# Joint round 3 brief: the two-box model after J1 fix round 2

Joint round 2 (`CODEX-REVIEW-TWO-BOX-R2.md`, 25c7c9e1) left J1 open on one P2. During a landing, the source region stopped being protected when the target's probe was admitted. Admission does not commit the move, so a clean rollback could restore a source generation whose keyed manifest had already been archived. Round 2 also asked for independent preservation coverage. J2 and J3 are still waiting on #236. This round judges only the fix.

**What changed (25c7c9e1..00bd0abe, model code only):**
- **Landing:** the `landing` branch of `filesHome` keeps the source region home until `op.Committed`, the claim following the move record's commit. Rollback and commit CAS the same record field from `landing`, so once the record commits, no clean return is possible. The source stays home a little longer, during the follow window, which is safe: the whole-location park that is queued when the claim follows retires it.
- **New witness `wRollbackKeepsSourceFiles`** (rule `files-home-move-phases`) follows your sequence:
  1. a park is delayed past the target's admission;
  2. the move rolls back cleanly, and the publisher skips republication;
  3. the source is terminated;
  4. the failover in the source region must serve with the keyed manifest.
  - Under dfab457c's landing rule it fails with INV-30 at t=125.
- **New INV-30, independent of `filesHome`.** In every region that could still serve the host next, the manifest the next install would pin, and the objects it names, must survive. The regions are derived from the move record and the operation, not from `filesHome` or any rule.
  - It runs at two boxes only, and is silent on 3,000 unmutated two-box seeds.
  - It leaves out the dirty rollback's target region, where a return never serves next.
- **Four witnesses now expect INV-30:** files-live-set, files-live-set-moves-parks, and both files-home-move-phases witnesses. INV-30 catches their mutations before INV-3 would. `TestFilesWitnessesStuckWithoutINV30` keeps the INV-3 liveness outcome for each with INV-30 off.
- **Witness matcher:** it is now bounded at digits. Before, "INV-3" matched "INV-30". A comparison across the whole witness suite, in both shapes, found no other change.

**Evidence:**
- The gate passes at 300+300 seeds.
- The unmutated 3,000-seed two-box run has 0 failures.
- One-box counters and traces are byte-identical (`ae19edaec4491fd3`).
- The two-box hash is unchanged (`fea529f94642f661`).
- In the files-* sweep (3,000 seeds), every rule is caught except files-pin-exact, which was already an expected miss.
  - files-live-set: 50 → 458.
  - files-live-set-moves-parks: 24 → 325.
  - files-home-move-phases: 0 → 13.
  - The rise comes from pushes' whole-location parks, now caught at the archive itself.
- The implementer's and reviewer's notes are in `.superpowers/sdd/2026-10-07-region-ha-hostlife-two-box/joint-j1-report.md` and `joint-j1-review.md`, on local disk.

**Questions:**
1. Is J1 closed?
2. Is `op.Committed` the right point at which rollback is ruled out?
3. Is INV-30's region set right against moves §5.1, and is it independent enough?
4. Has anything new been introduced?

Give findings with P1/P2/P3 severity and file:line. End with a verdict on J1.