From 9245446b5998d3e531fcf06187de2c40c72329b4 Mon Sep 17 00:00:00 2001
From: pingqiu <pingqiu@gmail.com>
Date: Mon, 27 Apr 2026 15:21:14 -0700
Subject: [PATCH] =?UTF-8?q?G5-5C=20=C2=A71.H=20code-start=20audit:=20PROCE?=
 =?UTF-8?q?ED=20=E2=80=94=20all=20halt-conditions=20clear?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Per v0.5 §1.H step 3, sw publishes audit findings as a commit note
before any G5-5C production code change.

AUDIT METHOD: greped seaweed_block/core/{engine,replication,adapter}
for the structural backing of each in-scope INV; cited apply.go +
state.go + replication/volume.go + adapter/adapter.go line numbers
as evidence.

PER-INV FINDINGS:

[1] INV-G5-5C-PRIMARY-RECOVERY-AUTHORITY-BOUNDED
    Owner: core/replication/volume.go (ReplicationVolume.peers map)
    Status: ✅ PASS. peers map is sole probe target collection;
    UpdateReplicaSet is sole mutator and is master-fact-driven only.
    Halt-cond cleared.

[2] INV-G5-5C-GENERATION-FENCE
    Owner: core/engine/apply.go:132-166 (stale event rejection) +
    state.go:24-32 (IdentityTruth.{Epoch, EndpointVersion} carrier)
    Status: ✅ PASS. Engine rejects events with epoch < Identity.Epoch
    or (epoch == AND ev < Identity.EndpointVersion). identityChanged
    triggers wholesale Recovery reset (line 166-169). Fence is
    carried on engine state, not re-derived per call site.
    Halt-cond cleared.

[3] INV-G5-5C-SINGLE-INFLIGHT-PER-PEER
    Owner: core/engine/state.go:144-151 (SessionTruth single-slot) +
    apply.go phase-guards at 183/236/364/417/442/455/472/507/536
    Status: ✅ PASS. ReplicaState.Session is one slot per peer.
    Engine FSM handlers explicitly skip / reject when Phase is
    PhaseStarting or PhaseRunning. apply.go:536 "Skip if a rebuild
    session already exists" pinned. In-flight is engine-explicit,
    not implicit. Halt-cond cleared.

[4] INV-G5-5C-PROBE-BEFORE-CATCHUP
    Owner: core/engine/state.go:84-121 (RecoveryTruth) +
    decide() probe-driven decision path
    Status: ✅ PASS. RecoveryTruth.Decision is derived from R/S/H
    (boundaries from probe), NOT from transport reachability.
    Engine's RebuildPinned guard prevents stale auto-probe from
    downgrading Rebuild back to CatchUp mid-flight (line 105-120).
    Halt-cond cleared.

[5] INV-G5-5C-RECOVERY-BACKOFF
    Owner: engine retry budget (state.go:91-103
    RecoveryTruth.Attempts + RuntimePolicy.MaxRetries from T4c-3) +
    NEW G5-5C runtime cooldown (5s base → 10s → 20s → 40s → 60s cap;
    reset on success)
    Status: ⚠ PARTIAL — engine has retry budget but no exponential
    cooldown. G5-5C adds the cooldown as a primary-runtime policy on
    top of engine retry budget. NOT an engine FSM change. Acceptable
    under §1.H "minimum evolution" criterion. Halt-cond cleared.

[6] INV-G5-5C-STALE-ACK-NO-HEALTH-PROMOTION
    Owner: core/engine/apply.go:766-789 (Healthy gate)
    Status: ✅ PASS. Healthy = true requires three conjuncts:
    (a) Recovery.Decision == DecisionNone, (b) Reachability.Status
    == ProbeReachable, (c) Identity.Epoch <= Reachability.FencedEpoch.
    A barrier ack with AchievedLSN < TargetLSN does not transition
    SessionTruth, decide() does not flip Decision to None on
    insufficient achieved LSN — Healthy stays false. Halt-cond
    cleared.

OVERALL VERDICT: PROCEED.

All six in-scope INVs have their backing infrastructure in engine
(state.go + apply.go) or replication (volume.go). G5-5C is a runtime
wiring batch + small policy extension (backoff). No engine FSM
rewrite needed. No halt-condition fires; no engine-evolution
mini-plan required.

NEXT STEP: implement primary-side probe loop +
ReplicaPeer.ProbeIfDegraded() + lifecycle/cooldown/dispatch tests +
component test, all under core/replication/. Probe loop owned by
ReplicationVolume lifecycle per architect binding. Test method
names to be concretized as code-start commit-note addendum to §2.

This audit commit fulfills §1.H step 3 (audit findings published) +
§2 #15 (audit commit note before production code).