Rev 3 answers your round 2 (`CODEX-FINDINGS-REGION-HA-SPEC2-2.md`). §15 maps each finding.
4
5
**Judge:**
6
1. Is each round-2 finding closed? Give a disposition table first.
7
2. The main design change: **forwarding (§6).** Cross-region forwards go to the home region's ingress address, and the receiving box forwards once more over a private in-region address, with hop limit 2. Check it against `internal/edge` (homemap, edge.go's backhaul and signed hop, mesh key):
8
- Are loops and amplification impossible?
9
- Is the signed hop count tamper-proof?
10
- Does it work before a region is migrated, while the region's ingress address is still a single box?
11
3. **The health answer as local liveness (§6).** Is anything a box could fail at locally left uncovered? Can a shared outage still flip it?
12
4. **The enrolment sequence (§5)** against `internal/hostactors`, exactly.
13
5. **The pending-create handoff (§7):** the `starting` state, reconciliation by operation ID, and the hostname reservation.
14
6. **IE's relay and MX swap inside the cut-over window, and its rollback (§6, §9).**
15
7. Anything new.
16
17
Report only new items after the table. Give findings P1/P2/P3 with file:line and a failure scenario. End with a verdict.
amadan