Astra: relocation × moves C8 provider, round 7

Round 6 (CODEX-REVIEW-L18-MERGE-6.md) raised four P2s, plus a CI vet failure. Fixes:

• 4607728c: the vet fix. wireClaimAdmission's test call gets one more nil.
• 52449165, finding 1: - one files-prefix rule, moves.GenerationFilesPrefix (<location>/files/g-<generation>/); - main's movesFilesPrefix, the park view's files live set, and every relocation site (pinner, allowed-reference rule, build, prepared verifier, install, release flush, probe evidence) delegate to it. - The builder found the old layout was not a data-loss hole. The park classifier placed relocation's files/<gen>/ keys in no generation, and every park path refuses an unplaced key in the holder's location, so parks stalled rather than deleting anything. Check that claim.
• e77d5912, findings 2 to 4: - Env path. The provider finds the env file through the host's registry row, as the launch source does. A nested row's file is read beneath its instance directory. A fenced, conflicting, missing or moved row refuses. A "foreign" row (a non-default DB or socket path) is treated as flat, because that is where the launch source writes its env. Judge this choice. - Prepared authority. The reader is chosen by the claim's op kind. For relocation, it reads prepared_authority's digest and stamp, the local_install receipt's journal digest, and a new install-journal files_manifest step (key, op, stamp, sha256, exact version). - Empty database. A relocating P's opening is treated as prepared even when its database is empty. It starts from P's files, by CAS over P's manifest, without setting in.Prepared, which drives DB publication.
• 6317c1af merges main again: moves-plan15-proof, the two-box sim, and settings-5-surfaces. - Plan 15 replaced the provider's origin fallback with ClaimOriginProof and gave the provider the claims store. Relocation's fixes were carried onto that. - Under Plan 15, admissions are recorded only with CARLOS_HOST_CLAIM_ORIGINS on, so relocation's provider tests set it. Without it, main's proof refuses P.

Judge:

1. Are round 6's four findings closed?
2. Is the relocation prepared-authority reader exactly as strong as the moves journal check, and is its selection by op kind sound?
3. Is the foreign-row-as-flat choice safe?
4. Did the Plan 15 merge leave anything relocation must now carry? In particular, does relocation's P admission need origin provenance it doesn't record, and does the CARLOS_HOST_CLAIM_ORIGINS dependency leave relocation unable to probe when it's off, or able to probe unsafely?
5. Anything new in these diffs?
6. Verdict: may relocation merge dormant?

Give findings P1/P2/P3 with file:line. Report only new items.