Q195 O2 W4 (#1799): Megavolt's round 4 review of 994c3f7fb (blob 2af460ab7): APPROVE, R3-B1 and R3-B2 closed, R4-N1 (re-migration after a pre-W4b restore) non-blocking for W4b; doc only

2026-10-22 18:47:51 -05:00
1 parent 5a91431ef9
commit 67f82a12d5
@@ -471,3 +471,58 @@ invent the enable path. Fix:

 Fix R3-B1 and R3-B2 and send me and Sage the commit and blob. I'll re-check those two items and the
 lines they touch.
+
+## Round 4: 994c3f7fb (blob 2af460ab7)
+
+Reviewed: Rocko's round 4 commit 994c3f7fb, a fast-forward on 54246cb32, design blob 2af460ab7.
+I read the whole delta and the definitions it touches. Static review only. I did not download the
+two public fixtures Rocko cites, so their sizes and hashes are Rocko's; what they report (-1/0 in
+Word 15, 0/1 in Word 12) matches my round 3 claim and also shows that an ID can't identify a
+reserved note.
+
+### Verdict: APPROVE
+
+Every blocker from rounds 1-3 is closed, and M1 closed in round 2 with no Mos/Jason item. The
+design meets the W4 Gate (spec blob 322ec50f2, lines 806-850):
+- no locator or permission ambiguity is left;
+- new O2 copies, generic reads, git grants and raw sessions are closed as bypasses;
+- quotes verify against a committed blob and an extractor revision;
+- there is no unsaved-context or agent write path;
+- Case 2 Markdown authorization is unchanged;
+- a migration and compatibility plan is present.
+
+W4b owns the implementation and the A1-A32 evidence. This approval covers the design, not passing
+tests.
+
+### Round 3 items
+
+- **R3-B1: closed.**
+  - Reserved notes are classified by `w:type` in {separator, continuationSeparator,
+    continuationNotice}, with any canonical signed ID (line 227).
+  - A normal note has no type or type normal, plus a nonnegative ID; unknown types refuse.
+  - Any reference to a reserved note refuses, including an id-0 continuation separator.
+  - Duplicate IDs within a part refuse.
+  - A31 covers both the -1/0 and 0/1 layouts.
+- **R3-B2: closed.**
+  - The first schema migration creates the fence durably before the tables commit, with a fresh
+    epoch, `restoreOperation` null, the `[]` digest and no confirmed businesses (line 781).
+  - Confirmation applies only when `restoreOperation` is non-null (line 819).
+  - A missing or malformed fence over existing `writing_*` tables or history fails closed and
+    never reinitializes (line 790), and a crash resumes on the same epoch.
+  - A32 covers both states.
+- **R3-N1: closed.**
+  - Each object holds business, project, row and a private 32-byte nonce, and lives under
+    `objects/<business>/<row>/`.
+  - There's no cross-row deduplication, and retention is per owning row.
+- **R3-N2: closed.** The rollback-detection claim is replaced by an honest limit: a same-uid
+  operator bypassing the protocol is outside what the file can prove.
+- **R3-N3: closed.** The `:498` citation is fixed.
+
+### Non-blocking, for W4b
+
+- R4-N1. Line 790 allows initialization only with no `writing_*` tables and no fence. One case is
+  unnamed: a compatible-controller restore of a backup taken before W4b, then a re-migration. The
+  tables are then absent while a rotated fence with a non-null `restoreOperation` exists. Neither
+  reading opens a bypass, because the restore dropped every `writing_*` row. W4b should still say
+  that re-migration keeps the existing rotated epoch and its confirmation requirement, rather than
+  refusing forever or writing a new null fence. Add that case to A32.