carlos / platform Public

Verdict: do not approve the dormant merge at f624686e. One new P2.

P2 — Replacement targets never activate their new install guard. relocationinstall.go:504

Replacing a target at installed, or in probing before P opens, resumes at installed with a fresh stamp. The participant calls InstallLocal, which requires that stamp already active. Activation runs only through the build at installing; its authority check also accepts only that phase.

Main’s reconciler cannot fill the gap: reconcile.go:212 explicitly refuses the relocating executor’s activation path. Wake activation happens after admission, which requires completing this installation first. A fresh replacement therefore fails with ErrNoRecord; an existing mismatched record fails with ErrStampMismatch. It stalls; it does not proceed unguarded.

The new regression fixture masks this by calling Guard.Activate directly. Add production activation for the replacement’s unopened installation, preserving the local-authority checks and retired-stamp refusal, and test the participant path without fixture activation.

Round 7’s stamp-binding P2 is closed: the prepared manifest binds P’s build stamp, while the receipt and installation journal bind the replacement’s stamp. Equality remains valid for the original target; replacement stamps are later. No other new findings in the two diffs. The release-test change matches VerifyHeldLive’s current implementation.

Static review only; git diff --check passed. No tests run, including the full internal/host suite.

---

FIRST PROMPT: Review round 8 at f624686e, read-only, without the full host suite.

WHAT: Assess the stamp fix, replacement guard activation, and dormant-merge readiness.

STATUS: Round 7 finding closed; one new P2 blocks approval.

NEEDED: Nothing for this review.

RECOMMENDED: Fix replacement guard activation and test without direct fixture activation.

SESSION: Safe to close; no files changed or background processes started.