carlos / platform Public

docs: nearest-region plan rev 2, after Astra's plan review and spec rev 6

All 18 findings (8 P1, 10 P2) verified against the code and accepted;
dispositions at the end of the plan. Copy is now reviewed first (Task 0,
a full inventory incl. operator lines, usage and scripts) into an
approved record that later tasks copy from and Task 25 proves applied.
GeoIP errors are logged as a fixed category; deploy --region stops on a
failed read; canary --region refuses identically on fleets and older
consoles; the service gate defeats proxies and is proved against the
edge's real backhaul; fixtures replace under etags; tests compare escaped
HTML, assert 201 before inspecting records, and cover every app_default
reason, C20, C27, the lost-race and held-apex claims, and the old-body IP
path. Folds in R9: Task 1b publishes secrets_key_fp via
appconfig.KeyFingerprint, and eligibility and the explicit C31 refusal
use it. Cross-compile runs the five CI targets.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>