| 1 | # Astra: relocation round 8 |
| 2 | |
| 3 | Round 7 (`CODEX-REVIEW-L18-MERGE-7.md`) raised one P2: a replaced target's new install stamp failed the prepared-authority stamp check. Two commits since: |
| 4 | |
| 5 | - **15ffddfa, the round-7 fix.** |
| 6 | - The install journal's `files_manifest` step now records P's build stamp, the one `prepared_authority` binds, alongside key, op, digest and exact version. The install reads the prepared authority to get it, and refuses one with no build stamp, or a manifest whose digest isn't the authority's. |
| 7 | - The reader checks the step against `prepared_authority` exactly. It checks the holder's stamp, this box's `local_install` receipt and its install journal against the current install stamp. It also requires build stamp < install stamp. |
| 8 | - Tests cover replacement at `installed`, and in `probing` before P's first admission, through the real provider. Each failed on the old code. They also cover refusing a stale install journal from the replaced box, and refusing an authority stamp at or past the install stamp. A mutation check (step checked against the install stamp) kills both positives. |
| 9 | - **a9610787, a CI fix.** On 03212a8b, `internal/release` `TestVerifyHeldLiveUnderReadsUnderTheClaim` asserted that `VerifyHeldLive` refuses under `CARLOS_HOST_CLAIM`. Main (moves-phase1-5f, Paul's T7 ruling) made `VerifyHeldLive` read under the claim, because it writes nothing. The test now asserts that it passes. No relocation code calls `VerifyHeldLive`. |
| 10 | |
| 11 | **Open question the builder raised; please trace it.** When a target is replaced at `installed`, what activates the replacement box's install guard at the new stamp? The builder found the guard activated only during the build, while the install refuses any other stamp. The test activates it directly. Main's reconciler may cover it, but the builder didn't trace that. Is this a real gap, meaning a replacement at `installed` never progresses or progresses unguarded? Or is it covered, and where? Check `hostclaim/relocation.go` around the replacement transition, relocation's install and build paths, and the guard activation sites. |
| 12 | |
| 13 | **Judge:** |
| 14 | 1. Is round 7's P2 closed? |
| 15 | 2. The guard-activation question above. |
| 16 | 3. Anything new in these two diffs? |
| 17 | 4. **Verdict:** may relocation merge dormant? |
| 18 | |
| 19 | Give findings P1/P2/P3 with file:line. Report only new items. |
| 20 | |
amadan