| 1 | | Round-1 finding | Disposition | |
| 2 | |---|---| |
| 3 | | A1: Registration before capacity refusal | **Closed.** Task 11 chooses before `RegisterStart`, carries the selection forward, and tests refusal through recovery. | |
| 4 | | A2: Missing choosing doors | **Partly closed — P2 remains.** The shared refusal reaches all four doors, but Task 12 leaves the move handler’s earlier placement checks intact. A configured destination with no edges file, or only blank public addresses, still returns **400 without an alert** at [apiinstancemove.go:594](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-two-box/internal/console/apiinstancemove.go:594). Test the full HTTP path and route this capacity failure through H27. | |
| 5 | | A3: App-derived region validation | **Closed for both reported scenarios.** Task 11 uses `PlaceableBoxes` and adds HTTP tests for stale boxes and a misconfigured sibling. | |
| 6 | | A4: Move filtering with HA off | **Closed.** `placementChooser` gates the filter on HA; tests cover persisted roles and an unreadable roster. | |
| 7 | | A5: Private dialing with HA off | **Closed.** Task 8 uses the reader’s switch and tests both settings. | |
| 8 | | A6: Restart resets alert limit | **Closed by ruling.** Revised H27 explicitly permits an extra alert after restart. | |
| 9 | | A7: Pending copy exposed | **Closed in the plan.** Built rows must be approved; Tasks 10 and 11 wait for approval. | |
| 10 | |
| 11 | Two new findings: |
| 12 | |
| 13 | 1. **P2 — A capacity-refused create can still change its environment’s store.** |
| 14 | Task 11 inserts early selection inside `beginClaimCreate`, but [apiinstances.go:1573](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-two-box/internal/console/apiinstances.go:1573) calls `bindEnvironmentCreate` first. If the requested environment has a seed-owned store, [takeSeedStore](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-two-box/internal/console/seedenvbind.go:76) clears `Declared.Seed` and writes it back. An explicit-region create can therefore change storage ownership, then return the no-capacity 503. Later seed cleanup leaves that store standing despite no instance having been created. Choose before this mutation, and test that the store bytes remain unchanged after refusal. |
| 15 | |
| 16 | 2. **P2 — Capacity metrics can be published to the wrong AWS region.** |
| 17 | [Task 13’s `regionCapacities`](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-two-box/docs/superpowers/plans/2026-10-16-region-ha-2a-core.md:6135) takes the destination AWS region from the last edges file naming each placement. The capacity count, however, uses the signed roster. A stale or misconfigured file naming `placement=uk, region=eu-west-1` can therefore redirect the valid UK count away from `eu-west-2`. The intended alarm receives missing data and reports a capacity problem even when eligible boxes exist. Derive the metric destination from the same authoritative region mapping used by the chooser, and test conflicting edges-file metadata. |
| 18 | |
| 19 | Platform-1e’s stated conditions are met by the proposed code on static inspection: private addresses use the configured address source, undergo private-IPv4 and CIDR validation, exclude loopback and link-local addresses, and remain routing data. Writer/source and reader tests cover invalid addresses. `boxRoster` performs only a signed roster read, and both production callers pass the operator gate first. |
| 20 | |
| 21 | The census treatment appears complete for the current proposal: all four authority/legacy units and all four B8 digest changes are covered. The overlay must load last, with coverage hashes, unit digests, fingerprints and seals recomputed after Plan 14 Parts 2 and 3. I did not execute the census checks. |
| 22 | |
| 23 | --- |
| 24 | |
| 25 | **FIRST PROMPT:** |
| 26 | Review plan 2a round 2 at `16939cda`, read-only, without heavy checks. |
| 27 | |
| 28 | **WHAT:** |
| 29 | Check prior findings, census conditions and new defects. |
| 30 | |
| 31 | **STATUS:** |
| 32 | Six findings closed, one partly closed; two new P2 findings. No builds or tests ran. |
| 33 | |
| 34 | **NEEDED:** |
| 35 | Nothing for this review. |
| 36 | |
| 37 | **RECOMMENDED:** |
| 38 | Resolve the three outstanding paths and add the described regression coverage. |
| 39 | |
| 40 | **SESSION:** |
| 41 | Safe to close. HEAD verified; worktree unchanged; no processes started. |
| 42 | |
| 43 | **Verdict: not ready to build.** |
amadan