carlos / platform Public

• P2 — A delayed reconcile can miss the source hold permanently. Plan:15689 wires the hooks without changing the production CheckLocal path. If the source’s fence closes, but its next reconcile occurs after ToInstalling advances holder.stamp, EmptyInstallationCensus.CheckLocal looks for the target’s new installation stamp on the source. That inventory is absent; the existing source row then causes ErrTypedInventory (empty_census.go:58). Reconcile returns before holdOnly, leaving the stopped source’s row ready. Subsequent passes cannot repair it; a stuck operation can preserve this indefinitely.

The proposed tests miss this: their source fixtures stub CheckLocal to return nil (plan:15214), while the assembly test checks only hook presence. Add a test using the real adapter and census, with the first post-fence reconcile delayed until installing. Make the hold-only check validate the source’s existing installation without requiring the target’s stamp or granting installation authority.

No P1 or additional P3 findings. The durable fence, guarded SetHoldIf, unreadable-state refusals, and flag wiring otherwise fit the stated decisions. Keeping an established source hold until retirement is consistent with M2: the target serves meanwhile. Relocation has no cancel path; stuck operations already require operator recovery.

The registry contract test intentionally passes without the new code; the other five cannot compile without the proposed helpers. Their reported mutation results do not cover the production-census gap above.

Reviewed HEAD 5791475f. Static review only; no files changed or tests run in this read-only sandbox. The existing activation gates remain necessary.

Verdict: not ready to build.