Review brief: region HA spec 1 rev 5, round 1

You are an independent second reader. Review docs/superpowers/specs/2026-10-04-region-ha-box-placement-design.md at the commit named in the prompt, in the repository at the working directory (Go; carlos platform).

What changed and why

Rev 4.2 (your rounds 1 to 6, CODEX-FINDINGS-REGION-HA-{1..6}.md) was written against host lifecycle claim rev 6.3. The claim has since reached rev 6.25+ and part of its library is on main. Rev 5 restates spec 1 against the claim as it is now, and records Paul's rulings H10 to H16 (2026-10-06). Plan 1a of rev 4.2 is built and merged (internal/boxid, internal/hostfiles, internal/termfence, internal/console/boxchoice.go, edges-file fields, home-map stamps); §18 and §19 say what of it stays.

Fixed: do not re-argue

Rulings H1 to H16 in §0, and the claim's own ruled text (R6 in particular: no warm reuse of a local database). Report only mechanisms that fail to honour them, are unsafe, or are missing.

Sources to check against

• Claim spec: git show origin/design-replica-ownership:docs/superpowers/specs/2026-10-02-host-lifecycle-claim-design.md (§2, §4, §5.1, §5.9 PROPOSED, §6.4, §6.4a, §6.6 PROPOSED, §7, §8, §10.1 PROPOSED).
• Claim code on main: internal/hostclaim, internal/hostguard, internal/stopevidence, internal/park, internal/genselect.
• Moves spec: /home/paulca/amadan.net/carlos/platform-moves-design/docs/superpowers/specs/2026-10-02-move-any-app-design.md (latest committed rev on that worktree's branch).
• Plan 1a's code on main, for §18 and §19's claims about it.

Focus

1. Relocation (§5.8) against §6.4a. Is every step consistent with the claim's writer sessions, prepared generations (opened at most once), AdmitWriter, KeepStamp, PublishGeneration and genselect? Can any sequence of crashes, a paused worker, two workers, a terminated participant, or a failing probe leave two writers, a reinstall after installed, lost acknowledged data beyond H3's window, or a host stuck with no recovery owner?
2. The termination fence (§5.9) after H15. The volume record, the 2-hour bound, the IAM guard (Modify, Attach, Detach), the event and describe reads. Any way to fence a box whose data could survive, or a live box.
3. §5.10's two-sided reservation check (H14). Can a relocation start and an executable update both proceed?
4. The L-table (§9). Does each request cite the right claim or moves text, and is anything missing that a multi-box region needs from the claim as it now stands? Is anything requested that the claim already provides?
5. Enrollment (H11, H16) and the roster. Does the evidence chain from the AWS-signed identity to the roster entry to the fence hold?
6. Code citations. Verify file:line references against the tree.

Output

Findings ranked P1 (unsafe or blocks a plan), P2 (wrong or missing), P3 (clarity). Each: section, the problem, a concrete failing sequence, and a suggested fix. End with a verdict: ready for plan, or not ready.