Hella Shield V1 reviewer brief

One-sentence thesis

Uncertainty is treated as finite authority to change data, bounded by bytes, time, evidence quality, recoverability and fairness.

What is actually measured

• Live disposable iSCSI containment and bounded post-trigger exposure.
• Independent recovery verification below the endpoint-visible storage layer.
• Repeated snapshot/clone/hash recovery proof.
• Recovery-backed byte credit and fail-closed time/byte boundaries.
• External supervision of a non-cooperative generated writer.
• Concurrency and write-size limits of reactive endpoint enforcement.

What failed

• An active RW-to-RO remount path was unreliable under I/O.
• The first recovery selector was too conservative.
• Policy v1 failed a fresh preregistered blind challenge.
• A small-sample selector became brittle under perturbation.
• Reactive endpoint credit widened under concurrency and larger writes.

Those failures were retained and used to change the architecture.

The sharpest current boundary

Reactive endpoint supervision can bound exposure, but cannot guarantee an exact hard byte cap once concurrent writes have already been admitted.

The exact-credit reference invariant is used + reserved ≤ credit, which requires reservation before admission at the enforcing layer.

That invariant is formally supported. A true live storage-side pre-admission implementation remains OPEN.

Why the record is reviewable

43 checkpoints, 48 experiment evidence artifacts, 41 selected hash-verified public artifacts, explicit truth boundaries, retained blind failures and local version history.

Current release status

V1 frozen for publication. Experiment 043 closed the combined V1 challenge: four concurrent writers, mixed 4–64 KiB durable writes, delayed recovery and witness-loss conditions all remained inside the frozen authority rules. The final pre-deploy evidence, sanitization and link audit passed; storage-side live pre-admission enforcement remains an explicit future-work boundary.