Astra: the L18 joint round (stage B Task 11), the merge gate for relocation

Review the two-box hostlife model on region-ha-two-box-build at 295f31a6, against the built relocation on region-ha-1b-next-build at 2f73d941. The relocation build is stage A plus R9 and J3 plus stage B (Tasks 8a to 10b), with main merged in. Both worktrees are on this machine:

• /home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-two-box-build
• /home/paulca/amadan.net/carlos/platform/.claude/worktrees/region-ha-1b-next-build

Earlier joint rounds:

• Round 1 (CODEX-REVIEW-TWO-BOX-R1.md on the two-box branch) found J1, J2 and J3.
• J1 was closed in round 3.
• J2 (moves' parks keep the files live set, protected on the source until the commit) is now on main: internal/host/movesfileslive_test.go and moves Plan 5.
• J3 (a committed landing whose target is terminated becomes a same-region failover, keeping the landing's op id) is hostclaim.ConvertCommittedLanding on the 1b-next branch. The model was changed to keep the op id (e814ece3).

What this round decides: whether relocation may merge, dormant behind CARLOS_REGION_HA, with stage B's activation record (plan Task 10 step 9) as the switch-on gate.

Judge the model against the built code on:

1. J2. Do main's moves parks honour the region-qualified files live set as the model does (rule files-live-set-moves-parks, files-home-move-phases)?
2. J3. Does ConvertCommittedLanding, including main's new @home mapping, match the model's conversion on both sides of the commit?
3. The one-cold-restart completion (ruling 49): probe stop, then C10's discharge, then the hold release and owned-fence lift, then the mark (ruling 80), then N6's serving handover. Does the model's completion reach the same states and refuse the same cases? This includes the completion barrier for successors (relocations and moves), and the completion pass running whenever claim mode is on (ruling 82).
4. A drain under ruling 28's order, and a probe-failed target. Drains stay off until C1 and C4. Say whether the model and the code agree on what is refused.
5. Task 10b. The source's row is held from its fence's close until its park-local. Does the model's routing assume anything the code doesn't do?
6. Any model rule or witness with no counterpart in the built code, or code behaviour the model does not cover that matters for safety.

Give findings P1/P2/P3 with file:line. End with a verdict: relocation may merge dormant, or not.