carlos / platform Public

A10-1 through A10-4 are closed at design level. One new finding:

P2 — Rollback’s placement exclusion does not survive box replacement. Spec:357

Rollback sets the two current group boxes to legacy, but leaves automatic replacement and enrolment running. §10 explicitly makes replacements placeable. The exclusion belongs to each box’s roster entry; no group-level exclusion or inheritance is specified.

Failure scenario: rollback excludes both boxes after a group boot/configuration problem. One fails and is replaced. Its replacement enrols under a new reference and accepts new customer instances into the group the operator rolled back. A replacement already joining during rollback has the same gap.

Persist the exclusion for the group and enforce it before replacements become eligible. Rehearse replacement during and after rollback.

Reviewed platform 6f88e541 and flagship 7c99ff8f. No files changed; no builds, tests or infrastructure commands run.

---

FIRST PROMPT: Review spec 2 round 11 at the pinned HEAD against flagship tofu, read-only.

WHAT: Confirm the previous fixes and report new findings.

STATUS: Four findings closed; one new P2.

NEEDED: Nothing.

RECOMMENDED: Make rollback’s placement exclusion survive replacement.

SESSION: Safe to close; nothing modified or left running.

Verdict: not ready for a plan.