# Review brief: region HA spec 1 rev 5.3, round 4

You are an independent second reader. Review
`docs/superpowers/specs/2026-10-04-region-ha-box-placement-design.md` at
the commit named in the prompt, in the repository at the working
directory (Go; carlos platform).

## What changed and why

Your rev 5 round 3 findings (`CODEX-FINDINGS-REGION-HA-REV5-3.md`, B3-1
to B3-5) were all about the volume guard. Rather than patch it again,
Paul ruled **H19** (2026-10-06), which supersedes H15 and the volume half
of H10:

- the failover fence for **execution** rests on a verified `terminated`
  read alone, bound to the roster's `cloud` identity (event, describe,
  later the group's history; absence never evidence): claim §7.2's own
  lost-box rule;
- disk evidence (the box's volume records, launch-time to last running,
  all `DeleteOnTermination`, none removed) decides **only** whether the
  dead box's `park-local` chores are discharged automatically (claim
  D5). Otherwise they stay open for an operator, and recovery waits on
  nothing;
- a surviving disk copy (Recycle Bin, copy, snapshot, image, detach) is
  a data-retention concern for the operator path, not a two-writer risk.

So rev 5.3 removes the SCP, holds, change role, guard attestation and
service-role audit, and rewrites §5.9 (what counts, disk evidence for
discharge, the volume record), §6 (disks), §7, §8, §9 (L2, L3), §10 and
§19. §22 is the disposition table, with a note revisiting B1-3, B1-4,
B2-1, B2-2 and B2-3.

## Fixed: do not re-argue

Rulings H1 to H19 in §0 (H19 supersedes H15 and the volume half of
H10), and the claim's own ruled text (R6 in particular: no warm reuse of
a local database). Report only mechanisms that fail to honour them, are
unsafe, or are missing.

## Sources to check against

- Claim spec: `git show origin/design-replica-ownership:docs/superpowers/specs/2026-10-02-host-lifecycle-claim-design.md`
  (§2, §4, §5.1, §5.9 PROPOSED, §6.4, §6.4a, §6.6 PROPOSED, §7, §8, §10.1 PROPOSED).
- Claim code on main: internal/hostclaim, internal/hostguard,
  internal/stopevidence, internal/park, internal/genselect.
- Moves spec: /home/paulca/amadan.net/carlos/platform-moves-design/docs/superpowers/specs/2026-10-02-move-any-app-design.md
  (latest committed rev on that worktree's branch).
- Plan 1a's code on main, for §18 and §19's claims about it.
## Focus

1. **First, a disposition table** for B3-1 to B3-5: resolved, moot under
   H19 (say whether you agree it is moot), or not resolved, each with
   the section that answers it.
2. **Then, specifically: does any two-writer or data-loss path now
   depend on disk evidence?** Follow every place the fence, the census
   (L5, L20), relocation (§5.8), §5.10, H17's confirmer and the claim's
   admission rules (C4, §6.4, §6.4a, P6-D2) are used, and say whether any
   of them still reads volume records, tags or IAM state, or would admit
   a writer from a surviving disk.
3. **Then only new findings.** Do not re-raise anything resolved in any
   earlier round (rounds 1 to 6 of rev 4.x, rev 5 rounds 1 to 3) unless
   this revision broke it; if it did, say which change broke it. Data
   retention of surviving disk copies is out of scope by H19.

## Output

The disposition table, the answer to focus 2, then new findings ranked
P1 (unsafe or blocks a plan), P2 (wrong or missing), P3 (clarity). Each:
section, the problem, a concrete failing sequence, and a suggested fix.
End with a verdict: ready for plan, or not ready.