carlos / platform Public

This came up building the roster-binding fix on claim-empty-cohort-done (phase C, commits 3ee48840..7103ee07, design note design-roster-revision-holds.md ruling B3). The behaviour is fail-closed and nothing is reused, but there is no automatic way back:

1. No agent path to a clean reinstall after a settlement. At startup, root settles a cold-handover barrier whose successor binding is obsolete. After that, the claim's holder is the obsolete successor's session. The agent looks for a completed receipt for that session, and none exists. Root does accept a new successor at the current binding when it is given the prior's receipt (the B3 test proves that), but the agent and console have no path that gets there.
2. A handover interrupted late leaves the host stuck. If root died after the rows moved to the successor, settlement leaves those rows owned by a retired stamp, and the prior is already parked. A new handover from the prior then refuses. Only the "interrupted right after BeginColdHandover" case is tested.

Both need a cold handover in flight when the box's binding changes, which means a quarantine. Neither affects the empty-cohort dev trial. This is owed before production cohorts. A related behaviour change: a quarantine alone, with no readmission, also settles an in-flight handover at the next root restart.