Ruling: core/paths.py is the canonical root resolver

Owner of the call: Min (Sol flagged it as open and deferred it: "The structure of record says core/paths.py — flagged as an open item in the stage doc, Min's call, not silently resolved.")

The collision, measured

A sibling had core/paths.py deleted in the worktree while my registry loader imported it. operation/test/test_paths_guard.py imported the deleted module, so the whole test directory failed to collect — 1 error, and a green-looking tail while the tests never ran.

Restored first. It was one git add -A from being committed, and the window between an uncommitted delete and the next add is the whole risk.

The decision — four pieces of evidence

1 decides it. 2 says the guard here is strictly stronger. 3 is the tie-breaker.4 says the other file was in the wrong lane to begin with — a root resolver is not cost policy.

core/config/paths.py is now a re-export shim — one live home for the logic, a pointer instead of a second copy. RootError aliases SolRootError; _is_forbidden is derived from the same rules _validate applies, so an answer there and a refusal here can never disagree.

🔴 The gap test_paths_adversarial.py found — and it was real

Sol's guard matched V2 roots by exact path:

_V2_ROOTS = (Path("/home/lab/solos2"), ...)
if resolved == bad or bad in resolved.parents:

That refuses /home/lab/solos2 and accepts a copy of the V2 tree anywhere else — a tarball extract, a fixture, a backup. A path named solos2 is not a V3 root wherever it sits, and the result of accepting one is the same: two live databases.

Measured before the fix: _is_forbidden(tmp/solos2) → None (accepted).

The canonical guard refuses it, because it matches path components against the whole resolved path rather than comparing to a list of locations.

A duplication defect I introduced and caught

My first edit added a component check to _validate while leaving the original marker loop in place — the rule written out twice, in the very file that exists to remove duplication.

Found by a red check that refused for the wrong reason: I stripped the new rule and the guard still fired, which meant a second copy was doing the work. Consolidated to one rule, then proved it load-bearing:

One rule, one implementation, provably load-bearing.

Test state — the checksum reconciles

Three tests in tests/test_stage0.py asserted a bare tmp_path is a valid root — a contract the canonical resolver does not offer, since a directory that exists is not thereby the root. Fixtures corrected to V3-shaped, and one NEW MUST-FAIL case added for the structure requirement.

Still open — the duplication that did not go away

Two resolvers became one. Two other pairs remain:

And the shim means core/config/paths.py still exists. That is deliberate — it carries a pointer, not a second answer — but it is a file in Mira's lane whose purpose is now another lane's module. If she objects, the fix is to repoint the callers, not to restore the second implementation.

Not established

• The three tests/test_stage0.py fixes changed test intent. They now match the canonical contract; whether Sol intended the looser contract is his call to confirm, not mine to assume.
• tests/ vs operation/test/ was not consolidated. Both pass, so the duplication is currently harmless — which is exactly how it stops being harmless.
• No sibling was consulted before the ruling. Sol explicitly deferred it; Mira was not asked about the shim in her lane. That is a gap, not a resolution.