minio/docs/investigations/r6/consensus.md

R6 plan consensus — final v3

2026-09-15. Source baseline: 9ebe81c1b3611f9cc73e676b5b741c2be62c467a.

Earlier v2 agreed immutable plan: plan-v2.md, SHA256 dae51753a3ab4b2ea98b85e720144338fdf52541ca6daf968c7dac5ce564d8c3.

Codex accepts this plan. Real Claude Code 2.1.270, explicitly --model claude-opus-5 --effort max, read the same file and returned GO_WITH_NONBLOCKING_NOTES, no blockers, with explicit consensus. Every recorded assistant model in both rounds is claude-opus-5. CLI auxiliary usage is listed separately in the metadata files. The reviewer had read-only tools, so verified content but did not independently compute the hash; Codex computed the hash before and after review and confirmed it unchanged. The plan is 59 lines as described by the reviewer. A rate_limit_event telemetry record is not a failure verdict: the actual final result is subtype=success, is_error=false, and includes the explicit review and consensus.

Round	Verdict	Outcome
v1	REVISE, one blocker	Accepted B1: preserve the disk creation block using the existing empty-update signal. All seven notes resolved/scoped in decisions-v2.md. No production code changed.
v2	GO_WITH_NONBLOCKING_NOTES	Same immutable plan accepted by both parties; implementation and tests now proceed.

Raw logs: /Users/vonng/tmp/silo-r6-20260915-aa3f/opus-v1.jsonl, opus-v2.jsonl, and matching stderr logs. Extracted reviews and SHA/model/command metadata are alongside this document. No simulated reviewer or fallback model was substituted.

v2 nonblocking dispositions

1. Keep canonical success audit normalization COMPLETE → COMPLETED, using replication.CompletedLegacy for conversion; assert the actual audit outcome and document the visible string correction.
2. Use operation status for per-target change comparisons. Assert count-only successful heal purge deltas, zero bytes, and no pending operation outcome for failed purges. No new metrics policy.
3. Initialize ResetStatusesMap before an existing assignment when nil, unconditionally safe; no general merge change.
4. Already-COMPLETE purge also short-circuits under ExistingObjectReplicationType, matching canonical behavior; add a matrix row.
5. Offline errors populate Err for both creation and purge. This is explicit error reporting with the same failed outcome.
6. Preserve getReplicationState's existing unused third parameter and shape-agnostic behavior.
7. Validate real marker/nonempty version/nonzero ModTime plus bucket and decoded object identity. Use decodeDirObject for the name comparison so the stricter gate does not reject the internal directory-object encoding.
8. Use int for delete RetryCount, matching the persisted MRF field and QueueReplicationHeal input. No on-disk format changes.
9. Purge-status subset replacement is pre-existing and remains outside R6; creation-block preservation under partial fan-out is newly tested.
10. Tests drive saveMRFEntries directly, verify the real stored record, and create a fresh pool for each load/queue replay. Timer waiting and process-crash durability are not claimed.

These are implementation refinements within the accepted plan; Opus explicitly stated they require no new review round/hash. Consensus is not test acceptance, merge, release or deployment. Production implementation begins only after this record was written.

Final v3 consensus, 2026-09-16 CST

Final immutable plan: plan-v3.md, SHA256 dc9a67fc91b3113fa35218a2f903455807430cc4daf9c78a88d0be6b8fc27058 (70 lines; locally recomputed unchanged after review).

Codex accepts v3. Real claude-opus-5 --effort max returned GO_WITH_NONBLOCKING_NOTES, no blockers, and explicit consensus on the exact read content. As before, read-only reviewer tools could not compute the digest; the model verified the named content and Codex verified its hash. Original review/metadata are opus-v3-review.md and opus-v3.metadata.json. The review candidly withdraws the earlier multi-target regex proof. This is actual additional review, not a simulated amendment to the earlier output.

The v2 implementation was completed only after v2 agreement. Codex then found and reproduced the two-empty-status parser counterexample on real storage; the incremental three-field v3 source change remained unapplied until this new consensus was recorded.

v3 note	Disposition
N1 payload invariant	Accepted as mandatory: wrap the real ObjectLayer update in purge tests and assert all three creation-update fields and their composite are empty.
N2 masking scope	Ordinary purges are protected through FileInfo.Deleted=false; ordinary object versions have another such guard. The unrecorded marker case corrupts creation metadata only on its first failed write.
N3 ReplicaStatus	Clearing it is defensive, not a repair of an observed producer population.
N4 shared parser	Remains unchanged; generic parser robustness is separate. No future arbitrary caller guarantee is claimed.
N5 timestamp assignment	Retained; empty creation-update payload makes it irrelevant to purge disk creation metadata.
N6 prior proof	v2's regex proof is correct only for a single target. The immutable raw reviews and executable counterexample are both retained.

Only v3's three field assignments and the required invariant remain to be applied after this record. All earlier compatible refinements and acceptance limits still stand.

Implementation completion, 2026-09-16 CST

The paragraph above records the state at approval time. The agreed v3 assignments and mandatory payload invariant have since been implemented and verified. After rebasing onto af2b1794d38d9e70e1d2c3ee692426e4b6cab4bd, all five R6 source/test hashes remained identical. Source commit cf381a7151ef25fc95ace5fedcd767fa19410de2 passed the scoped regression, race, build, vet and lint checks, plus the six formerly capacity-blocked DELETE tests. See README.md and its linked machine verification records. Subsequent changes only document this evidence; no new production-plan deviation was introduced.