Reviewed HEAD `1297aa7547fa51f41a14d866b7faef2e6943c4b9` read-only. No builds or tests run; working tree unchanged. Findings concern the proposed implementation.

| Open round-3 item | Status | Assessment |
|---|---|---|
| Unresolved group reference overwrites legacy status | **Closed** | `groupStatusTick` publishes nothing until resolution succeeds and retries on subsequent ticks, independently of both flags. |
| Historical reports exhaust the 200-key cap | **Closed** | `ListMod` pages the listing; old entries are filtered before GETs and the cap. Content-freshness checks remain. |
| Remove redundant freshness pre-checks | **Closed** | Both removed; the bound store remains the write enforcement point. |
| Stop/start versus reboot verification | **Partly** | Explicit activation gate retained; the dev observation remains outstanding. This alone does not block implementation. |

The deadline actually starts at **describe start**, which is stricter than your summary and permitted by spec rev 18.

New findings:

1. **P2 — A successful return after the deadline bypasses unknown-outcome recovery.**  
   [`inFlight`, plan line 3224](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-2b/docs/superpowers/plans/2026-10-17-region-ha-2b-joining.md:3224) checks cancellation only when the underlying operation returns an error. A context-ignoring store such as `DirStore` can begin its roster write before the deadline, finish afterward, and return `nil`. Enrolment then succeeds without recording an unknown outcome or scheduling the fresh describe.

   This contradicts the stated requirement that a commit not confirmed before the deadline enters recovery. Check the bound after the operation, including successful returns. Add a test whose `Put` completes successfully after expiry; the current in-flight test always returns `ctx.Err()`.

2. **P2 — Read-back accepts a stale describe as fresh.**  
   [`readBack`, plan line 4745](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-2b/docs/superpowers/plans/2026-10-17-region-ha-2b-joining.md:4745) calls `confirmMembership` directly and never calls `c.fresh`. That helper validates membership fields but does not enforce elapsed time.

   If the group read succeeds and the subsequent instance read stalls beyond 60 seconds, read-back accepts the old membership answer, logs “a fresh read confirms membership,” and deletes the recovery entry. Apply the freshness check before settling the entry; stale answers should retain it for retry. Test a successful describe taking exactly 60 seconds.

3. **P2 — Failed paging permanently discards the only automatic escalation.**  
   [`readBack`, plan line 4753](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-2b/docs/superpowers/plans/2026-10-17-region-ha-2b-joining.md:4753) deletes the recovery entry unconditionally after `pageNotMember`. That function only logs delivery errors.

   A temporary alert-sink failure therefore leaves a detached, running instance enrolled indefinitely without delivering the required page. Subsequent passes skip its existing roster entry. Preserve pending notification state and retry with backoff; suppress further sends after success. Add a failed-delivery-then-success test.

4. **P2 — The host.env directory check does not establish a protected write path.**  
   [`runHostEnv`, plan line 1415](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-2b/docs/superpowers/plans/2026-10-17-region-ha-2b-joining.md:1415) checks only the immediate directory’s ownership and type. It accepts a root-owned directory writable by other users, follows symlinked ancestors, and subsequently reopens the pathname in `hostfloor.Durable`.

   With `--out` beneath a writable ancestor, another user can replace or redirect the checked directory before the write. A writable destination directory also permits replacement of the resulting configuration despite its `0600` mode. Anchor the write to a validated directory descriptor and reject writable or symlinked path components. The current test covers only an immediate-parent symlink.

The allowlist, value validation, roster cross-check, and trigger-content independence are represented. The directory issue above leaves the checked-write condition incomplete.

---

**FIRST PROMPT:**  
Round 4 review of region HA 2b at `1297aa75`.

**WHAT:**  
Reviewed round-3 dispositions and the revised safety paths.

**STATUS:**  
Prior status defects closed; four new P2 findings. **Verdict: not ready to build.**

**NEEDED:**  
Nothing for this review.

**RECOMMENDED:**  
Fix the four gaps and add the boundary tests described above.

**SESSION:**  
Safe to close. No files changed or processes started.