| Round-1 finding | Disposition |
|---|---|
| A1: Registration before capacity refusal | **Closed.** Task 11 chooses before `RegisterStart`, carries the selection forward, and tests refusal through recovery. |
| A2: Missing choosing doors | **Partly closed — P2 remains.** The shared refusal reaches all four doors, but Task 12 leaves the move handler’s earlier placement checks intact. A configured destination with no edges file, or only blank public addresses, still returns **400 without an alert** at [apiinstancemove.go:594](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-two-box/internal/console/apiinstancemove.go:594). Test the full HTTP path and route this capacity failure through H27. |
| A3: App-derived region validation | **Closed for both reported scenarios.** Task 11 uses `PlaceableBoxes` and adds HTTP tests for stale boxes and a misconfigured sibling. |
| A4: Move filtering with HA off | **Closed.** `placementChooser` gates the filter on HA; tests cover persisted roles and an unreadable roster. |
| A5: Private dialing with HA off | **Closed.** Task 8 uses the reader’s switch and tests both settings. |
| A6: Restart resets alert limit | **Closed by ruling.** Revised H27 explicitly permits an extra alert after restart. |
| A7: Pending copy exposed | **Closed in the plan.** Built rows must be approved; Tasks 10 and 11 wait for approval. |

Two new findings:

1. **P2 — A capacity-refused create can still change its environment’s store.**  
   Task 11 inserts early selection inside `beginClaimCreate`, but [apiinstances.go:1573](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-two-box/internal/console/apiinstances.go:1573) calls `bindEnvironmentCreate` first. If the requested environment has a seed-owned store, [takeSeedStore](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-two-box/internal/console/seedenvbind.go:76) clears `Declared.Seed` and writes it back. An explicit-region create can therefore change storage ownership, then return the no-capacity 503. Later seed cleanup leaves that store standing despite no instance having been created. Choose before this mutation, and test that the store bytes remain unchanged after refusal.

2. **P2 — Capacity metrics can be published to the wrong AWS region.**  
   [Task 13’s `regionCapacities`](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-two-box/docs/superpowers/plans/2026-10-16-region-ha-2a-core.md:6135) takes the destination AWS region from the last edges file naming each placement. The capacity count, however, uses the signed roster. A stale or misconfigured file naming `placement=uk, region=eu-west-1` can therefore redirect the valid UK count away from `eu-west-2`. The intended alarm receives missing data and reports a capacity problem even when eligible boxes exist. Derive the metric destination from the same authoritative region mapping used by the chooser, and test conflicting edges-file metadata.

Platform-1e’s stated conditions are met by the proposed code on static inspection: private addresses use the configured address source, undergo private-IPv4 and CIDR validation, exclude loopback and link-local addresses, and remain routing data. Writer/source and reader tests cover invalid addresses. `boxRoster` performs only a signed roster read, and both production callers pass the operator gate first.

The census treatment appears complete for the current proposal: all four authority/legacy units and all four B8 digest changes are covered. The overlay must load last, with coverage hashes, unit digests, fingerprints and seals recomputed after Plan 14 Parts 2 and 3. I did not execute the census checks.

---

**FIRST PROMPT:**  
Review plan 2a round 2 at `16939cda`, read-only, without heavy checks.

**WHAT:**  
Check prior findings, census conditions and new defects.

**STATUS:**  
Six findings closed, one partly closed; two new P2 findings. No builds or tests ran.

**NEEDED:**  
Nothing for this review.

**RECOMMENDED:**  
Resolve the three outstanding paths and add the described regression coverage.

**SESSION:**  
Safe to close. HEAD verified; worktree unchanged; no processes started.

**Verdict: not ready to build.**