| 1 | # Astra: relocation × moves C8 provider, round 7 |
| 2 | |
| 3 | Round 6 (`CODEX-REVIEW-L18-MERGE-6.md`) raised four P2s, plus a CI vet failure. Fixes: |
| 4 | |
| 5 | - 4607728c: the vet fix. `wireClaimAdmission`'s test call gets one more nil. |
| 6 | - 52449165, finding 1: |
| 7 | - one files-prefix rule, `moves.GenerationFilesPrefix` (`<location>/files/g-<generation>/`); |
| 8 | - main's `movesFilesPrefix`, the park view's files live set, and every relocation site (pinner, allowed-reference rule, build, prepared verifier, install, release flush, probe evidence) delegate to it. |
| 9 | - The builder found the old layout was not a data-loss hole. The park classifier placed relocation's `files/<gen>/` keys in no generation, and every park path refuses an unplaced key in the holder's location, so parks stalled rather than deleting anything. Check that claim. |
| 10 | - e77d5912, findings 2 to 4: |
| 11 | - **Env path.** The provider finds the env file through the host's registry row, as the launch source does. A nested row's file is read beneath its instance directory. A fenced, conflicting, missing or moved row refuses. A "foreign" row (a non-default DB or socket path) is treated as flat, because that is where the launch source writes its env. Judge this choice. |
| 12 | - **Prepared authority.** The reader is chosen by the claim's op kind. For relocation, it reads `prepared_authority`'s digest and stamp, the `local_install` receipt's journal digest, and a new install-journal `files_manifest` step (key, op, stamp, sha256, exact version). |
| 13 | - **Empty database.** A relocating P's opening is treated as prepared even when its database is empty. It starts from P's files, by CAS over P's manifest, without setting `in.Prepared`, which drives DB publication. |
| 14 | - 6317c1af merges main again: `moves-plan15-proof`, the two-box sim, and `settings-5-surfaces`. |
| 15 | - Plan 15 replaced the provider's origin fallback with `ClaimOriginProof` and gave the provider the claims store. Relocation's fixes were carried onto that. |
| 16 | - Under Plan 15, admissions are recorded only with `CARLOS_HOST_CLAIM_ORIGINS` on, so relocation's provider tests set it. Without it, main's proof refuses P. |
| 17 | |
| 18 | **Judge:** |
| 19 | 1. Are round 6's four findings closed? |
| 20 | 2. Is the relocation prepared-authority reader exactly as strong as the moves journal check, and is its selection by op kind sound? |
| 21 | 3. Is the foreign-row-as-flat choice safe? |
| 22 | 4. Did the Plan 15 merge leave anything relocation must now carry? In particular, does relocation's P admission need origin provenance it doesn't record, and does the `CARLOS_HOST_CLAIM_ORIGINS` dependency leave relocation unable to probe when it's off, or able to probe unsafely? |
| 23 | 5. Anything new in these diffs? |
| 24 | 6. **Verdict:** may relocation merge dormant? |
| 25 | |
| 26 | Give findings P1/P2/P3 with file:line. Report only new items. |
| 27 | |
amadan