H25 removes the old-box drain requirement from the forward rollout, but **not from the rollback as written**. Three P2 findings and one P3:

1. **P2 — Destroying the group during rollback still needs settlement.**  
   [Spec:352](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-two-box/docs/superpowers/specs/2026-10-15-region-ha-two-box-regions-design.md:352)

   Rollback restores the old box’s eligibility and relocates group residents before destroying the group. It never excludes the group boxes from new destinations or settles outstanding selections.

   **Failure scenario:** a create selects a group box before rollback, pauses, then completes after its residents have been relocated. Recovery [retains that executor](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-two-box/internal/hostops/production_create.go:257). Destroying the group strands the instance. The post-cut-over rollback inherits this problem through step 4.

   Either retain the group until spec 4, or provide the exclusion and acknowledged settlement needed to retire it safely.

2. **P2 — Rollback cannot relocate a never-woken group instance.**  
   [Spec:352](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-two-box/docs/superpowers/specs/2026-10-15-region-ha-two-box-regions-design.md:352)

   A newly created group instance can still have `Holder.Session == 0`. [Relocation refuses that state](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-two-box/internal/hostrelocate/worker.go:329), and the ordinary wake path [requires `Holder.WriterBox` to name the local box](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-two-box/internal/activator/claimwake.go:182).

   **Failure scenario:** an instance is created during rehearsal but receives no traffic. Rollback cannot return it to the old box, so it cannot safely destroy the group. A9-2 remains relevant to this sequence despite [§22’s moot disposition](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-two-box/docs/superpowers/specs/2026-10-15-region-ha-two-box-regions-design.md:509).

   Retain the group, or explicitly include support for relocating this state.

3. **P2 — Moves need separate source validation and destination eligibility.**  
   [Spec:313](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-two-box/docs/superpowers/specs/2026-10-15-region-ha-two-box-regions-design.md:313)

   The proposed move change describes destination selection. Today, [`selectMoveBoxes`](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-two-box/internal/console/boxselect.go:114) applies the placement predicate to **both** regions, and the move door [requires the selected source to equal the claim’s executor](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-two-box/internal/console/apiinstancemove.go:671).

   **Failure scenario:** after enforcing `legacy`/`platform` exclusion, an existing customer instance on the old box cannot move to another region: its executor is absent from the source candidates. Removing the multiple-box refusal alone does not fix this.

   Specify that the source comes from the claim and is validated as active and unfenced; only the destination gets §7’s placement policy. Test outbound moves from both excluded roles.

4. **P3 — The active forwarding section still requires emptying the old box.**  
   [Spec:240](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-two-box/docs/superpowers/specs/2026-10-15-region-ha-two-box-regions-design.md:240)

   This clause says §9 moves every instance off before transferring the EIP. H25 and the revised §9 explicitly retain those instances.

   **Failure scenario:** a plan following §6 reinstates the drain prerequisite that this revision removes. Replace it with the new-address, forced-publication and reader-refresh transition.

The revised address swap covers the previously identified forwarding and relay requirements at design level. I found no additional blocker in those steps.

Reviewed platform `9c26d974` and flagship `7c99ff8f`. No files changed; no builds, tests or infrastructure commands run.

---

**FIRST PROMPT:**  
Review spec 2 round 10 at the pinned HEAD against flagship tofu, read-only.

**WHAT:**  
Check H25, placement exclusion, address switching, rollback and the full spec.

**STATUS:**  
Complete; three P2 findings and one P3.

**NEEDED:**  
Nothing.

**RECOMMENDED:**  
Resolve group retirement during rollback and distinguish move-source validation from destination selection.

**SESSION:**  
Safe to close; nothing modified or left running.

**Verdict: not ready for a plan.**