Desktop fs reads/writes don't participate in the encryption-migration admission lock (race window during disable/rotate)

[qnbs]

CURRENT CONTROL-PLANE CHECKPOINT — 2026-10-04 — TERMINAL VIA GATE 4B

ISSUE = #360
CURRENT_MAIN = 9cb74b5c1e16722b4eaee6051ab9b1f6fe0ae56a
STATUS = COMPLETED
FOUNDATION = PR #951
READ_SNAPSHOT_CLOSURE = PR #953
MUTATION_ROOT_RECOVERY_LIFECYCLE = PR #954
PR_954_RESULTING_MAIN = c3afd2b96f20428ae6ebaaa974fd69d1ffc53064
EVIDENCE = docs/native/r15/GATE4B-OPERATION-EVIDENCE.md
EVIDENCE_SCOPE = "This slice is headless Core operation integration for #360"
UNIFIED_CROSS_PROCESS_ADMISSION = IMPLEMENTED
PROTECTED_READ_WRITE_ADMISSION = IMPLEMENTED
LOCK_UNLOCK_SHUTDOWN_INTEGRATION = IMPLEMENTED
RESULTING_MAIN_PROOF = TERMINAL
CURRENT_R15_OWNER = Gate 4D / #359 / QNB-11
PRODUCTION_AUTHORITY_SWITCH_ALLOWED = NO

The historical fs read/write migration-admission race is closed by the terminal renderer-neutral Gate-4B operation integration. No further #360 implementation remains.

---

HISTORICAL / SUPERSEDED — Successor A exact-head checkpoint — PR #953 — 2026-10-03

PR = #953
HEAD = e9bd7556ab0f8111f843b78038fa56078792a097
BASE = 3cd2b6a37ab8b5bbe8abe32830cd8170b0c9d052
FILES = 15
COMMITS = 3 signed
MEANINGFUL_LINES = 1870
PR_952 = OPEN / DRAFT / frozen provenance
CODEQL = SUCCESS
CHANGELOG/TEXT GUARDS = SUCCESS
CODEANT = all gates SUCCESS
CI_CD = IN_PROGRESS; all Rust/Node/platform/signature/security/build jobs green, E2E/VRT downstream still running
VERCEL = SUCCESS exact head
CODEX_EXACT_HEAD = one new P2 race remains open
MERGE_READY = NO
PRODUCTION_AUTHORITY_SWITCH_ALLOWED = NO

The Terra/Codex closure commit e9bd7556... is now on the remote despite the executor's final report having observed a delayed remote ref. The earlier transport blocker is therefore RESOLVED / transient.

The three P2s from 12cf7833... are implemented and their threads are now resolved:

• steady-state validated same-key external forward rebind;
• lifetime-contract cross-process barrier wording;
• admitted snapshot-backed catalog enumeration with raw production list/load paths gated away.

Fresh exact-head Codex review on e9bd7556... found one additional VALID same-slice blocker: a mid-capture TOCTOU can occur when provider.state() observes the old runtime as Unlocked, another process commits root N+1, then the subsequent anchor read sees N+1. Current code publishes N+1 into AuthorityCell.current before proving the provider is bound to N+1; resolve_ref then returns Locked, and future retry cannot take the strict-forward rebind path because N+1 has already poisoned current.

Required invariant for closure: never publish a newer snapshot into current before provider/key usability for that exact anchor is established. Prefer rebinding/validation before publication, or otherwise restore/retain the previous snapshot on resolution failure. Preserve explicit-lock, route-change/rotation, rollback, same-generation mismatch and incompatible-authority refusals.

This is still Read/Snapshot scope, but anti-cascade remains binding. One surgical race fix with a deterministic mid-capture regression is admissible; if it needs broad provider redesign or another architectural expansion, stop/split rather than cascade.

The new CodeScene Large Method warning on the 134-line cross-process integration test is non-material and resolved by evidence; no suppression or proof weakening.

Resource horizon remains unchanged: after #953 protected merge + exact resulting-main CI/CD/CodeQL/Vercel Production + cleanup/retention, executor reports and STOPs. No successor B or 4C.

---

CURRENT EXECUTION MODE — 2026-10-03 — RESOURCE-BOUNDED GATE 4B SPLIT

CURRENT_MAIN = 3cd2b6a37ab8b5bbe8abe32830cd8170b0c9d052
PR_952 = OPEN / DRAFT / FROZEN PROVENANCE
PR_952_HEAD = e34aae28bba31269a814a9a2778346e568c3577e
PR_952_BUDGET = 16 files / 3000 meaningful lines / 5 signed commits
PR_952_MERGE = FORBIDDEN — validated prepared-root recovery gap remains
GATE_4B_SPLIT = ADMITTED
SUCCESSOR_A = Read/Snapshot Admission Closure
SUCCESSOR_B = Mutation/Root-Recovery/Lifecycle Closure
CURRENT_AGENT_HORIZON = SUCCESSOR_A ONLY → merge → exact resulting-main proof → cleanup/retention → STOP
CONTROL_PLANE_WRITES = ChatGPT session only; coding agent read-only except successor-PR operations
4C = PENDING
4D = PENDING via WorldScript-Studio#359 / QNB-11
4E = PENDING
RELEASE_READY = NO
PRODUCTION_AUTHORITY_SWITCH_ALLOWED = NO

Anti-cascade/resource decision: PR #952 is no longer a correction target. It is the immutable reviewed extraction source. The current coding-agent run is deliberately bounded to the first successor PR only and must stop after its normal protected merge, exact resulting-main CI/CD + CodeQL + Vercel Production verification, worktree/branch cleanup, and safe Vercel retention. It must not start successor B or 4C in the same execution epoch.

Control-plane ownership is also split deliberately: GitHub issue, Linear, milestone, release-program and checkpoint curation is performed from the ChatGPT control-plane session; the coding agent should only read those records when needed and should not spend token/week quota duplicating status maintenance.

The prepared-root Step-F coordinator-recovery Critical is Gate 4B successor-B scope, not Gate 4D. Gate 4D remains crash-resumable rotation/rekey after 4B and 4C. #360/QNB-12 remains open until complete Gate 4B closure.

---

CURRENT R-15 CHECKPOINT — PR 952 / e34aae2 — recovery finding blocks merge

CURRENT_MAIN = 3cd2b6a37ab8b5bbe8abe32830cd8170b0c9d052
4A = TERMINAL via 950
4B_FOUNDATION = TERMINAL via 951
4B_INTEGRATION = ACTIVE / PR 952
PR_952_HEAD = e34aae28bba31269a814a9a2778346e568c3577e
PR_BUDGET = 16 files / 3000 meaningful lines / 5 signed commits
CODEQL = 37132489430 SUCCESS
CI_CD = 37132489420 SUCCESS — all required exact-head jobs terminal green
VERCEL_PREVIEW = dpl_FBpTZftnpnum9ZahLkPCeMfAWUtz READY exact head
CODEX = exact e34aae28 review reports no major issue
CODERABBIT = current incremental review 401b81b8 to e34aae28 complete / no actionable finding
CODEANT_QUALITY_SCR = FAILURE — valid material recovery finding is not dismissed
CODEANT = fresh full review completed; validated prepared-root recovery gap remains OPEN
MERGE_READY = NO
GH_360 = OPEN / QNB-12 In Progress
GATE_4 = ACTIVE / QNB-168 In Progress / M3 Active
4C = PENDING
4D = PENDING via 359 / QNB-11
4E = PENDING
RELEASE_READY = NO
PRODUCTION_AUTHORITY_SWITCH_ALLOWED = NO

The minimal stale-CAS correction is signed/pushed and locally verified: success and reconciled stale CAS clear the local mutation latch only after physical/writer/admission revalidation; all uncertain errors remain fail-closed. Normal Git transport works; no sandbox/protection/signing bypass occurred.

New material finding: after an injected step-F COMMIT failure, the public coordinator reconciliation returns PreparationPending even when the provider fault is removed. Existing authenticated recover_root is not integrated into the provider-owning coordinator operation API. Lock/shutdown correctly refuse, but same-instance recovery is incomplete. Diagnostic proof is retained locally; temporary probes were removed from source. Do not merge or close 360/QNB-12 until this is fixed with fault proof and fresh exact-head convergence.

No-op RootBusy is separately proved retryable after contention release; its conservative latch is not the prepared-root recovery defect. Remaining DeepSource Rust / CodeScene reds are understood test-only advisory findings, not green. No 4C journal, 4D rekey, collector, deletion, current-app authority change or Gate-7 switch was introduced. At saturated budget, establish a bounded mutation/root-recovery/lifecycle proof slice rather than expand or delete meaningful safety evidence.

HISTORICAL / SUPERSEDED — prior Gate-4B foundation checkpoint

CURRENT R-15 CHECKPOINT — 2026-10-03 — GATE 4B FOUNDATION TERMINAL VIA #951

CURRENT_MAIN = 3cd2b6a37ab8b5bbe8abe32830cd8170b0c9d052
RESULTING_MAIN_VERIFICATION = TERMINAL
4A = TERMINAL via #950
4B_FOUNDATION = TERMINAL via #951
PR_951_FINAL_HEAD = d3c87fe675300b2d29e797625b192516a94fd191
PR_951_MERGED_AT = 2026-10-03T04:51:40Z
RESULTING_MAIN_CI_CD = 37097936085 SUCCESS
RESULTING_MAIN_CODEQL = 37097936105 SUCCESS
VERCEL_PRODUCTION = dpl_9W7p2XZ4dscci5d2sXasPHK7iibz READY / PROMOTED exact CURRENT_MAIN / HTTP 200
HOUSEKEEPING = COMPLETE — clean local main; merged branch/tracking ref removed; other worktrees preserved
RETENTION = COMPLETE — 3 stale predecessor previews deleted; all 15 protected IDs and alias bindings verified
4B_OVERALL = ACTIVE / #360 / QNB-12
4B_INTEGRATION = NEXT — protected operation / authority-key / snapshot / lifecycle integration
GH_360 = OPEN until complete 4B acceptance
4C = PENDING / authenticated journal + paged manifest
4D = PENDING / #359 / QNB-11 / rekey + key-epoch crash window
4E = PENDING / first enable + disable refusal + Gate 4 closure
GATE_4 = ACTIVE
RELEASE_READY = NO
PRODUCTION_AUTHORITY_SWITCH_ALLOWED = NO

All resulting-main CI/CD jobs succeeded, including Security Audit, Verified Signatures, Node 22/24, Core/Tauri Rust, Linux/macOS/Windows platform evidence, Build, Playwright, Deep Coverage, Storybook, Browser Quality, CI Success and Pages. Final-head CodeRabbit/CodeAnt/Codex review converged with no actionable finding and no unresolved thread. The two DeepSource test false positives remain evidence-dispositioned advisory red, not green; unavailable reviewer quotas remain recorded.

This terminal checkpoint is for the kernel admission foundation only. It does not complete issue 360, Gate 4B overall, Gate 4 or production Core authority. The next bounded engineering owner remains 4B integration, not 4C.

HISTORICAL / SUPERSEDED — #951 merged, post-merge proof was pending

CURRENT_MAIN = 3cd2b6a37ab8b5bbe8abe32830cd8170b0c9d052
LAST_VERIFIED_MAIN = 4f33d7786076c1d00e73d5db9c527fbd1ea31693
4A = TERMINAL via #950
4B = ACTIVE / #360 / QNB-12
4B_FOUNDATION_PR = #951 MERGED at 2026-10-03T04:51:40Z
PR_951_FINAL_HEAD = d3c87fe675300b2d29e797625b192516a94fd191
4B_FOUNDATION_TERMINAL = NO — resulting-main + Production + housekeeping pending
RESULTING_MAIN_CI_CD = 37097936085 IN_PROGRESS
RESULTING_MAIN_CODEQL = 37097936105 IN_PROGRESS
VERCEL_PRODUCTION_EXACT_CURRENT_MAIN = PENDING VERIFICATION
GH_360 = OPEN until complete 4B integration acceptance
NEXT_ENGINEERING = 4B protected-operation integration, only after foundation terminal proof
4C = PENDING / journal + paged manifest
4D = PENDING / #359 / QNB-11 / rekey + key-epoch crash window
4E = PENDING / first enable + disable refusal + Gate 4 closure
GATE_4 = ACTIVE
RELEASE_READY = NO
PRODUCTION_AUTHORITY_SWITCH_ALLOWED = NO

Final-head CI/CD and CodeQL succeeded; CodeRabbit, CodeAnt and Codex reviewed the final delta/head without remaining actionable findings. All review threads are resolved. The two DeepSource test findings remain evidence-dispositioned advisory false positives, not a green status; quotas are recorded as unavailable. The normal protected squash merge did not close #360 or switch production Core authority. No next semantic slice or retention deletion starts before the exact resulting-main gate.

HISTORICAL / SUPERSEDED — pre-merge #951 checkpoint

CURRENT_MAIN = 4f33d7786076c1d00e73d5db9c527fbd1ea31693
GATE_3 = TERMINAL via #949
GATE_4 = ACTIVE via #922
4A = TERMINAL via #950
PR_950_FINAL_HEAD = f2dde0e65bb4dacfd6753f16a6bce1e28bf13078
RESULTING_MAIN_CI_CD = 36994420903 SUCCESS
RESULTING_MAIN_CODEQL = 36994420828 SUCCESS
VERCEL_PRODUCTION = dpl_7Z1r45ckAp4YeYpdHWtHdzQ8BWNN READY exact CURRENT_MAIN
4B = ACTIVE / #360 / QNB-12 / PR #951 kernel admission foundation; protected-operation integration follows
PR_951_HEAD = d3c87fe675300b2d29e797625b192516a94fd191
PR_951_STATUS = OPEN / exact-head CI and review pending / not terminal
GH_360 = OPEN until full 4B acceptance
4C = PENDING / journal + paged manifest
4D = PENDING / #359 / QNB-11 / rekey + key-epoch crash window
4E = PENDING / first enable + disable refusal + Gate 4 closure
NEXT = 4B → 4C → 4D → 4E → Gate 5 → Gate 6 → explicit Gate 7 authorization
PRE_GATE_7_RESIDUAL = #948
RELEASE_READY = NO
PRODUCTION_AUTHORITY_SWITCH_ALLOWED = NO

Live reconciliation confirms Gate 4A terminal, including exact resulting-main CI/CD, CodeQL and Production evidence. Gate 4B is the current renderer-neutral admission/fencing owner. Historical legacy filesystem defects remain provenance; this checkpoint does not claim a production authority switch or Gate 4 closure.

HISTORICAL / SUPERSEDED — CURRENT R-15 RECONCILIATION — 2026-10-02 — superseded by verified Gate 4A terminal checkpoint

• OWNER = Gate 4 / security(core/R-15): Gate 4 — journal, admission, rekey/recovery and cross-process serialization #922
• Gate 3 predecessor = TERMINAL via feat(core): close R-15 Gate 3 with its evidence matrix and residual owners (#445) #949
• Gate 4 active = slice 4A / PR feat(core): serialize every root commit through a cross-process root_commit_mutex (#445) #950
• This issue's closure slice = 4B unified admission gate
• Immediate predecessor = 4A root_commit_mutex terminal
• Required closure = coherent read/write/migration admission + cross-process fencing
• PRODUCTION_AUTHORITY_SWITCH_ALLOWED = NO

#360 is no longer blocked on Gate 3. It remains open and is the next semantic closure owner after Gate 4A becomes terminal.

HISTORICAL / SUPERSEDED — CURRENT R-15 RECONCILIATION — 2026-10-01 — superseded 2026-10-02

OWNER = Gate 4 / #922
PREDECESSOR = Gate 3 terminal
REQUIRED_FIX = coherent read/write/migration admission + cross-process serialization
PRODUCTION_AUTHORITY_SWITCH_ALLOWED = NO

The historical Tauri race below remains valid provenance, but the implementation destination is now renderer-neutral Gate 4. Do not fix it with a renderer-private lock that the Core production authority could later bypass.

---

Summary

services/fs/fsCore.ts's protectTextValue()/unprotectTextValue() (and, transitively, every fs-store save/load) resolve the active key and encrypt/decrypt purely via resolveProtectedWriteKey() — they never take the same admission lock the IndexedDB path uses (withProtectedWriteAdmission() / assertNoActiveEncryptionMigration(), see docs/IDB-ENCRYPTION.md). Concretely:

1. Writes during a disable/rotate migration. services/fs/fsEncryptionMigration.ts#migrateAllProtectedFsData re-keys/decrypts every fs-backed file directly, with no lock held against ordinary saves. A normal autosave (project/settings) that resolves its key concurrently with the migration can write a file encrypted under the old key (or plaintext, for disable) after the bridge has already converged that same file, and after clearIdbPassphrase()/rotateIdbPassphrase() swaps or discards the old key — leaving that one file stranded under a key nothing can derive anymore.
2. Reads during a migration. Similarly, unprotectTextValue() doesn't check assertNoActiveEncryptionMigration() before decrypting, so a read racing a migration isn't guaranteed to see a consistent state.
3. Legacy plaintext content ignores the lock policy. When encryption is configured but the session is currently locked, unprotectTextValue() only fails closed for values that parse as a protected-v1 envelope — a value that's still in its pre-migration plaintext form (opportunistic/lazy migration by design, see fsCore.ts's "Protected text files" section) is returned as-is, bypassing the lock gate entirely for any file that hasn't been touched by a save (or the bridge) since encryption was enabled.

Why this wasn't fixed inline

The services/fs/fsEncryptionMigration.ts bridge (built to fix the more severe "disable/rotate strands fs data outright" bug) already substantially narrows the window this issue describes, and per-file read/write failures during migration are now safely skipped (non-strict) or aborted (strict) rather than silently succeeding into a bad state. But it does not prevent the race — it just makes the failure mode of hitting it less catastrophic (a stranded file becomes detectable as "temporarily unreadable" rather than crashing or silently corrupting).

Fixing this properly means giving the fs path the same Web Locks–based admission control the IDB path has (services/storage/storageEncryptionService.ts#withProtectedWriteAdmission), or coordinating both under one shared admission mechanism — a real architectural addition, not a one-line fix, and one best done alongside (or as part of) the resumable-migration work already tracked in #359, since both are about making the fs migration bridge a first-class citizen of the same lifecycle machinery the IDB path already has.

Real fix

• protectTextValue() should call the fs equivalent of assertIdbProtectedWriteAllowed() (or take a shared-mode admission) before resolving a key and encrypting.
• unprotectTextValue() should call assertSecureStorageReadable() (or equivalent) before returning any content — including a value that isn't (yet) a protected envelope — whenever encryption is configured, so a locked session fails closed uniformly regardless of a given file's migration status.
• migrateAllProtectedFsData() should hold the exclusive-mode admission across its whole run, matching how the IDB migration orchestrator already holds it.

Found via

Surfaced during the PR #356 (fix/desktop-project-data-encryption) review-correction loop — codeant-ai, qodo-code-review, and chatgpt-codex-connector independently flagged variants of this same gap (2026-08-13).

Related: #359 (fs migration bridge crash-resumability — same root cause, different symptom).

[qnbs]

Live status audit against main 34b83a22: there is no active encrypted-FS read/write migration bridge on current main; the project FS path is plaintext and the only implemented admission machinery is for protected IndexedDB stores (services/storage/protectedWriteAdmission.ts). The original race scenario is therefore not a currently active encrypted-FS regression, but the requested cross-store admission contract remains OPEN for the future renderer-neutral R-15 storage design. Closure requires ordinary FS reads/writes and migration/disable/rekey operations to share an atomic admission protocol, with locked legacy/plaintext behavior explicitly covered.

[qnbs]

R-15 / Rev-3 architecture reconciliation — 2026-08-24

The race described here remains a real security/data-integrity invariant, but its durable target is now #445/R-15 Core migration admission, not a second Tauri/filesystem-specific lock authority.

Existing seed to preserve

services/storage/protectedWriteAdmission.ts already demonstrates the required shared/exclusive admission semantics for browser/IDB encryption migration. Treat it as a proven semantic seed, not as a module Qt/native must literally reuse.

Native target

R-15 must define one coherent native admission model covering:

• ordinary protected reads;
• ordinary protected writes/autosaves;
• plaintext→protected migration;
• enable/disable transitions;
• key rotation/rekey;
• cancellation/shutdown;
• recovery/resume.

Renderers must not be able to bypass it.

Locked/legacy plaintext rule

The original issue's fail-closed requirement remains binding: when protection policy says a session/record is not readable, legacy plaintext must not become an accidental bypass simply because it has not yet been migrated.

Avoid false cross-platform symmetry

Browser Web Locks are a PWA implementation primitive. Native Core may use different synchronization mechanisms while preserving the same admission invariant and typed behavior.

Closure rule

Close only when #445 maps these race scenarios to Core implementation plus concurrent read/write/migration negative tests and packaged evidence where required.

[qnbs]

Queue / execution status — 2026-09-05

Priority: P0 as an R-15 acceptance requirement. Canonical implementation owner: #445.

This issue preserves the migration-admission invariant: ordinary reads/writes must not race an exclusive encryption migration/rekey into an obsolete or inconsistent key epoch, and legacy plaintext must not bypass the secure-storage readability policy.

Do not build a second Tauri-only/Web-Locks authority to close this ticket. #445's renderer-neutral Core design must own the authoritative admission semantics; renderer/browser coordination may adapt to it but may not weaken it.

Close #360 only when #445 has explicit concurrency/race evidence proving reads, writes, autosave and migration share one coherent admission model.

[qnbs]

2026-09-24 curation checkpoint

Still OPEN as an R-15/#445 acceptance/provenance child. Do not add an independent renderer-specific admission authority just to close this issue.

#553 has been reopened after an incorrect merge-time closure, so #445's implementation admission must be recomputed against the live ledger. When R-15 implementation is admitted, ordinary protected reads/writes and migration must converge under the canonical Core admission model; close this issue only with explicit evidence that the stated race/legacy-plaintext bypass classes are structurally impossible.

[qnbs]

R-15 / v1.30.0 sequencing update — 2026-10-01

This P0 is now a direct closure input to Gate 4 owner #922 under #445 / release #926.

Gate 4 owns one coherent admission/fencing model for ordinary reads/writes, autosave, rekey and migration, plus cross-process serialization. The original race window in this issue must be proven impossible by that shared authority.

Do not add a parallel Web Locks-only desktop authority merely to close the historical issue. Close #360 from Gate 4 evidence once all relevant writers/readers participate in the admitted model.

[qnbs]

Sequencing, 2026-10-02. Gate 4A (#950, the cross-process root_commit_mutex) is terminal on main 4f33d778. This issue is the semantic owner of the next slice, Gate 4B (the unified admission gate, contract §11), which covers:

• shared and exclusive admission;
• lock/unlock drain;
• shutdown;
• no write into an obsolete epoch;
• no plaintext legacy read bypass.

4B has not been started. It resumes no earlier than 2026-10-06 00:00 Europe/Berlin.

[qnbs]

Gate 4B integration — live exact-head checkpoint

PR = #952
HEAD = 401b81b8be2d4fc0f007d1e043e9aae36f52b119
BASE / CURRENT_MAIN = 3cd2b6a37ab8b5bbe8abe32830cd8170b0c9d052
PR_STATE = OPEN / MERGEABLE / NOT MERGE_READY
PR_SIZE = 16 files / 2853 meaningful lines / 3 commits
CI_CD = 37115923615 SUCCESS
CODEQL = 37115923652 SUCCESS
CORE_RUST = SUCCESS
TAURI_RUST = SUCCESS
NODE_22_24 = SUCCESS
PLATFORM_LINUX_MACOS_WINDOWS = SUCCESS
SECURITY_AUDIT = SUCCESS
VERIFIED_SIGNATURES = SUCCESS
CI_SUCCESS_AGGREGATOR = SUCCESS
VERCEL_PREVIEW = dpl_GcxxZ4ZWbSxJUYFyyEMYww6y53vA READY exact HEAD
VERCEL_PRODUCTION = dpl_9W7p2XZ4dscci5d2sXasPHK7iibz READY exact CURRENT_MAIN
CODESCENE = RED — remaining findings are test-maintainability metrics; production findings improved
DEEPSOURCE_RUST = RED / advisory; current test findings evidence-dispositioned
MERGE_READY = NO
PRODUCTION_AUTHORITY_SWITCH_ALLOWED = NO

The first correction wave fixed the original macOS failure and the prior CodeAnt/Codex/CodeRabbit clusters. Fresh exact-head review found a narrower second wave:

• VALID: retained-epoch transient read errors must preserve undecided Io semantics instead of reporting authenticated corruption/recovery.
• VALID: reject the reserved <installation>/ordinary-writers root collision centrally before snapshot/provider/key observation on every operation path.
• VALID: failed unlock must retain the exclusive guard across panic/unwind; do not take() the stored guard before verification succeeds.
• VALID: a durable PENDING marker followed by a failed/busy PENDING-root event must latch local recovery-pending state so lock/shutdown cannot report a clean drain. Keep this bounded to Gate 4B; do not pull the Gate 4C persistent journal/manifest into this PR.
• NON-MATERIAL / contract clarification: clean shutdown need not retain a permanent cross-process fence after the local storage instance is closed. The retained fence contract applies to confirmed lock until verified unlock; shutdown must drain/refuse unresolved recovery, then may release on completion/exit.
• NON-MATERIAL as deletion authority: SnapshotRetention::is_referenced is explicitly non-authorizing; reclamation already validates coordinator ownership/scope before consulting it.
• PARTIALLY_VALID documentation: distinguish the logical Arc<Snapshot> pin from per-operation physical location pins; do not introduce a new hazard-pointer/RCU/persisted-pin architecture without a newly proven contract requirement.

CodeAnt's prior two Majors are resolved at this head and its Quality Gate reports PASS. CodeRabbit and Codex independently agree on the transient-I/O finding; Codex additionally raised the reserved-root and unrooted-PENDING cases. CodeScene remains red only on the integration-test structure after production-code improvements; its remaining metrics have been individually dispositioned without suppression or test weakening.

Split gate: keep #952 together only for this narrow correction if it remains the same Gate-4B semantic/proof unit and is near-net-neutral. At 2853 meaningful lines there is almost no size reserve. If the next correction materially exceeds ~3000 lines, adds another independent authority/recovery abstraction, or begins 4C/4D semantics, split at a real lifecycle/recovery proof boundary before pushing.

Next cadence remains: one narrow coherent correction → signed push → entirely fresh exact-head CI/reviewer epoch. No stale-head merge.

Gate 4B integration remains ACTIVE through #952. #360 stays OPEN until final-head convergence, normal protected merge, resulting-main CI/CodeQL/platform/security/signature proof, exact-SHA Production verification, housekeeping and GitHub/Linear reconciliation. 4C/4D/4E remain pending.

[qnbs]

Gate 4B exact-head checkpoint — 7878df9

PR = #952
HEAD = 7878df9084457fea1633506ce326d4eae3c819b9
BASE / VERIFIED_MAIN = 3cd2b6a37ab8b5bbe8abe32830cd8170b0c9d052
STATE = OPEN / MERGEABLE / NOT MERGE_READY
COMMITS = 4
FILES = 16
MEANINGFUL_LINES = 2994
GITHUB_DIFF = +2940/-54
PR_SIZE_GOVERNANCE = SUCCESS with over-hard-tier warning
VERCEL_PREVIEW = dpl_DWs2jZ1QW4K9q2YpPXLYSRGr1nD8 READY exact HEAD
CI_CD = 37119007516 IN_PROGRESS
CODEQL = 37119007529 QUEUED
MERGE_READY = NO
PRODUCTION_AUTHORITY_SWITCH_ALLOWED = NO

Correction commit: fix(core): fence recovery and unlock cancellation (#445).

The new commit remains inside Gate 4B and addresses the validated second-wave clusters:

• retained-epoch read errors now distinguish NotFound from transient I/O;
• reserved ordinary-writers root collision is centrally rejected before authority/key observation across operation paths;
• failed/unwound unlock retains the exclusive fence and clears runtime keys;
• a local pending-record latch refuses clean lock/shutdown drain until same-identity reconciliation/write clears it;
• shutdown semantics are clarified as coordinator close, not a durable installation-wide LOCKED authority;
• SnapshotRetention wording is explicitly non-authorizing.

No Gate 4C journal/manifest, Gate 4D rekey state machine, collector, deletion path or production authority switch was added.

Current exact-head external evidence:

• CodeAnt Quality Gates/coverage/SCR/SAST/SCA = SUCCESS;
• CodeRabbit status = SUCCESS;
• Vercel = SUCCESS/READY exact head;
• DeepSource Python/Docker/Shell = SUCCESS; Rust remains FAILURE on the same test-only drop analyzer class and must be evidence-dispositioned, not called green;
• CodeScene remains red on test-only cohesion/assertion metrics (19 isolated integration cases; 8 large assertion blocks), with production root-store health improved.

Important review note: the new pending_record latch is intentionally conservative and is set before the admitted mutation/reconciliation call. Fresh reviewers should explicitly verify that early non-durable failures cannot create an unintended permanent local recovery latch or require an impossible recovery path.

Split gate: 2994 meaningful lines leaves effectively zero correction reserve. Freeze scope now. Any new substantive architecture/recovery work, 4C/4D semantics, or material LOC growth should trigger a real split rather than another expansion of #952.

Do not merge until the full exact-head CI/reviewer epoch is terminal and every new finding is dispositioned.

[qnbs]

Gate 4B exact-head terminal-CI / fresh-Codex checkpoint — 7878df9

PR = #952
HEAD = 7878df9084457fea1633506ce326d4eae3c819b9
BASE / VERIFIED_MAIN = 3cd2b6a37ab8b5bbe8abe32830cd8170b0c9d052
STATE = OPEN / MERGEABLE
FILES = 16
COMMITS = 4
MEANINGFUL_LINES = 2994
CI_CD = 37119007516 SUCCESS
CODEQL = 37119007529 SUCCESS
VERCEL_PREVIEW = dpl_DWs2jZ1QW4K9q2YpPXLYSRGr1nD8 READY exact HEAD
MERGE_READY = NO
PRODUCTION_AUTHORITY_SWITCH_ALLOWED = NO

All CI/CD jobs on the exact head are terminal green: policy, security, signatures, Core Rust, Tauri Rust, Node 22/24, Linux/macOS/Windows secure-store evidence, Storybook, Build, Playwright, E2E Deep Coverage, Browser Quality and the CI Success aggregator. CodeQL is also SUCCESS.

Fresh Codex review on exact head 7878df90 raised one material P2:
Clear the mutation latch after a stale CAS.

Validated control flow:
ProtectedStorage::try_write_record sets pending_record before calling protected_write_admitted. The lower write path first reconciles, then checks expected_generation, and returns ProtectedError::StaleGeneration before begin_write when the CAS is stale. The current ? therefore exits with the local latch still set even though no new PENDING write was begun. This can make later try_lock / try_shutdown incorrectly return RecoveryPending.

Correction requirements:

• fix this narrowly inside Gate 4B;
• do not clear the latch for genuinely uncertain/durability-relevant failures;
• before clearing on a proven-resolved stale-CAS outcome, preserve the existing physical/admission identity checks (record/location pin, writer guard, operation admission); if those checks fail, remain fail-closed;
• add deterministic regression proof that stale CAS leaves no false recovery latch and a subsequent clean lifecycle transition does not require an unnecessary reconciliation/write;
• audit adjacent error exits only far enough to ensure the fix does not accidentally broaden clearing semantics.

PR budget is effectively exhausted at 2994 meaningful lines. Prefer line-neutral/line-reducing correction and test reshaping over growth. Do not introduce 4C journal/manifest, 4D rekey, collector, deletion or cutover scope. No suppressions/test weakening.

DeepSource Rust remains advisory red on the test-only drop analyzer class; CodeScene remains red on test-only cohesion/assertion metrics. Neither should drive semantic weakening.

After a signed fix push, all current-head evidence becomes stale: start a completely new exact-head CI/reviewer epoch. Normal protected merge only after final-head convergence; no admin/bypass/self-authorization.

[qnbs]

Gate 4B anti-cascade decision: superseding split, not merge.

PR #952 is frozen at e34aae2 (16 files / 5 signed commits / 3000 meaningful lines). Prepared-root recovery finding remains VALID and merge-blocking; no source push or suppression will squeeze its full R1–R5 proof into a saturated PR.

Replacement A: read/snapshot admission only, from verified main 3cd2b6a. Replacement B: mutation/root-recovery/lifecycle closure, only from A's terminal resulting main, reusing recover_root before fresh capture under shared admission → writer serialization → finite root event. No new durable format, journal, or rekey state machine.

Exact A/B/S/D extraction and finding ownership are recorded locally in crates/target/PR952-SUPERSEDING-EXTRACTION-2026-10-03.md; existing #952 remains the immutable review provenance. The prepared-root Critical belongs to B/R1–R5; retained snapshots/locators/read lifetime to A; commit-refresh/stale-CAS/lifecycle to B; physical collection and rotation remain later gated owners. #952 stays OPEN until replacement A is safely open/cross-linked and B ownership is durably recorded.

WorldScript-Studio#360 / QNB-12 stays OPEN / In Progress. Gate 4 / QNB-168 / M3 stays active. 4C/4D/4E pending.
PRODUCTION_AUTHORITY_SWITCH_ALLOWED = NO.