carlos / platform Public

This follows from #236 (moves into home, part 2, branch moves-home-part2-plan @ 8e617135, under census-ruling-home-part2).

What happens now:

• revertRun.probing (internal/host/movesrevert.go) re-reads the claim after the recovery probe answers.
• It accepts the fresh claim only if replaying the probe wake's own writes over the step's earlier read reproduces that claim exactly. The probe's writes are its hostclaim.AdmitWriter admission plus FS-R11's restore re-tag (revertProbeWrites).
• Admissions bound to a declared loss or a fenced target cannot be replayed. hostclaim's "verified" flags are internal, so such an admission is refused as a foreign change, and the revert's probed step stalls.
• The stall fails closed: the step retries and nothing is damaged.
• It is plausible in practice, for example when the failed target holder was fenced first.

Ruling (platform-1e, 2026-10-16):

• Accept the stall for now, since moves stay off until after claim activation.
• Do NOT expose the verified flags. A replay helper that lets callers assert "verified" is a forging surface.

The later fix: a hostclaim-owned function that re-verifies the loss or fence evidence itself and then produces the expected claim, never a flag setter. Moves then calls it from revertProbeWrites.

A test pinning today's refusal is being added on moves-home-part2-plan. Unclaimed.