# Astra: confirming security review of the tenant-directory fix 3

Your review `CODEX-REVIEW-REGION-HA-TENANT-DIR.md` (P1 FIFO block in Restore, P2 vanished-directory absence) and Opus's (I1 deep-chain walk, M2-M4) are answered in f9123572:

- **P1, the FIFO block.** Restore's directory opens now use `root.OpenFile(rel, O_RDONLY|O_DIRECTORY|O_NONBLOCK|O_NOFOLLOW)`.
- **P2, the vanished directory.** The new `instancefs.OpenBeneathOrAbsent` and `ReadBeneathLimitOrAbsent` hold one directory descriptor, and absence comes only from the lookup beneath it. A directory that does not open is `ErrDirUnopened`. `readInstanceFile` and `Present` both use it.
- **I1, the deep chain.** `walkDir` and `checkManifest` share `withinTreeCap`: 4095 path bytes, 256 components. Anything beyond is `ErrTooDeep`, and ctx is checked at each directory.
- **M2-M4.** Error paths are wrapped with the files dir, a test pins that a missing `/proc` is an error, and one absence implementation remains.

**Judge:**
1. Are P1 and P2 closed?
2. Is anything still blocking or exhaustible on tenant ground?
3. Do the caps break any legitimate tree, or moves' callers?
4. Did the fix introduce anything new?

Give findings P1/P2/P3 with file:line, then a verdict.