**Review:** `docs/superpowers/plans/2026-10-10-instance-key-provision.md` rev 5 (caa2609d). It answers your round 5 (`CODEX-PLAN-INSTANCE-KEY-R5.md`):
4
- **Ruling 27.** A configured key is never changed in place: rotation is unsupported, and a coordinated procedure applies to apps with replicas. On every launch of a replica whose key comes from configuration, the agent checks that key against two things: the replica's `CARLOS_REPLICA_HOME_KEYS` entry, which only the pre-roll check writes, and the key the bucket's configuration holds right now, read fresh at launch. One residual remains: a change made only on the home, such as a hand-edited home `<host>.env` or a key configured for that host alone. A test documents it.
5
- **Ruling 28.** O8 delivers platform-minted keys only. A home whose key exists only in configuration is deferred, and its keyless replica is refused.
6
- **P3.** `ParseHomeKeys` errors report the index and the reason, never the input.
7
8
**Judge:**
9
1. Are all three findings closed?
10
2. Is the fresh bucket-config read at a replica launch safe? Consider failure modes, latency, and which outcome a failed read produces.
11
3. Is the residual acceptable as documented?
12
4. Anything new?
13
14
Give findings P1/P2/P3 with file:line, then a verdict: ready to build, or not.
amadan