# Astra: relocation × moves C8 provider, round 7

Round 6 (`CODEX-REVIEW-L18-MERGE-6.md`) raised four P2s, plus a CI vet failure. Fixes:

- 4607728c: the vet fix. `wireClaimAdmission`'s test call gets one more nil.
- 52449165, finding 1:
  - one files-prefix rule, `moves.GenerationFilesPrefix` (`<location>/files/g-<generation>/`);
  - main's `movesFilesPrefix`, the park view's files live set, and every relocation site (pinner, allowed-reference rule, build, prepared verifier, install, release flush, probe evidence) delegate to it.
  - The builder found the old layout was not a data-loss hole. The park classifier placed relocation's `files/<gen>/` keys in no generation, and every park path refuses an unplaced key in the holder's location, so parks stalled rather than deleting anything. Check that claim.
- e77d5912, findings 2 to 4:
  - **Env path.** The provider finds the env file through the host's registry row, as the launch source does. A nested row's file is read beneath its instance directory. A fenced, conflicting, missing or moved row refuses. A "foreign" row (a non-default DB or socket path) is treated as flat, because that is where the launch source writes its env. Judge this choice.
  - **Prepared authority.** The reader is chosen by the claim's op kind. For relocation, it reads `prepared_authority`'s digest and stamp, the `local_install` receipt's journal digest, and a new install-journal `files_manifest` step (key, op, stamp, sha256, exact version).
  - **Empty database.** A relocating P's opening is treated as prepared even when its database is empty. It starts from P's files, by CAS over P's manifest, without setting `in.Prepared`, which drives DB publication.
- 6317c1af merges main again: `moves-plan15-proof`, the two-box sim, and `settings-5-surfaces`.
  - Plan 15 replaced the provider's origin fallback with `ClaimOriginProof` and gave the provider the claims store. Relocation's fixes were carried onto that.
  - Under Plan 15, admissions are recorded only with `CARLOS_HOST_CLAIM_ORIGINS` on, so relocation's provider tests set it. Without it, main's proof refuses P.

**Judge:**
1. Are round 6's four findings closed?
2. Is the relocation prepared-authority reader exactly as strong as the moves journal check, and is its selection by op kind sound?
3. Is the foreign-row-as-flat choice safe?
4. Did the Plan 15 merge leave anything relocation must now carry? In particular, does relocation's P admission need origin provenance it doesn't record, and does the `CARLOS_HOST_CLAIM_ORIGINS` dependency leave relocation unable to probe when it's off, or able to probe unsafely?
5. Anything new in these diffs?
6. **Verdict:** may relocation merge dormant?

Give findings P1/P2/P3 with file:line. Report only new items.