Correct the record: zero-copy promotion is already unblocked

[brad-richardson]

The state doc says item 1's precondition is "two changes, not one" and concludes "until both land, keep release_slice_version EMPTY". That was true when written and is now stale — and it's blocking a decision worth ~158 GiB and ~123 minutes on every promotion.

Both halves already exist

1. A v2-aware unreferenced check — scripts/v2_retention_guard.py (8e4e0fc) resolves v2/catalog.json → v2/releases/{build}/release.json → every family source and retained external operation_sources. It scans recursively rather than enumerating fields (enumerating is precisely how the v1 guard came to miss the v2 chain) and fails closed on a missing release document, a byte-mismatched one, an unreadable catalog, or a partial target.
2. A phase that can match a slice prefix — phase 3 emits a bare <prefix>/ target for each ORPHAN_PREFIXES entry with no version-format restriction, and the guard accepts slice-YYYY-MM-DD.N as a bucket-root prefix. r2-cleanup.yml fetches the whole chain before any delete and calls the guard in both bucket-root delete phases.

What this PR adds

I started building the v2-aware guard before checking whether one existed — it did, in a better form than the one I was writing. The durable fix for that is a test, not a note: the guard only protects what calls it, so this adds contract tests asserting both delete phases consult it, that the chain is fetched before any delete, and that a slice prefix is a legal phase-3 target. Plus the state-doc correction in three places.

What remains

A decision, not engineering. The slice smoke already promotes both layouts on every change and asserts byte-identical published routing.json and family manifests (0bf477e); Monaco measured 21 objects copied under the construction layout against 0 copied / 21 prepositioned under the release layout.

Full suite: 1,812 passed, 2 skipped.

🤖 Generated with Claude Code

[brad-richardson]

Adversarial review found a real one, and it inverted the conclusion

I had this PR framed as "the precondition is already met, nothing to build." A subagent review tasked with refuting that found the delete surface is wider than r2-cleanup.yml.

F1 — release-slice-families.yml deletes exactly the shape zero-copy publishes into, unguarded. Its cleanup job runs aws s3 rm "s3://geocoder-shards/${SLICE_VERSION}/" --recursive behind nothing but a shape regex — and that regex is precisely release_slice_version's validated format. Three things compound it:

• the job is always(), so it runs when preflight failed and every build job was skipped;
• its one reference check, probe_catalog_excludes_slice.sh, walks the v1 catalog's child links, so it reports "not referenced" for a fully live promoted slice — always. It is reassurance, not a gate;
• flipping release_slice_version is what moves ~45 GiB (Places) / ~114 GiB (Addresses) of serving objects into that namespace, from a construction prefix no delete path can name.

Verified in the code, not taken on report. Fixed here: the job now fetches the same v2 chain and calls the same guard before deleting.

F3 — my own overclaim. I wrote that r2-cleanup.yml "fetches the whole v2 chain before any delete." It does not: the fetch is at line 379, phase 1's RM at 329, phase 2's at 366. Those phases are sound for a different reason — they pin targets to */staging/ and ^staging/global-v2/[0-9a-f]{64}/$, neither of which can be a bucket root. Doc corrected, and the distinction is now what the test encodes.

F4 — both my new tests were tautologies. The reviewer built four safety-breaking edits that left them green. Replaced with structural checks over the parsed step order, and mutation-checked against all four:

mutation	old tests	new tests
|| true on the guard call	pass	fail
continue-on-error on its step	pass	fail
guard reordered after the delete	pass	fail
guard step deleted outright	pass	fail

The \|\| true case needed a second pass — the guard invocation spans backslash continuations, so appending to its last line evaded a per-line scan. Continuations are joined first now.

Recorded, not fixed (in the state doc): the pre-promotion window where a finished-but-unpromoted slice reads as unreferenced and the create-only claim file is not consulted; phase 3 needing a workflow edit to target a slice; phase 3 lacking phase 5's cache-TTL wait; and rebuild-r2-shards.yml's retention prune still being v1-only.

Full suite: 1,816 passed, 2 skipped.