Reviewed rev 5 at `761b8eb1` against the clean worktree, after reading AGENTS.md, rounds 1–4, and the dispositions in **§21**. “Resolved” below means resolved in the design; implementation remains ahead.

| Round-1 finding | Status | Why |
|---|---|---|
| 1. Picker bypasses pool exclusion | Resolved | Pooled manifests yield no candidates or guess; target boxes must positively advertise shared-pool eligibility. |
| 2. Browser adoption changes the default | Resolved | `@auto` remains distinct from an explicit choice, and inference follows adoption detection. |
| 3. Unnamed home prevents override | Resolved | Non-home app defaults require a named home, providing an explicit-home override. |
| 4. Mixed versions and rollback unspecified | Resolved | Read-first rollout, switch behavior, and the region-aware binary floor are specified; R7 settles enforcement. |
| 5. Existing-canary `--region` undefined | Resolved | Equal proceeds; different refuses before mutation or upload. Fleet placement now has a consistent refusal before either branch. |
| 6. Manifest absence versus failure unspecified | Resolved | Absent, known, and unreadable policies have distinct behavior; legacy topology remains available. |
| 7. Unavailable-default explanation disappears | Resolved | `app_default` represents absent regions, and C8 does not depend on the number of alternatives. |
| 8. Query hints reflected by redirects | Resolved | Hints use POST bodies, with privacy assertions covering redirects, errors, logs, and audit. |

**No new P1, P2, or P3 findings.** The three round-4 corrections are sufficient at design level.

The requested checks support proceeding:

- **Create precedence:** The insertion follows placement resolution and precedes replica validation, policy validation, and the armed gate in [apiinstances.go:763](/home/paulca/amadan.net/carlos/platform-nearest-region/internal/console/apiinstances.go:763). Its conditions preserve fleet, pool, replica, static, and address-backed exclusions. [DerivesPaths:343](/home/paulca/amadan.net/carlos/platform-nearest-region/internal/provision/provision.go:343) matches the intended socket-backed shape; sidecars retain their separate door.
- **Migration:** ALTERs precede `migrateAppsKey` at [store.go:402](/home/paulca/amadan.net/carlos/platform-nearest-region/internal/console/store.go:402). §5.2 correctly requires updating the rebuild DDL and both sides of the copy at [store.go:487](/home/paulca/amadan.net/carlos/platform-nearest-region/internal/console/store.go:487).
- **Compatibility:** The existing permissive request decoder at [authcli.go:945](/home/paulca/amadan.net/carlos/platform-nearest-region/internal/console/authcli.go:945) and response unmarshalling at [apimode.go:1013](/home/paulca/amadan.net/carlos/platform-nearest-region/apimode.go:1013) support additive fields. Existing apps retain their home default.
- **Policy and availability:** §6.4 constrains every non-null guess through the normalized allow-list predicate; §7 rechecks placement before writing. A stale guess can be refused, but cannot bypass policy. Migrated apps avoid the new non-home eligibility refusal. For non-home apps, explicit overrides remain policy-bound: if all allowed destinations are unavailable, capacity or policy must be repaired.
- **Privacy:** The proposed persistent fields contain only region and source. Request-local hints and coordinates require no retention; POST bodies avoid the query reflection at [server.go:1306](/home/paulca/amadan.net/carlos/platform-nearest-region/internal/console/server.go:1306).
- **Rollout:** Box publication precedes activation, region-aware reads survive switch-off, and the new service gate checks actual public and cross-edge requests. That addresses the separate mesh-key dependency at [edge.go:2699](/home/paulca/amadan.net/carlos/platform-nearest-region/internal/edge/edge.go:2699). Phase L remains gated separately under R8.

There are **no open questions to answer** in this revision: §17 contains rollout, and §18 explicitly says none. The earlier completion, latency-sequencing, and rollback questions are settled by R5, R8, and R7 respectively.

All code citations above were checked. No files changed, no tests ran, and production configuration was not inspected.

**Verdict: ready for planning.** The placement design now defines the necessary precedence, migration, compatibility, privacy, and rollout safeguards without depending on Phase L.