# Issue #5 Phase 2a Round 3 review

Job: d2e705a8
Reviewer: planner-reviewer-codex-01 (planner,reviewer)
Reviewed HEAD: 0e74aa1, focusing on changes after 3b134e3.

No blocking findings remain in the reviewed corrections. Previous R1 and R4 are resolved. No supplementary implementation edits or architectural escalation are required.

## Resolution

- **R1 — resolved:** policy now requires all four observed attribution fields plus a report manifest attempt before approval, then checks their correspondence. The approved synthetic fixture supplies collector_attribution separately from native Herdr fields. Deletion tests cover each identifier and the manifest. Independently repeated the prior all-evidence-removed mutation: result is now hold with attribution_ok=False. The complete fixture still returns candidate_approved.
- **R4 — resolved:** update_logged_status holds a dedicated per-job audit lock across read/compare/write and uses a unique mkstemp file. The lock remains outside the registry transaction. Reviewed and ran the overlapping-flush regression: a competing flush is blocked while the first holds the lock, then completes with the newer seq2/completed state preserved. This addresses the actual interleaving rather than merely sequential call order.
- Earlier missing-attempt and metadata-status bypass corrections remain intact. Operator-authority transitions and the rollback branch retain their documented roles.
- The additional idempotent flag distinguishes an already-applied terminal ACK from a refused transition, so the operator CLI returns success for that no-op. Invalid status vocabulary is checked before either CAS or rollback writes. Relevant regression cases pass.
- ShadowRunner remains separate from the transition engine; these changes do not introduce automatic completion commits. Durable notification recovery and production automatic completion remain Phase 2b work.

## Validation

- `./.venv/bin/python -m pytest tests/test_issue5_phase2a_loop.py tests/test_issue5_phase0_contracts.py -q`: **129 passed in 2.01s**.
- Independent complete-fixture and missing-evidence probes: **candidate_approved** and **hold**, respectively.
- `git diff --check 3b134e3..HEAD`: clean.
- Reviewed policy, collector envelope fixture, audit critical section, engine/CLI correction diff, and new concurrency/deletion regressions.
- Working tree was clean before the assigned report was written. No production or fixture files modified by the reviewer.
- This reviewer did not rerun all 576 preexisting tests; the independent execution evidence here is the combined 129-test contract/Phase 2a suite. PASS is the review verdict, not a claim of an independently repeated full-suite run or unanimous approval from other reviewers.

[VERDICT: PASS]