carlos / platform Public

region HA 2b: answer Astra's round 1 (H28, spec rev 16)

The console is the only membership confirmer (H28): EnrollAutomatic and
CheckConfirmed take the console's reader and read membership themselves,
fresh within 60 seconds of each write; the box-side confirmer, its grants
and the stored confirmation are gone. A failed read is unknown and keeps
the attempt. install-channel hands its /data directories to the service
user; shared parameters are seeded create-only; the console's enrolment
pass joins the claim-authority census; the join units' descriptions get
copy rows; a group box started again is held; 2c's boot order fetches
the bootstrap binary first. Box references outside the label space are
blocked by statusLoop (accepted-legacy) and left as Open question 4.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>