Evan JarrettandClaude Opus 5 2a58ccebd8 hold/gc: name the third ownership state instead of encoding it as a lie ...

264d332 fixed the behaviour but encoded it badly. manifestBelongsToHold
returned (true, false) for an unreachable hold — "yes, but not really" — a
return value that contradicts itself, and isPredecessorHold both applied the
fail-open policy and handed back the raw material for that policy. The
behaviour was right and the shape was wrong.

The underlying problem is that ownership has three states and the return type
had two:

  ours        - this hold's manifest, or a confirmed predecessor's
  not ours    - the hold answered, and it is someone else's
  unknown     - the hold did not answer; don't delete, but do not adopt

For the first two, "is it ours" and "should its blobs stay referenced" have
the same answer, so one bool worked and the design was never stressed. They
diverge only on unknown. Every version so far has had to collapse unknown
onto one of the other two: before 95d4f7c onto "not ours", which deleted a
live predecessor's blobs, and after it onto "ours", which adopted foreign
manifests and put ten phantom missing layer records on hold01. Same shape
error, opposite sides. That conflation is original, not something 95d4f7c
introduced: manifestBelongsToHold has fed knownManifests since the function
was written.

So name the state. manifestClaim has three values, classifyManifest and
classifyPredecessorHold report what they found and apply no policy, and the
one decision that matters — an unknown claim is carried for blob protection
but never adopted — now sits in the open at the call site instead of two
functions deep, which is how it leaked into ownership to begin with.

No behaviour change from 264d332; the three outcomes and the blob protection
are identical. The regression test was re-verified against this shape: it
fails, reporting the adoption, when claimUnknown is allowed to adopt.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KWoKzpgtBJ33sCyGxJGR7x

2026-09-01 10:41:04 -05:00

..

aux_records_test.go

hold/gc: stop the aux-record sweep deleting live records

2026-08-08 21:24:00 -05:00

blobs_test.go

hold/gc: test the blob sweep, and give the S3 mock object ages

2026-08-25 16:34:25 -05:00

config.go

hold/gc: stop the aux-record sweep deleting live records

2026-08-08 21:24:00 -05:00

gc_test.go

hold/gc: name the third ownership state instead of encoding it as a lie

2026-09-01 10:41:04 -05:00

gc.go

hold/gc: name the third ownership state instead of encoding it as a lie

2026-09-01 10:41:04 -05:00

orphan_regression_test.go

hold/gc: stop the aux-record sweep deleting live records

2026-08-08 21:24:00 -05:00

predecessor_test.go

hold/gc: name the third ownership state instead of encoding it as a lie

2026-09-01 10:41:04 -05:00

takedown_gate_test.go

holds now listen for deletes and labelers for takedowns. GC will defer takedowns for a grace period in case of reversal

2026-05-02 23:31:41 -05:00