| 1 | A4-1 is **partially closed**: the required gate is now stated, but raising the existing floor is unsupported. A4-2’s **current/previous mismatch is closed**, but the specified rotation exposes another failure. |
| 2 | |
| 3 | 1. **P2 — The existing host floor cannot be raised as specified.** |
| 4 | [Spec:233](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-two-box/docs/superpowers/specs/2026-10-15-region-ha-two-box-regions-design.md:233) |
| 5 | |
| 6 | Once claim mode has published its floor, changing `min_release` changes its digest. [Disk.Persist:73](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-two-box/internal/hostfloor/disk.go:73) rejects that change; [PublishFloor:35](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-two-box/internal/hostactors/publication.go:35) also refuses it, and the bucket objects are create-only. |
| 7 | |
| 8 | **Failure scenario:** an enrolled deployment upgrades every box to forwarding v2, then attempts stage 2. Its existing guards cannot adopt the higher floor, so the required census reports never appear. Overwriting only the bucket floor would instead trigger local/remote digest refusals. |
| 9 | |
| 10 | Specify an authenticated, monotonic floor transition covering guards, roster, census and recovery—or a separate forwarding floor. Test migration from an already-published claim floor. |
| 11 | |
| 12 | 2. **P2 — Immediate `.next` signing causes failures during staggered refresh.** |
| 13 | [Spec:227](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-two-box/docs/superpowers/specs/2026-10-15-region-ha-two-box-regions-design.md:227) |
| 14 | |
| 15 | The existing code explicitly documents this propagation window at [mesh.go:52](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-two-box/internal/edge/mesh.go:52). Dual acceptance helps only after the receiver has loaded `.next`; waiting before promotion does not prevent early signing. |
| 16 | |
| 17 | **Failure scenario:** box A refreshes first and signs with `.next`. The destination NLB selects box B, which still knows only the current key; the host lives on box C. B rejects authentication and, under the new refusal rule, returns 503 instead of forwarding to C. This contradicts [the staggered-refresh test requirement](/home/paulca/amadan.net/carlos/platform/.claude/worktrees/design-region-ha-two-box/docs/superpowers/specs/2026-10-15-region-ha-two-box-regions-design.md:393). |
| 18 | |
| 19 | Separate distributing the verification key from activating it for signing, with receiver readiness established before activation. Preserve the prohibition on forwarding failed credentials. |
| 20 | |
| 21 | Reviewed platform `3b721bfde90c461bcf62092e25b464d6cf1fdcf4` and flagship `7c99ff8f1512f1a9ff3bf13337c3d147d730a6b6`. No files changed; no builds, tests or infrastructure commands run. |
| 22 | |
| 23 | --- |
| 24 | |
| 25 | **FIRST PROMPT:** |
| 26 | Review spec 2 round 5 at the pinned HEAD, read-only, against flagship Tofu. |
| 27 | |
| 28 | **WHAT:** |
| 29 | Confirm A4-1/A4-2 and report new findings. |
| 30 | |
| 31 | **STATUS:** |
| 32 | Complete; two P2 findings. |
| 33 | |
| 34 | **NEEDED:** |
| 35 | Nothing. |
| 36 | |
| 37 | **RECOMMENDED:** |
| 38 | Define the floor transition and safe key-signing activation before planning. |
| 39 | |
| 40 | **SESSION:** |
| 41 | Safe to close; nothing started or modified. |
| 42 | |
| 43 | **Verdict: not ready for a plan.** |
amadan