Context
Child contract of #445 (R-15 Secure Storage). PR #564 merged the S5-A architecture baseline (docs/native/R15-SECURE-STORAGE-CONTRACT.md) with S5_A_ADMITTED = YES but explicitly does not admit this domain — it is an S5-A fail-closed blocker (§5.3.3's "S5-B2 blocker" paragraph). S5_TERMINAL requires S5-A + S5-B1 + S5-B2 + S5-B3 all merged and post-merge green.
Problem
committed_root is the sole publication authority; the immutable read-snapshot semantics are admitted in S5-A. What is not admitted: a race-free acquisition mechanism between snapshot capture and retention-reference registration. A reader descheduled in that gap can have its retention reference arrive after two further root commits already reclaimed the generation it names — a gap in acquisition, not retention, that no reference counting or generation-addressed layout closes merely by existing.
Scope
S5-B2 owns:
- Race-free
AuthoritySnapshot acquisition.
- Retention reference acquisition.
- Root publication interaction.
- Generation reclamation.
- Reader lifetime.
- GC eligibility.
- Crash/process-lifetime implications.
Preferred semantic model: AuthoritySnapshotGuard with one atomic semantic operation:
acquire_authority_snapshot_guard()
= capture current committed_root + register retention reference
No externally observable gap between those two actions. Release: drop/release guard → retention reference removed. Reclamation: a generation is reclaimable only when (a) not reachable from committed/prepared authority AND (b) no live AuthoritySnapshotGuard references it AND (c) no other admitted recovery retention reason applies.
Implementation may use Rust Arc/reference-counting or equivalent. Do not require hazard pointers/RCU unless actual implementation constraints prove the simpler guarded-reference model insufficient.
Non-goals
No implementation. No production authority switch.
Size target
~250–600 meaningful lines. No PR-size exception authorized.
Parent
#445
Context
Child contract of #445 (R-15 Secure Storage). PR #564 merged the S5-A architecture baseline (
docs/native/R15-SECURE-STORAGE-CONTRACT.md) withS5_A_ADMITTED = YESbut explicitly does not admit this domain — it is an S5-A fail-closed blocker (§5.3.3's "S5-B2 blocker" paragraph).S5_TERMINALrequires S5-A + S5-B1 + S5-B2 + S5-B3 all merged and post-merge green.Problem
committed_rootis the sole publication authority; the immutable read-snapshot semantics are admitted in S5-A. What is not admitted: a race-free acquisition mechanism between snapshot capture and retention-reference registration. A reader descheduled in that gap can have its retention reference arrive after two further root commits already reclaimed the generation it names — a gap in acquisition, not retention, that no reference counting or generation-addressed layout closes merely by existing.Scope
S5-B2 owns:
AuthoritySnapshotacquisition.Preferred semantic model:
AuthoritySnapshotGuardwith one atomic semantic operation:No externally observable gap between those two actions. Release:
drop/release guard → retention reference removed. Reclamation: a generation is reclaimable only when (a) not reachable from committed/prepared authority AND (b) no liveAuthoritySnapshotGuardreferences it AND (c) no other admitted recovery retention reason applies.Implementation may use Rust
Arc/reference-counting or equivalent. Do not require hazard pointers/RCU unless actual implementation constraints prove the simpler guarded-reference model insufficient.Non-goals
No implementation. No production authority switch.
Size target
~250–600 meaningful lines. No PR-size exception authorized.
Parent
#445