**P2 — Source files lose protection before rollback is ruled out.** [regionha_test.go:2141](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-two-box-build/internal/sim/hostlife/regionha_test.go:2141)

The `landing` branch stops protecting the source region when the target’s admission changes `holder.Gen`. Admission does not commit the move; a clean rollback remains possible.

The reachable sequence is:

1. Use the new stopped-move witness’s setup: a source restart queues a generation park, while the older generation holds the keyed manifest.
2. Delay that park until the target probe is admitted, before commit. `filesHome` now returns false for the source, allowing the sibling to archive its manifest and referenced object.
3. Roll back cleanly. [moves_test.go:1509](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-two-box-build/internal/sim/hostlife/moves_test.go:1509) restores the source generation.
4. The unchanged-files publisher can skip republication at [regionha_test.go:2014](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-two-box-build/internal/sim/hostlife/regionha_test.go:2014). A subsequent source failure leaves failover without the keyed manifest.

At `a2ef0203`, the region-blind chain lookup preserved that source manifest. This is a regression introduced by the regional restriction. It is established by static tracing, **not an executed reproduction**.

**Fix:** preserve the source rollback files and their references until rollback is ruled out. Add a witness that delays the queued park until after target admission, rolls back cleanly, then requires source-region failover to succeed.

The other answers to the brief:

- **Original late-PUT defect:** the region-qualified lookup addresses it, and the revised witness covers both the manifest and object.
- **Phase table:** “no home” for creating, deleting, parking and purging agrees with §5.1. Keeping the source region throughout relocation agrees with claim §6.2a’s unchanged-region rule, including pinning without an executor. The landing condition follows the table’s current-generation authority, but that alone does not preserve the files needed for rollback.
- **Optional invariant:** add independent preservation coverage, including rollback files. Keep the existing INV-3 scenarios as separate liveness evidence; their expected failure strings should not prevent a safety check. An invariant derived from the same `filesHome` predicate would miss this defect.
- **J2/J3:** unchanged by this fix.

`git diff --check` and package formatting passed. Go tests could not run because the sandbox refused creation of the build directory. The supplied sweep results and identity hashes remain independently unverified.

---

**FIRST PROMPT:**
Review the J1 fix at dfab457c against the R2 brief and stage A fe144bab.

**WHAT:**
Check J1 closure, phase semantics and regressions.

**STATUS:**
Review complete; one P2 rollback-preservation finding.

**NEEDED:**
Nothing from you.

**RECOMMENDED:**
Preserve rollback files and add the post-admission rollback witness.

**SESSION:**
Safe to close. No files changed or processes left running; the read-only workspace prevented saving a handoff file.

**Verdict: J1 is not closed.**