generation. Wet helper renamed to hold_refusal_is_named_window_head_moved.

— sent from bright-dove-288

[gunbai-bot]

review 78060 both findings are in caae496:

1. Named-window head movement is off std.durable_exclusive_hold. HoldReleaseNamedWindowHeadMoved / HoldRecoveryNamedWindowHeadMoved are gone. Windowed named verify now returns WindowedHoldReleaseFromVerify / WindowedHoldRecoveryFromVerify, then FileHoldWindowedReleaseAssessment / FileHoldWindowedRecoveryAssessment in gunbc.durable_exclusive_hold_file_store. Keep-all FileHoldReleaseAssessment / FileHoldRecoveryAssessment and fabric/host matches are unchanged (no window-only arms). materialization_store_local is the consumer.

2. cas_unreadable_slot_detail now renders BoundExceeded as observation bound exceeded after N attempts, not as a generation. The witness pins bound 8.

Please dismiss the REQUEST_CHANGES reviews that were anchored to earlier heads once this one is checked.

[briansrls]

APPROVE at exact head e14bd75.

The three requested repairs are closed:

1. Named-window movement is now realization-private. The PR diff no longer touches std.durable_exclusive_hold, gunbc.fabric.fabric_control_plane, or gunbc.host.managed_host_unit_hold. CasNamedWindowVerify carries NamedWindowHeadCurrent | NamedWindowHeadMoved inside durable_cas_file_store; durable_exclusive_hold_file_store projects that into its own WindowedHoldRelease*/WindowedHoldRecovery* assessment families, and materialization_store_local is the production consumer. Keep-all protocol and consumers are unchanged.

2. CasUnreadableObservationBoundExceeded is again only observation-budget exhaustion. Its shared renderer is unit-neutral ("observation bound exceeded: N"), the interface authority names the file-window and fabric-closure producers and distinguishes named-head movement, and the witness pins bound 8. Named movement has no route back through CasSlotProbe or DurableHoldObservation.

3. The PR body now matches the source: the wet inhabitance witness is the currently admitted local_store_held_session caller; #13482 is the declared next production consumer; and the stale-hold discriminator is NamedWindowHeadMoved.

The prior no-holes construction remains: reclamation walks eligible generations in order and stops at the first delete refusal, and the leaked-hold control requires LocalStoreHoldNamedWindowHeadMoved before any object/index mutation.

No remaining code or modeling objection. Enqueue once the exact-head witnesses/check aggregate passes.

[gunbai-bot]

review 78073 (opus APPROVE): the NamedWindowHeadCurrent-on-unaddressable-key remark is left.

That path already fails closed: the observation is CasObservedUnreadable / LocalStoreHoldNotCurrent. A third CasNamedWindowVerify arm would be a second name for an observation the protocol already carries, and would spread matches through windowed release/recovery. Not worth a recut on an approve.

— sent from bright-dove-288

[briansrls]

Approved at exact head 3b015d6, conditional only on the exact-head required aggregate/witnesses passing before enqueue.

The three-commit recut is coherent:

1. The existing clean release-then-mutate control now matches the actual named-window result. Release publishes G+1 as the free successor, so verifying leaked G establishes NamedWindowHeadMoved rather than decoding the successor as LocalStoreHoldStale. The control still requires occupancy_unavailable, no object publication, and a miss on independent lookup.

2. The CAP_LINUX_IMMUTABLE integration claim is correctly removed from local_repo_wet ExpectedToHold. On that runner it was false by construction, not evidence against the implementation. Keeping the authored claim, enrolling its hermetic DirWithTemplate route gap, and naming both the cause and restoration trigger is an honest debt boundary rather than silent deletion or a weakened expectation.

3. The required no-holes wall remains executing and discriminating without that capability. reclaim_stops_before_a_later_generation_when_an_earlier_delete_fails_by_real_execution plants G as a nonempty directory, causes its delete to refuse, and requires G+1 to remain present. It is still ExpectedToHold on the local-repo wet lane. Together with the clean leaked-hold control, this proves the two construction steps the unavailable integration claim composes: reclaim cannot punch the G/G+1 hole, and a present G+1 prevents leaked G from mutating.

The BuildBuddy ioctl run is useful supplementary integration evidence, but landing does not depend on treating it as exact-head CI evidence; the exact-head required walls are the two controls above. No remaining code or DESIGN objection. Enqueue only after witnesses/aggregate are green.

[gunbai-bot]

review 78093 (cursor/auto APPROVE): nothing to apply.

The verdict names the construction already on 3b015d6 (named G/G+1 verify, no-hole reclaim, unit-neutral BoundExceeded, sealed held-session with inhabitance + named later consumer, ioctl claim as DirWithTemplate debt). No remaining remark.

— sent from bright-dove-288

[gunbai-bot]

review 78100 (cursor/auto REQUEST_CHANGES): not applied. Dropping the ioctl leaked-hold claim is the silent delete already reversed (42d93b7, then restore-and-declare).

The claim is not a grep standing in for a consumer. It is the leak → pin G → second acquire/release (the reclaim that used to punch G+1) → reuse G composition. reclaim_stops_before_a_later_generation_when_an_earlier_delete_fails_by_real_execution proves the unlink-refusal half; it does not run named verify of leaked G after that reclaim. Deleting this row removes the only executable form of that composition.

It is not ExpectedToHold on the CI wet lane (no CAP_LINUX_IMMUTABLE). Floor enrolls the same DirWithTemplate gap as its siblings. Cause and restoration trigger are on the chunk_09 module-item annotation (af71b94): a wet lane that grants the cap, or an unlink-refusal plant that needs none. Integration red/green is invocation bbdf835a (reclaim-stop reverted then restored). That is declared debt, not specification-without-execution and not a new ExpectedToHold.

— sent from bright-dove-288

[briansrls]

Approved at exact head af71b94.

The delta from the previously approved 3b015d6 is one commit touching only src/v2/workflow/floor_route_gap.dag. It moves the existing CAP_LINUX_IMMUTABLE debt annotation out of the Cons/list body and into the module-item comment block immediately above floor_route_gap_expectation_chunk_09. The FloorRouteGapExpectation row and all executable code are unchanged.

This is the correct DESIGN 4c repair for the native emitter refusal and does not reopen any prior modeling or evidence finding. Enqueue once exact-head witnesses and the required aggregate pass.

[gunbai-bot]

review 78118 (opus APPROVE): nothing to apply.

The pin claim's non-execution on CI is the DeclinedNoCiWetLane standing on d0f99d9, not leftover dangling code. Restoration stays a cap-granting wet lane or an unlink-refusal that needs none.

— sent from bright-dove-288

[gunbai-bot]

review 78122 (opus APPROVE): applied the attachment nit.

The bound comment after CasUnreadableSlot was a blank-separated block, so it attached to cas_unreadable_slot_detail. It now leads the type.

— sent from bright-dove-288

[gunbai-bot]

review 78124 (cursor/auto APPROVE): nothing to apply.

The verdict restates the construction already on this head. No remaining remark.

— sent from bright-dove-288

[briansrls]

Review-record blocker only at exact head 121565a; I found no remaining source-code objection.

The recut itself is coherent. The CAP_LINUX_IMMUTABLE composition moved intact into materialization_store_local_immutable_pin_wet_witness_test.dag; that file has an exact BinWitnessWet exclusion row, its basename is added to edited_bin_witness_wet_rows_not_executed_by_ci_population, and the claim is named in bin_witness_wet_entries. The old floor_route_gap enrollment is gone, so a change to this identity is now counted as DeclinedNoCiWetLane rather than planned without a terminal. The debt names the missing capability and the two restoration paths. The required no-holes wall reclaim_stops_before_a_later_generation_when_an_earlier_delete_fails_by_real_execution remains unchanged and ExpectedToHold, while the ordinary release-then-reuse control remains on the executing materialization-store wet file. The chunk-09 closer and the CasUnreadableSlot comment placement are also correct.

The PR body still states the superseded opposite construction: “Enrolled as the hermetic DirWithTemplate gap (floor_route_gap).” A route-gap row means the required floor plans and executes the identity, then accepts a typed host-effect refusal; DeclinedNoCiWetLane suppresses it before execution under a declared no-CI cadence. Those are materially different standings and this PR changed specifically because the first one could not discharge the changed-witness obligation.

Please recut that bullet to say: the claim lives in its own BinWitnessWet file; changed revisions are DeclinedNoCiWetLane through the bounded edited_bin_witness_wet_rows_not_executed_by_ci population; no required CI lane executes it; bbdf835a is the non-CI revert-red/fixed-green receipt; restoration is a lane with CAP_LINUX_IMMUTABLE or a capability-free unlink-refusal construction; and reclaim_stops... remains the required executing wall. No source-head move is needed. Once the description matches the landed authority, this exact code head is approvable.

[briansrls]

Approved at exact head 121565a. The PR body now matches the reviewed construction: the immutable-pin integration claim is isolated in its own BinWitnessWet file; changed revisions are counted DeclinedNoCiWetLane through the bounded edited_bin_witness_wet_rows_not_executed_by_ci population and are declined before execution, not treated as route gaps; no required CI lane is claimed to execute it; the BuildBuddy revert-red/fixed-green receipt is identified as non-CI evidence; both restoration routes are named; and reclaim_stops_before_a_later_generation_when_an_earlier_delete_fails_by_real_execution remains the required executing no-holes wall. No source-head move and no remaining objection. Enqueue once exact-head required checks pass.

[gunbai-bot]

Superseded by #13641 at 634453d: this PR's head is an ancestor of integration/v1-closeout. The source branch is kept for archaeology; this PR is no longer an independent merge authority. — sent from neat-wolf-604