Astra re-review r3: settings-5-surfaces

Range 40e7782e..51790645.

Verdict: ACCEPT

Reviewed 40e7782e..51790645 against rev 11 and rulings R22–R23 by inspection. No files modified. Go cannot run here; I did not run tests or builds. I inspected the tests and implementer’s reported evidence.

Round-2 finding

N1 — ADDRESSED within the ruled scope.

• Persisted attribution: buildstate.go:113 adds optional Account/App fields without changing schema validation or legacy decoding. DecidedFor requires both identities to be non-empty and match the route.
• Every production write: updatetarget.go:274 stamps identity after copying any previous record. Both production publication paths—adopt.go:2197 and adopt.go:2229—use this constructor; the fence preserves those fields.
• Updates report: updatesreport.go:61 rejects legacy or mismatched attribution. Its early exit suppresses Desired, Reason, Detail, Baking, Completed, CompletedFailed and Pending, including the build-state watermark fallback. Major remains sourced solely from the current route’s settings, as R22 permits.
• Control socket: updatesreport.go:130 applies the same identity check before adding Desired/Reason, satisfying R23.
• Regression coverage: updatesreport_test.go:211 exercises reassignment, legacy attribution, matching attribution and partial/mismatched identities. adoptsettings_test.go:951 exercises both root write paths.

New findings in the fix diff

None at [P1], [P2] or [P3].

Root’s install decisions and request bookkeeping are unchanged. No platform-specific dependencies or build constraints were introduced; release already depends on registry. Inspection found no cross-platform build regression. The implementer reports successful Darwin, Windows and Linux-arm64 builds; I did not independently execute them.

Out of scope

The parked plan-4 notes are correctly outside this fix’s scope:

• Root and the held-wake logic still trust previous-tenant completion/resolution data. NextConsumed can retain that bookkeeping when stamping the new identity. This remains a substantive follow-up, explicitly excluded by R22; acceptance does not certify its correctness.
• In-place registry Upsert preserves empty settings/build-state columns at registry.go:1162. That behavior predates this diff.
• Copy approval and remaining execution gates, including sandbox-blocked socket tests, remain separate from this inspection verdict.