| 1 | H25 removes the old-box drain requirement from the forward rollout, but **not from the rollback as written**. Three P2 findings and one P3: |
| 2 | |
| 3 | 1. **P2 — Destroying the group during rollback still needs settlement.** |
| 4 | [Spec:352](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-two-box/docs/superpowers/specs/2026-10-15-region-ha-two-box-regions-design.md:352) |
| 5 | |
| 6 | Rollback restores the old box’s eligibility and relocates group residents before destroying the group. It never excludes the group boxes from new destinations or settles outstanding selections. |
| 7 | |
| 8 | **Failure scenario:** a create selects a group box before rollback, pauses, then completes after its residents have been relocated. Recovery [retains that executor](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-two-box/internal/hostops/production_create.go:257). Destroying the group strands the instance. The post-cut-over rollback inherits this problem through step 4. |
| 9 | |
| 10 | Either retain the group until spec 4, or provide the exclusion and acknowledged settlement needed to retire it safely. |
| 11 | |
| 12 | 2. **P2 — Rollback cannot relocate a never-woken group instance.** |
| 13 | [Spec:352](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-two-box/docs/superpowers/specs/2026-10-15-region-ha-two-box-regions-design.md:352) |
| 14 | |
| 15 | A newly created group instance can still have `Holder.Session == 0`. [Relocation refuses that state](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-two-box/internal/hostrelocate/worker.go:329), and the ordinary wake path [requires `Holder.WriterBox` to name the local box](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-two-box/internal/activator/claimwake.go:182). |
| 16 | |
| 17 | **Failure scenario:** an instance is created during rehearsal but receives no traffic. Rollback cannot return it to the old box, so it cannot safely destroy the group. A9-2 remains relevant to this sequence despite [§22’s moot disposition](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-two-box/docs/superpowers/specs/2026-10-15-region-ha-two-box-regions-design.md:509). |
| 18 | |
| 19 | Retain the group, or explicitly include support for relocating this state. |
| 20 | |
| 21 | 3. **P2 — Moves need separate source validation and destination eligibility.** |
| 22 | [Spec:313](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-two-box/docs/superpowers/specs/2026-10-15-region-ha-two-box-regions-design.md:313) |
| 23 | |
| 24 | The proposed move change describes destination selection. Today, [`selectMoveBoxes`](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-two-box/internal/console/boxselect.go:114) applies the placement predicate to **both** regions, and the move door [requires the selected source to equal the claim’s executor](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-two-box/internal/console/apiinstancemove.go:671). |
| 25 | |
| 26 | **Failure scenario:** after enforcing `legacy`/`platform` exclusion, an existing customer instance on the old box cannot move to another region: its executor is absent from the source candidates. Removing the multiple-box refusal alone does not fix this. |
| 27 | |
| 28 | Specify that the source comes from the claim and is validated as active and unfenced; only the destination gets §7’s placement policy. Test outbound moves from both excluded roles. |
| 29 | |
| 30 | 4. **P3 — The active forwarding section still requires emptying the old box.** |
| 31 | [Spec:240](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-two-box/docs/superpowers/specs/2026-10-15-region-ha-two-box-regions-design.md:240) |
| 32 | |
| 33 | This clause says §9 moves every instance off before transferring the EIP. H25 and the revised §9 explicitly retain those instances. |
| 34 | |
| 35 | **Failure scenario:** a plan following §6 reinstates the drain prerequisite that this revision removes. Replace it with the new-address, forced-publication and reader-refresh transition. |
| 36 | |
| 37 | The revised address swap covers the previously identified forwarding and relay requirements at design level. I found no additional blocker in those steps. |
| 38 | |
| 39 | Reviewed platform `9c26d974` and flagship `7c99ff8f`. No files changed; no builds, tests or infrastructure commands run. |
| 40 | |
| 41 | --- |
| 42 | |
| 43 | **FIRST PROMPT:** |
| 44 | Review spec 2 round 10 at the pinned HEAD against flagship tofu, read-only. |
| 45 | |
| 46 | **WHAT:** |
| 47 | Check H25, placement exclusion, address switching, rollback and the full spec. |
| 48 | |
| 49 | **STATUS:** |
| 50 | Complete; three P2 findings and one P3. |
| 51 | |
| 52 | **NEEDED:** |
| 53 | Nothing. |
| 54 | |
| 55 | **RECOMMENDED:** |
| 56 | Resolve group retirement during rollback and distinguish move-source validation from destination selection. |
| 57 | |
| 58 | **SESSION:** |
| 59 | Safe to close; nothing modified or left running. |
| 60 | |
| 61 | **Verdict: not ready for a plan.** |
amadan