carlos / platform Public

Verdict: no—two new P2 findings block the dormant merge. Reviewed build 5fbe1824 against model eaa08175.

1. P2 — Relocation probes lose the newly required staged identity. relocationwake.go:146 copies l.Version but omits Staged: l.Staged. With production’s BeforeExec hook enabled, the merged activator rejects the empty staged version before restore or execution (beforeexec.go:90). Relocation probes therefore cannot start. Forward the identity and cover the launch with BeforeExec enabled.

1. P2 — The model drops source protection for dirty returns without target admission. regionha_test.go:2641 treats every dirty return as having a target admission. However, SrcCovered=false makes a return dirty even when the target never admitted. The helper then removes source-files protection and excludes the interval from INV-30. Built code explicitly preserves those generations when targetAdmitted is false (movesinstall.go:406). Require admission evidence in the model and add the complementary witness; the new witness always admits the target first.

Finding 1 is closed: movessources.go:502 preserves source authority through releasing and released, until the return CAS. The merged callers retain that protection.

No further regression established in the completion barriers, EndProbe/flushStopped, verified completion-fence exemption, or census/copy gate changes. Targeted tests failed before execution because Go could not create its build directory on the read-only filesystem. The full internal/host suite was not run.

---

FIRST PROMPT: Review the round-4 brief at build 5fbe1824 against model eaa08175, read-only.

WHAT: Determine whether relocation may merge dormant.

STATUS: Review complete: two new P2 findings; finding 1 closed.

NEEDED: Nothing for this review.

RECOMMENDED: Fix both findings, add targeted regression coverage, and rerun the required gates.

SESSION: Safe to close; no files changed or background processes started.