carlos / platform Public

Verdict: do not approve the dormant merge at 03212a8b. One new P2 finding.

1. P2 — Replacing a target invalidates the prepared-authority stamp check. movesfiles.go:734 requires prepared_authority.InstallStamp == install_stamp. But replacing a terminated target at installed, or before P’s first admission in probing, deliberately retains P and its prepared authority while issuing a new installation stamp. ToInstalled does not run again. The replacement can complete its own local install and admit P, then deterministically fail C8 establishment on this comparison. Preserve the distinction between P’s build stamp and the replacement’s local-install stamp, and cover this replacement path through the real provider.

The original four round-6 failures are addressed, but the prepared-authority fix introduces this replacement failure. Otherwise, operation-kind selection and the digest/exact-version checks are sound. Treating foreign rows as flat matches the exec backend.

Plan 15 records P through shared AdmitWriter/Update; no relocation-specific provenance write is missing. With origins disabled, probing fails closed. Activation still requires origin recording and backfill of unproven existing file origins. The old prefix mismatch caused active-location parks to refuse unclassified keys, rather than delete live files.

Focused tests could not start: the read-only sandbox blocked Go’s build-directory creation. The full internal/host suite was not run.

---

FIRST PROMPT: Review round 7 at 03212a8b, read-only, without the full host suite.

WHAT: Assess the round-6 fixes and Plan 15 integration.

STATUS: One new P2; dormant-merge approval withheld.

NEEDED: Nothing for this review.

RECOMMENDED: Fix replacement stamp handling and test replacement-before-P with the real provider.

SESSION: Safe to close; no files changed or background processes started.