A10-1 through A10-4 are closed at design level. One new finding:

**P2 — Rollback’s placement exclusion does not survive box replacement.**  
[Spec:357](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-two-box/docs/superpowers/specs/2026-10-15-region-ha-two-box-regions-design.md:357)

Rollback sets the two current group boxes to `legacy`, but leaves automatic replacement and enrolment running. [§10 explicitly makes replacements placeable](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-two-box/docs/superpowers/specs/2026-10-15-region-ha-two-box-regions-design.md:375). The exclusion belongs to each box’s roster entry; no group-level exclusion or inheritance is specified.

**Failure scenario:** rollback excludes both boxes after a group boot/configuration problem. One fails and is replaced. Its replacement enrols under a new reference and accepts new customer instances into the group the operator rolled back. A replacement already joining during rollback has the same gap.

Persist the exclusion for the group and enforce it before replacements become eligible. Rehearse replacement during and after rollback.

Reviewed platform `6f88e541` and flagship `7c99ff8f`. No files changed; no builds, tests or infrastructure commands run.

---

**FIRST PROMPT:**  
Review spec 2 round 11 at the pinned HEAD against flagship tofu, read-only.

**WHAT:**  
Confirm the previous fixes and report new findings.

**STATUS:**  
Four findings closed; one new P2.

**NEEDED:**  
Nothing.

**RECOMMENDED:**  
Make rollback’s placement exclusion survive replacement.

**SESSION:**  
Safe to close; nothing modified or left running.

**Verdict: not ready for a plan.**