| 1 | | Round-2 finding | Disposition at `7d791cd9` | |
| 2 | |---|---| |
| 3 | | A2-1 — Attempt and confirmation expiry | **Closed.** Fresh attempts reuse the stable invitation; enrolment follows fresh confirmation and guard readiness. | |
| 4 | | A2-2 — Bootstrap binary retained as `.prev` | **Closed.** Both protected slots contain the verified channel artifact. | |
| 5 | | A2-3 — Shared bucket outage triggers replacement | **Closed for refresh failures after arming.** Cached map/key failures no longer revoke health. Local-stall detection remains incomplete; see 3. | |
| 6 | | A2-4 — Restart during joining | **Closed.** Mode selection checks roster membership and guard state; intermediate states resume joining. | |
| 7 | | A2-5 — Pending-create handoff | **Closed at design level.** Durable `starting`, stable identity, shared reservation and cancellation restrictions address the original race. Implementation must integrate existing registration settlement and recognise completed creates through the holder’s acquisition identity. | |
| 8 | | A2-6 — Relay advertises old address | **Closed.** Explicit configuration, restart, allocation verification and media exchange occur inside the cut-over window. | |
| 9 | | A2-7 — Secondary-address selection | **Superseded.** Region ingress plus private forwarding removes the requirement. The transition to that protocol needs work; see 2. | |
| 10 | | A2-8 — Capacity metric permission | **Closed.** Scoped namespace permission and missing-data handling are explicit. | |
| 11 | | A2-9 — Rollback removes required addresses | **Closed at design level.** Forwarding survives reassociation; IE DNS and relay configuration revert together, retaining the new allocation. | |
| 12 | | Remaining round-1 partials | Substantive topology and first-build exceptions are addressed. Some summaries remain stale: §12 still defers the second ingress zone, and §10 states unconditional replacement during enrolment failure. | |
| 13 | |
| 14 | 1. **P1 — Failed hop authentication can reset the forwarding budget.** |
| 15 | [Spec:219](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-two-box/docs/superpowers/specs/2026-10-15-region-ha-two-box-regions-design.md:219) relies on a signed two-hop limit, but existing [hop acceptance](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-two-box/internal/edge/homemap.go:930) strips an invalid signature and treats the request as an ordinary client request, eligible for forwarding again. |
| 16 | |
| 17 | During mesh-key propagation, a receiving box can reject a legitimate forwarded request and restart its budget. With inconsistent home maps, two regional boxes can recirculate it until existing concurrency limits or timeouts intervene. Signing the count alone does not prevent that reset. |
| 18 | |
| 19 | Specify refusal—or at least prohibition of further forwarding—for requests carrying invalid, unsupported or malformed hop credentials. Also explicitly replace the [current host-and-timestamp-only MAC](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-two-box/internal/edge/mesh.go:241) with a versioned signature binding the count. Test key disagreement and malformed counts alongside the third-hop refusal. |
| 20 | |
| 21 | 2. **P2 — Removing public addresses breaks forwarding during the prerequisite software rollout.** |
| 22 | [Spec:220](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-two-box/docs/superpowers/specs/2026-10-15-region-ha-two-box-regions-design.md:220) removes public dial addresses from publication. Existing readers successfully parse such files but [discard their ordinary dial targets when `eip` is empty](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-two-box/internal/edge/homemap.go:570). |
| 23 | |
| 24 | Upgrade one region before another: the upgraded publisher stops emitting its EIP, and the older region loses forwarding to its hosts on the next map refresh. This happens before the EIP cut-over; §9’s “every box is ready” check comes too late to protect that interval. |
| 25 | |
| 26 | Require a staged transition: add private addresses and region information while retaining legacy publication, upgrade all readers and hop receivers, then enable the new forwarding protocol and retire legacy publication. Once that transition is complete, forwarding to an unmigrated region’s single-box ingress is sound. |
| 27 | |
| 28 | 3. **P2 — The health conditions miss a locally stalled forwarding refresher.** |
| 29 | [Spec:192–194](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-two-box/docs/superpowers/specs/2026-10-15-region-ha-two-box-regions-design.md:192) latches map/key readiness permanently and checks heartbeats only for request handling and the activator. The [map/key refresh worker](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-two-box/internal/edge/homemap.go:838) runs separately. |
| 30 | |
| 31 | If that worker stalls after its first successful load, HTTP handling and activation can remain alive, so health stays 200. Later relocations or key rotations leave that box forwarding incorrectly indefinitely. The replacement promised in §10 for this exact failure never triggers. |
| 32 | |
| 33 | Add refresh-worker progress monitoring independent of refresh success: completed failed attempts must count as progress, with a threshold covering the existing two-minute request timeout. That detects a local stall without restoring shared-bucket freshness as a termination condition. |
| 34 | |
| 35 | Reviewed the requested platform HEAD and flagship checkout `7c99ff8f1512f1a9ff3bf13337c3d147d730a6b6`. No files changed; no builds, tests or infrastructure commands run. |
| 36 | |
| 37 | **Verdict: not ready for an implementation plan. Resolve the forwarding failure contract, staged protocol rollout and refresh-worker liveness coverage first.** |
amadan