# Final whole-branch review brief: offline operator move (moves-offline)

You are an independent reviewer (Astra). Review the WHOLE branch `moves-offline` against `main`, merge base `git merge-base HEAD origin/main`. The tip is ae122d78 or later. This is the final gate before merge. Built pieces have each had task-level reviews already; your job is whole-branch correctness and safety.

## What it is

An operator-run, planned-downtime move of one instance between regions. It is used on the production fleet with no host claim, and the first use is three customer instances moving Ireland to UK. The plan is docs/superpowers/plans/2026-10-20-offline-operator-move.md, the authority, including its "Ruling 2026-10-20" block. The decisions ledger is in that plan, plus the in-code comments.

## The three properties that must hold

1. **Stop means stopped.**
   - Before seal, every source-region box holds the row and fences it.
   - A create-only tombstone lease `moved:<id>` in the source data bucket is written at seal, AFTER the checkpoint, and the final position is read after it.
   - No wake on any source-region box can write after the final position. That includes a restarted agent, a due wake, adoption, config sync, edge, timers, `carlos run` and a second home box.
   - A lost tombstone after seal is a lost stop, and is never re-taken.
2. **Every half-failure has a path that loses no write and leaves no two live copies.** That covers abort before flip, a target revert after flip and before open, a crash at any step with a rerun, and the one-host-at-a-time lock.
3. **Every dependency moves.** The db at the sealed position, the files tree (nested and flat, with launch.* files not carried, and the no-files-dir case), `<host>.env` (instance key), config.env (store binding), timers, next-due, replication and the env pin. App settings move; box settings don't. The target proves every item against the immutable seal.json before open.

## Also check

- **Dormant safety.** With no offline record anywhere, box and console behaviour is identical to main. The capability string is the only edges-file change. Nothing here is reachable without an operator.
- **Claims.** Claim-mode consoles and claims-on boxes are refused from published evidence (rule 3). No writes to control/hosts/, control/host-census/, control/host-actors.json, admissions or domains claims. Record writes go only through provision's transitions with record_seq. Nothing does a raw Put of a record.
- **Root.** Root has no new code path. The target build is staged through ordinary adoption only.
- **Copy.** Every operator-visible string is a recorded copy row. No err.Error() is shown to operators except the allow-listed diagnostics.
- **Cross-platform.** Builds on darwin and windows; linux-only syscalls are tagged.
- **Census.** The overlay at internal/provision/testdata/plan14-root-reads-moves-offline.tsv and docs/superpowers/notes/census-proposal-moves-offline.md. Are any unit classifications wrong?

## Output

Write findings with a severity (BLOCKER/HIGH/MEDIUM/LOW), each with file:line, a concrete failure scenario and a fix. Verify every claim against the code. Finish with a verdict: MERGE, MERGE AFTER FIXES (list them), or DO NOT MERGE.