Module conformance 

Does this store actually enforce the conditions lean writes under?

Everything the protocol promises rests on one property of the backend: a conditional write is REFUSED when its condition does not hold. The manifest CAS, the lease cell, the upload gate and the file collector are all conditional writes, and a store that accepts the header and ignores it answers byte-for-byte like one that enforces it — until the day it overwrites or deletes the wrong generation.

This was a documented assumption (lean/SAFETY.md §2) and a CLI verb an operator could remember to run. That is not enough, and the model says why in the sharpest possible terms: the garbage collector’s DELETE carries If-Match because the variant WITHOUT it — LeanBarrierLeaseGCUnconditional — is refuted by the gate, a mutation that must violate an invariant. On a store that ignores the header, the shipped binary IS that mutation. Nothing about the code is wrong; the store makes it wrong.

So the probes run before the first barrier, and the answer is acted on rather than printed:

• PUT conditionals broken → refuse the workspace. If-None-Match and If-Match on PUT carry the manifest CAS and the lease itself; there is no degraded mode, only last-writer-wins pretending to be arbitration.
• If-Match on DELETE broken → refuse the COLLECTOR, not the workspace. The syncer runs, publishes and arbitrates exactly as before; the collector leaves its objects behind (barrier.rs, report.leaked). Uncited objects are served to nobody and swept by nothing, so the cost is storage growth. Apache Ozone 2.2.x is this case (HDDS-14907, finding L-27), and refusing it outright would refuse the on-prem target over a leak.

The verdict is cached in the state dir per store identity: the probes cost ~10 requests and a store does not change its mind between two barriers. The state dir is the worker’s emptyDir, so a store that is FIXED is re-probed by the next pod without anyone clearing a cache.

Enums

Decision

What the gate decided, for the caller to act on and report.

Constants

PROBE_VERSION

Bump when a probe asks a NEW question, so an old verdict is never read as the answer to it.

Functions

gate

Probe this store (or read the cached verdict), apply the result to sc.cfg, and say what was decided.

message

The operator-facing sentence for each outcome. Kept here, next to the decision, so the CLI and the worker cannot describe the same verdict two different ways.