Rollback sets the two current group boxes to `legacy`, but leaves automatic replacement and enrolment running. [§10 explicitly makes replacements placeable](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-two-box/docs/superpowers/specs/2026-10-15-region-ha-two-box-regions-design.md:375). The exclusion belongs to each box’s roster entry; no group-level exclusion or inheritance is specified.
7
8
**Failure scenario:** rollback excludes both boxes after a group boot/configuration problem. One fails and is replaced. Its replacement enrols under a new reference and accepts new customer instances into the group the operator rolled back. A replacement already joining during rollback has the same gap.
9
10
Persist the exclusion for the group and enforce it before replacements become eligible. Rehearse replacement during and after rollback.
11
12
Reviewed platform `6f88e541` and flagship `7c99ff8f`. No files changed; no builds, tests or infrastructure commands run.
13
14
---
15
16
**FIRST PROMPT:**
17
Review spec 2 round 11 at the pinned HEAD against flagship tofu, read-only.
18
19
**WHAT:**
20
Confirm the previous fixes and report new findings.
21
22
**STATUS:**
23
Four findings closed; one new P2.
24
25
**NEEDED:**
26
Nothing.
27
28
**RECOMMENDED:**
29
Make rollback’s placement exclusion survive replacement.
amadan