# Astra: review plan 2b (region HA spec 2, joining mode and automatic enrolment)

**Plan:** `docs/superpowers/plans/2026-10-17-region-ha-2b-joining.md`, 9 tasks.
**Copy record:** `docs/superpowers/plans/2026-10-17-region-ha-2b-copy.md`.
**Spec:** `docs/superpowers/specs/2026-10-15-region-ha-two-box-regions-design.md`, rev 15, especially §5 and §25.
**Plan 2a:** merged as 6834659c. This plan builds on its seams.

The plan's code was dry-run on main 6834659c and replayed task by task.

**Controller rulings already made on the plan's open questions:**
- Q2: enrol into the console's own namespace and `default` pool.
- Q5: 2c grants no `DescribeAutoScalingGroups`.
- Q6: enrolling on the invite's confirmation while it is still fresh is acceptable.
- Q1 (who writes a region's `GroupName`/`GroupARN` and initialises the roster) is asked of platform-1e.

**Judge:**
1. **Spec coverage for 2b's scope:**
   - mode selection;
   - joining mode (no edges file, no admission, health 503);
   - the enrolment sequence against `internal/hostactors` exactly: attempts, the one-minute confirmation freshness, the invitation, guard-ready, `EnrollAutomatic`, and group-role inheritance;
   - the channel-release install with both slots and the floor;
   - `host.env` from SSM;
   - §25.
2. **Safety:**
   - Can a box admit, serve, or be referenced before it is enrolled and armed?
   - Can a non-member be confirmed?
   - Can the confirmer or enrolment pass be driven by forged bucket objects?
   - Is root's `carlos system join` path safe: the path unit, and guard-arm in process?
3. **Fail-closed behaviour.** Is every unreadable fact "unknown" and retried, never a definite negative or positive?
4. **Box-label collisions.** Box references come from the 1,600-value status label space. Under an Auto Scaling group that replaces boxes, how likely is a collision, and what happens then? Is it a P-level issue for 2b?
5. **Census.** The new authority rows (`runHostEnv`, `channelInstall.run`, the join units), the new legacy rows (`Directory.ConfirmPass`, `AutoEnroller.inputs`) and the re-digests of `runSystem`/`systemVerb`. Is anything unflagged, including in the console claim-authority census?
6. **Copy.** Does every sentence a person reads have a row? Is the record proportionate, given that it has 61 rows?

Give findings P1/P2/P3 with plan section or file:line and a failure scenario. End with a verdict: ready to build, or not.