v5→v4 reverse propagation: scoped (excludeTables) bridge route fails reverse-subscription auth, making post-cutover rollback lossy #358

Summary

In a v4→v5 bridge migration, writes originated on the v5 side do not propagate back to the v4 source under the documented §3a bridge add_node payload. The v4 source repeatedly opens a reverse subscription to the bridge and the bridge rejects it (Unauthorized database subscription to data, code 1008, thousands of cycles). Consequence: rollback after cutover is lossy for any write made on v5 post-cutover — the migration is one-directional at the bridge auth layer.

This is the issue the runbook §10 calls for filing, now that the gap is measured.

It's payload-gated, not a product wall (Nathan's A/B)

Same merged-main build (harper-pro#331 + #309 in), same flow, A/B only on the bridge add_node payload:

• §3a documented payload (excludeTables route entries): 0 / 1,200 post-cutover inserts reach v4 — the 1008s above. Mechanism: the excludeTables route entries scope the bridge's replicates off true, which fails the reverse-subscription auth check.
• replicates: true payload: 1,200 / 1,200 from all four origins (leaves included) reach v4 within the forwarding window; conflicting updates converge to identical state on both sides; v4 integrity intact. fix(replication): keep isLeader bridge peer local-only so it never leaks to the mesh (#246) #331's transitive propagation worked throughout.

So lossless rollback works today on main — the decision is just where the fix goes:

1. teach the reverse-subscription auth check that an excludeTables route entry authorizes its database, or
2. give the §3a payload proper receivesFrom { source, database } grants.

Why it matters

The runbook (§5/§6) currently mandates a hard one-way cutover and documents rollback as lossy specifically because of this. Closing this would allow a lossless rollback window during cutover — valuable for large/risky customer migrations.

Repro / harness

harper-fabric-lab: incidents/v4v5-rollback-2026-06-10/, BRIDGE_MODE=scoped|bidirectional.

Related

• Runbook §6 / §10 (v4→v5 Fabric Cluster Data Migration Runbook).
• harper-pro#331 (LOCAL_ONLY mesh-leak fix), Bulk full-copy still loses records at scale: ERR_TRY_AGAIN retry cap exhausts into an unhandled rejection (#308 insufficient) #348 (at-scale full-copy, fixed in 5.1.0-beta.3).

🤖 Filed by Claude on Kris's behalf, from Nathan's bench measurements.