Astra: region HA spec 2, round 3

Rev 3 answers your round 2 (CODEX-FINDINGS-REGION-HA-SPEC2-2.md). §15 maps each finding.

Judge:

1. Is each round-2 finding closed? Give a disposition table first.
2. The main design change: forwarding (§6). Cross-region forwards go to the home region's ingress address, and the receiving box forwards once more over a private in-region address, with hop limit 2. Check it against internal/edge (homemap, edge.go's backhaul and signed hop, mesh key): - Are loops and amplification impossible? - Is the signed hop count tamper-proof? - Does it work before a region is migrated, while the region's ingress address is still a single box?
3. The health answer as local liveness (§6). Is anything a box could fail at locally left uncovered? Can a shared outage still flip it?
4. The enrolment sequence (§5) against internal/hostactors, exactly.
5. The pending-create handoff (§7): the starting state, reconciliation by operation ID, and the hostname reservation.
6. IE's relay and MX swap inside the cut-over window, and its rollback (§6, §9).
7. Anything new.

Report only new items after the table. Give findings P1/P2/P3 with file:line and a failure scenario. End with a verdict.