carlos / platform Public

Verdict: do not approve the dormant merge at 1887a22a. Four new P2 integration findings:

1. Files prefixes disagree. movesfiles.go:131 uses <location>/files/g-<generation>/; relocation’s pinner, builder, installer and flush use files/<generation>/. A failover cannot find manifests published by the new provider, and that provider cannot consume relocation’s prepared manifest. Both paths need one prefix contract.

1. The provider reads the wrong env path. claimfiles.go:115 hardcodes <dataDir>/<host>.env. Relocation always installs a nested instance and places its env there. Establish reads the flat path before handling prepared files, so a clean target’s first probe fails; a stale flat file supplies incorrect configuration instead.

1. Prepared publication requires a journal relocation never writes. movesfiles.go:634 requires .moves/<host>/<generation>/journal.json with a files_manifest binding. Relocation writes relocate/ops/<op>/install.json and claim prepared_authority. Consequently, every nonempty first probe fails this check even after correcting the paths. The provider needs a relocation-compatible prepared-authority reader.

1. Empty database bypasses prepared files. relocationwake.go:180 sets Empty=true, leaving Prepared=false, although relocation always builds P’s files manifest. The new provider consequently starts from an empty manifest instead of consuming P. With prefixes aligned, its create-only commit collides with the existing prepared manifest—even for an empty bootstrap. Files preparation must be handled independently of database emptiness.

The explicit conflict resolutions look correct; shared admission updates record provenance automatically. Targeted tests could not start because Go’s build-directory creation was blocked by the read-only filesystem. The full internal/host suite was not run.

---

FIRST PROMPT: Review round 6 at 1887a22a, read-only, without the full host suite.

WHAT: Check the main merge for new relocation incompatibilities.

STATUS: Four new P2 findings; approval withheld.

NEEDED: Nothing for this review.

RECOMMENDED: Fix the four contracts and test relocation with the real files provider.

SESSION: Safe to close; no files changed or background processes started.