Review brief: region HA spec 1 (box placement), round 4

You are an independent second reader. Review docs/superpowers/specs/2026-10-04-region-ha-box-placement-design.md at the commit named in the prompt, in the repository at the working directory (Go; carlos platform).

Fixed: do not re-argue

§0's rulings H1 to H6 are Paul's and are fixed, as are the standing rulings listed under them. Report only mechanisms that fail to honour them, are unsafe, or are missing.

What the spec builds on

• Host lifecycle claim rev 6.3: file /home/paulca/amadan.net/carlos/platform/.claude/worktrees/replica-ownership/docs/superpowers/specs/2026-10-02-host-lifecycle-claim-design.md
• Move-any-app rev 7.6 (29245f69): file /home/paulca/amadan.net/carlos/platform-moves-design/docs/superpowers/specs/2026-10-02-move-any-app-design.md
• Nearest-region, on main: docs/superpowers/specs/2026-10-01-nearest-region-default-design.md and internal/console/regioncandidates.go.

Those specs are still in review themselves. Where spec 1 relies on them, check it relies on what they actually say; §9 lists the changes it asks of them.

Focus

1. One writer. Can any sequence (create, relocation, termination, a stale edges file, a stale warm copy, a placer that pauses, the console's box dying, a partition from the control bucket) leave two boxes running or writing one host, or a box serving a stale copy?
2. The termination fence (§5.9). Is terminated from DescribeInstances sufficient evidence? What about eventual consistency of EC2 state, a box id that is a label not an instance id, a box in another account or region, a forged edges file.
3. Files durability (§5.6). Restore ordering, tombstones, generation scoping, interaction with the moves archive, what a snapshot app loses.
4. Reconcile and the edges (§5.3, §5.4). The slow sweep, the stamp rule, legacy files without stamps.
5. The K list (§9). Is anything missing that the claim or moves specs would need to change for multi-box regions?
6. Code citations. Verify every file:line cited against the tree.

A mechanism named, bounded and assigned to spec 2, 3 or 4 (§12) is complete at this level; don't pull later specs' depth into this one.

Output

Findings ranked P1 (unsafe or blocks build), P2 (wrong or missing), P3 (clarity). Each: section, the problem, a concrete failing sequence, and a suggested fix. End with a verdict: ready for plan, or not ready.

Round 4

This is rev 4, answering rounds 1 to 3 (CODEX-FINDINGS-REGION-HA-1.md to -3.md). First give a disposition table for each round 3 finding (A3-1 to A3-4) and the A2-5, A2-7 and A1-1 residuals: resolved, partly resolved (say what is left), or not resolved. Then report only new findings, including any that rev 4's fixes introduce: the release sequence (§5.8), the bind and the control/boxes/ bucket policy (§5.1), polling while watch coverage is missing (§5.6), and the S3 conditional policies (§6). Don't re-raise anything a previous round's disposition marked resolved unless rev 4 broke it.