Reviewed HEAD `f649d972825a085aa444b30687b093d38dab7ae4`.

1. **P2 — Replica exclusion stops minting, but still delivers configured keys.** [Plan:1546](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/instance-key-provision/docs/superpowers/plans/2026-10-10-instance-key-provision.md:1546)  
   Returning `InstanceKeyReplica` leaves environment composition unchanged. A home can retain platform key A in its own env while configuration supplies B; the replica receives B because it has no minted override. `InstanceKey("")` then returns B successfully. The adoption endpoint’s 409 cannot enforce refusal because the helper explicitly ignores failures and returns the key ([plan:604](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/instance-key-provision/docs/superpowers/plans/2026-10-10-instance-key-provision.md:604)). This permits the wrong key over the home’s replicated data, contrary to ruling 17’s promised exclusion. Enforce the exclusion at key delivery/resolution, and test an actual replica launch with configured and pre-existing env keys.

2. **P3 — The final dependency order contradicts the shipping gate.** [Plan:3585](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/instance-key-provision/docs/superpowers/plans/2026-10-10-instance-key-provision.md:3585)  
   “O6 and O7 … in that order” conflicts with ruling 24 and O6’s explicit requirement that O7 ship first. Correct the final instruction so it cannot direct implementation back into R2-5’s artifact-retirement defect.

The five round 2 findings are addressed **at the plan-contract level**:

- **R2-1/2:** configuration presence no longer counts; adoption identifies the key, and installation checks its pinned digest.
- **R2-3:** writer binding and admission-time invalidation reject stale-session and rollback records.
- **R2-4:** the relay supplies continuous publication; O6 explicitly gates relocation. A lost first report causes refusal.
- **R2-5:** O7 specifies retirement, inventory and rollback handling before the writer ships, subject to correcting finding 2 above.

The `source` check is sound as specified: the agent derives it and the digest from the launch’s actual environment layers, then checks the helper’s echo against captured launch state. Replica adoption evidence is refused; finding 1 concerns the process still using the delivered key.

The configured-secret digest warrants the existing **P3 note**. A public per-host salt would reduce cross-host correlation and reusable guessing work, but would still permit guessing weak keys. It need not block this plan under the stated threat model.

Static review only; I did not independently compile or execute the proposed snippets.

---

**FIRST PROMPT:**
Review the instance-key plan at HEAD using the round 3 brief.

**WHAT:**
Assess whether the revised plan is ready to build.

**STATUS:**
Review complete: one P2 and one P3. No files changed.

**NEEDED:**
Nothing for this review.

**RECOMMENDED:**
Close the replica delivery gap and correct the dependency order.

**SESSION:**
Safe to close; no processes or scratch files left behind.

**Verdict: not ready to build.**