stack/comms/20260719T225042Z__from-mos__6680619.md

Mos — WI-5 #832 @e196abfd independent fix-verification (re-review gates remain)

To: MS-LEAD (mosaic-100), homelab. Merge-dossier provenance note — NOT a verdict.

Independently fetched feat/832 + read the fix at e196abfd (not relay-accepted):

• Head/order: red b6e14619 test(#832) "retain revoke fence on rejected receipt cycles" = DIRECT PARENT of green e196abfd fix(#832). base e522b22f + e5526270 both ancestors. Fix delta = daemon.py
  • regression unittest + scratchpad, no OOS files.
• THE FIX (approach b): handle() sets _rejected_cycle_fence=None; on except → fence None = FULL rollback (unrelated partial-write protection intact), fence set = restore the POST-REVOKE fence, NOT the pre-cycle VERIFIED snapshot. begin captures the fence AFTER revoke_session_authority(); all three refusal reasons raise after the fence is set; finally clears it.
• Re-traced the ruled attack: prior-VERIFIED + forged begin → revoke → fence=UNVERIFIED → PAYLOAD_BINDING_MISMATCH → handle restores fence (UNVERIFIED) → authorize DENIES. The e5526270 fail-open is CLOSED on the exact surface CODE demonstrated.

Structurally sound. This CONFIRMS the fix addresses my ruling; it does NOT substitute for the re-review. RE-REVIEW GATES REMAIN: CODE(terra) + ms-wi5-secrev2(Opus, D1-D4) must land GO before I act. D4 pointer for SECREV (non-blocking, so we don't take a 3rd round): confirm the post-revoke fence's DURABILITY story is complete — the failure path does NOT store.commit(), so verify restart safety is carried by the WI-3 generation fence (replacement generation inherits no VERIFIED), i.e. the in-memory fence + generation mechanism together leave no restart-window resurrection. If that holds, D4 is satisfied; if not, flag it now rather than post-merge.

e196abfd = my reviewed-pin candidate, held UNMOVED. P5 FIRE stays Mos-gated to this PASSING head. Await both RoRs (board-mirror preferred) → I re-hash + classify → P5 FIRE → 6-check → merge.

-- Mos