# Review brief: region HA spec 1 rev 5.1, round 2

You are an independent second reader. Review
`docs/superpowers/specs/2026-10-04-region-ha-box-placement-design.md` at
the commit named in the prompt, in the repository at the working
directory (Go; carlos platform).

## What changed and why

Rev 5.1 answers your rev 5 round 1 findings
(`CODEX-FINDINGS-REGION-HA-REV5-1.md`, B1-1 to B1-9). §20 is the
disposition table. The mechanisms changed:

- **§5.8 probe attempts (B1-1):** only the first attempt opens the
  prepared generation `P`; later attempts restore from their
  predecessor through `genselect.Select`; coverage is decided per
  admission, `released` only on `P`'s opening with a predecessor
  matching the journaled release (L9).
- **§5.8 local install (B1-2):** the remote build (built once) is split
  from a per-box local install, recorded as a receipt bound to
  `op.exec`, its enrollment and `holder.stamp`, which `probing`
  requires; a replacement at `installed` makes its own.
- **§5.8 source loss (B1-6):** a source-loss CAS converts a drain to a
  failover from `starting` or `releasing`.
- **§5.9 and §6, disk evidence (B1-3, B1-4):** holds written before any
  exempt volume change, removed volumes suspending disk evidence,
  releases with operator attestation; the SCP also protects the
  `carlos:role` tag; one hold-gated volume-change role; a root-signed
  guard attestation, without which there is no automatic fence.
- **§5.10 (B1-5):** root refuses an executable update on any controller
  record in any state, `lost` included, or any unreadable one, until
  claim D6's clearing with cleanup complete.
- **§5.9, L5 (B1-7):** console enrollments gain a `compute` binding; a
  console on a fenced box leaves the census.
- **§7, §11, L19 (B1-8):** no automatic recovery claimed for a one-box
  region; the empty-region confirmer is an open question for Paul.
- **Citations (B1-9)** refreshed.

Paul ruled both questions those fixes raised, on 2026-10-06, and they
are now fixed text: **H17** (an enrolled box in another region, with
read-only cross-region Auto Scaling and EC2 describe rights and no other
cross-region use, confirms the first box of a region with no enrolled
box; §5.1, §6, L19) and **H18** (for box-started relocations only, the
census accepts a console's newest report however old if it met the floor
and the console's box has the D1 update guard armed; §5.9, L20). §11 is
empty. Review how H17 and H18 are specified, not whether they should be.

## Fixed: do not re-argue

Rulings H1 to H18 in §0, and the claim's own ruled text (R6 in
particular: no warm reuse of a local database). Report only mechanisms
that fail to honour them, are unsafe, or are missing.

## Sources to check against

- Claim spec: `git show origin/design-replica-ownership:docs/superpowers/specs/2026-10-02-host-lifecycle-claim-design.md`
  (§2, §4, §5.1, §5.9 PROPOSED, §6.4, §6.4a, §6.6 PROPOSED, §7, §8, §10.1 PROPOSED).
- Claim code on main: internal/hostclaim, internal/hostguard,
  internal/stopevidence, internal/park, internal/genselect.
- Moves spec: /home/paulca/amadan.net/carlos/platform-moves-design/docs/superpowers/specs/2026-10-02-move-any-app-design.md
  (latest committed rev on that worktree's branch).
- Plan 1a's code on main, for §18 and §19's claims about it.
## Focus

1. **First, a disposition table for B1-1 to B1-9:** resolved, partly
   resolved (say what remains) or not resolved, each with the section
   that answers it.
2. **Then only new findings**, especially in the mechanisms listed
   above and their neighbours: the probe-attempt chain and
   `PublishGeneration`'s parks; the local install receipt across
   replacements and crashes; the source-loss CAS against claim D5 and
   D6; holds, releases and removed volumes against the 2-hour bound and
   the fence; the SCP's tag statements against Auto Scaling launches;
   the cross-region confirmation (H17) and its IAM; the stale-console
   census rule (H18) against D1 and D7;
   root's refusal against D6's clearing; the console `compute` binding
   against D7. Do not re-report a round 1 finding unless its fix is
   incomplete.

## Output

The disposition table, then new findings ranked P1 (unsafe or blocks a
plan), P2 (wrong or missing), P3 (clarity). Each: section, the problem,
a concrete failing sequence, and a suggested fix. End with a verdict:
ready for plan, or not ready.