| 1 | Reviewed `dad9bdb7` read-only. No builds or tests run. |
| 2 | |
| 3 | 1. **P1 — Confirmation objects do not authenticate their producer.** [Task 4, line 2471](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-2b/docs/superpowers/plans/2026-10-17-region-ha-2b-joining.md:2471) |
| 4 | `CheckConfirmed` accepts unsigned JSON whose claimed confirmer matches a roster entry. The proposed IAM grants every box create access across `control/box-enrollment/*`. A holder of those credentials can copy attempt IDs and confirmer details from the readable roster, invent request IDs and membership results, and obtain an invitation for a valid same-account identity outside the group. A fabricated guard-ready report can then satisfy the remaining field checks. Create-only storage prevents replacement; it does not establish who created the evidence. Authenticate the producer and test forged objects through the complete enrolment pass. |
| 5 | |
| 6 | 2. **P2 — Installing the channel release blocks subsequent automatic updates.** [Task 3, line 1703](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-2b/docs/superpowers/plans/2026-10-17-region-ha-2b-joining.md:1703) |
| 7 | Bootstrap sets `/data` ownership before `install-channel` runs. The installer then creates `/data/system/router/<version>` as root with mode `0755`, and cleanup removes only `<version>`. The remaining root-owned parents prevent the `User=carlos` agent from downloading another version or writing `requested.json`. Preserve service-account ownership and verify an ordinary agent update after a fresh install. |
| 8 | |
| 9 | 3. **P2 — The label space is too small for permanent enrolment references.** [Open question 4, line 5634](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-2b/docs/superpowers/plans/2026-10-17-region-ha-2b-joining.md:5634) |
| 10 | With 1,600 uniformly distributed labels, the probability of at least one collision reaches **50.9% after 48 lifetime launches**, and **95.8% after 100**. These count historical launches across the deployment, not concurrent boxes. A collision permanently prevents that instance from joining. Replacement may recover capacity, but the spec explicitly identifies a first-build case where a target group with no previously healthy target does not replace unhealthy instances. This is a 2b reliability issue. Use collision-resistant references before enabling automatic replacement. |
| 11 | |
| 12 | 4. **P2 — Concurrent seeding can overwrite shared secrets.** [Task 2, line 957](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-2b/docs/superpowers/plans/2026-10-17-region-ha-2b-joining.md:957) |
| 13 | Two seed commands can both observe a missing shared parameter, then write different values. `Set` always uses `Overwrite: true`, so the second silently replaces the first, violating the promised protection for shared release and secrets keys. Give shared parameters a create-only operation; on conflict, reread and require equality. Regional writes can retain overwrite behaviour. |
| 14 | |
| 15 | 5. **P2 — The specified boot order invokes a binary before obtaining it.** [2c’s seams, line 5618](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-2b/docs/superpowers/plans/2026-10-17-region-ha-2b-joining.md:5618) |
| 16 | A fresh box runs `carlos system host-env write` before downloading `bootstrap/carlos`. No earlier step supplies that executable. Following this sequence stops at configuration. Download and checksum-verify the bootstrap executable first, then use it to assemble `host.env` before installing the channel release. |
| 17 | |
| 18 | 6. **P2 — The new console signing path escapes the authority census.** [Task 5, line 3497](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-2b/docs/superpowers/plans/2026-10-17-region-ha-2b-joining.md:3497) |
| 19 | `newAutoEnroller` transfers the console’s directory and root signer into a new controller; `runEnrollPass` invokes its mutation-capable `Pass`. Neither is selected by the console census. Consequently, removing or duplicating this authority path would leave that census green. “Calls no selected method” identifies a coverage gap. Add explicit coverage for construction and invocation, alongside the proposed root-read rows. |
| 20 | |
| 21 | 7. **P3 — Unreadable confirmation evidence is treated as invalid evidence.** [Task 5, line 3286](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-2b/docs/superpowers/plans/2026-10-17-region-ha-2b-joining.md:3286) |
| 22 | Every `CheckConfirmed` error falls through to attempt expiry and replacement. Its second confirmation read or its fence read can fail transiently, so an unknown result can supersede a valid attempt and increase backoff. This contradicts the stated unknown-and-retry rule. Preserve read failures separately from expired or invalid evidence, and retry without changing the attempt. |
| 23 | |
| 24 | 8. **P3 — Two user-visible strings are missing from the copy record.** [Task 7, line 4440](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-2b/docs/superpowers/plans/2026-10-17-region-ha-2b-joining.md:4440) |
| 25 | Neither new unit’s `Description=` text has a row, although operators see both through systemd. The gate checks its declared inventory, so these omissions remain invisible. Add both descriptions. The existing 61 rows otherwise seem proportionate to the command refusals, help and documentation. |
| 26 | |
| 27 | The normal joining sequence, both-slot installation checks, group-role inheritance and AWS adapter separation are represented. The findings above prevent accepting their surrounding safety and recovery guarantees. |
| 28 | |
| 29 | **Verdict: not ready to build.** |
amadan