carlos / platform Public

Checkpoint at 00:45 Europe/Dublin, code tip 8e7499ae (ae8c911a adds documents and the regenerated preview only).

Verified on 8e7499ae: go build, go vet, gofmt, go test ./... plus the vendored Litestream package outside the sandbox (60 packages ok); five cross builds pass. Amadan CI on the tip still to be read.

Independent review round 1 (GPT-6 Astra, committed unedited as docs/superpowers/specs/CODEX-FINDINGS-carloku-paid-launch-overnight.md): reject, nine P1 and one P2. All ten accepted and fixed, each with a test that reproduces the scenario (CODEX-DISPOSITIONS beside it). The ones that matter most: the report reader now refuses AWS's overwrite layout; a bucket ownership ledger resolves an owner only if the grant that minted the bucket created it, so adopted and pre-existing stores hold instead of billing whoever is recorded; replication writes bill only three operations under the replicate purpose; a box with no ledger holds the day; a held month is revisited for six months.

Round 2 by Astra and the Opus production review required by AGENTS.md are running against 8e7499ae.

New since the first post: operator API doors for billing review holds and the house marker; a team quantity worker behind CONSOLEBILLINGPRORATION, which is unset and must stay unset until Paul decides; the Stripe provisioning plan and a print-only script; the collector and attestation plans.

Review URLs: pricing http://docs-t1.tail5fd3ba.ts.net:38009 (fallback http://100.119.180.57:38009); billing page http://docs-t1.tail5fd3ba.ts.net:45033 (fallback http://100.119.180.57:45033, port changed on restart); interactive demo http://100.119.180.57:41881.

Still blocking a first invoice, precisely: no Cost and Usage Report export exists; existing store buckets have no attested ownership history; no box attests replication completeness; team quantities are not lowered at renewal; no Stripe catalog, portal, webhook or rk_live key; copy unapproved. Billing is off and nothing live was touched.

Status at 02:20 Dublin, 2026-10-01. Tip 4bbe94b6, pushed, not merged. Billing off. No AWS, Stripe or production change.

Round 3 reviews, both against e07f6475. Astra rejected (four P1, one P2). Opus accepted with fixes (one P1, one P2, six P3). All thirteen were accepted and fixed in 4abe94cb and c3913dd9. The dispositions file names the reproduction for each and which were confirmed to fail with the fix disabled.

• Quantity worker: recording an operation is now a compare-and-set on everything its target was computed from. The request dates its proration inside its own period, so a renewal between the read and the update is refused by the provider and not charged into the new year. The mark and the acknowledgement commit together.
• Bucket ownership: an absent bucket no longer counts as proof that nobody holds a key. Completeness needs an inventory of principals. The AWS provisioner cannot list them yet, so on AWS no ledger claims completeness and store transfer holds.
• Statement catch-up walks across gaps, treats an unreadable statement as open, and writes a statement an account is missing.

Partial-month billing is built. A first month, an ending month and a lapse now bill the UTC days wholly inside a paid span, against the allowance weighted over those spans. It has had no independent review yet.

Gate. go build, go vet, gofmt and make test pass on c3913dd9 (60 packages). Five cross builds pass on 4bbe94b6. Amadan CI for 4bbe94b6 is queued.

Round 4 of Astra and Opus is running against 4bbe94b6.

Found and not fixed:

• A teardown retried after a failed revocation deletes the bucket on its record, even if another app has since been granted that name. It predates this branch. Data loss, not billing.
• Stripe's refusal of a proration date outside the current period is taken from its documentation. Test mode is not authorized, so it is unconfirmed.
• One host test had been passing by luck (about one failure in fifteen). Its helper now waits for the ledger's late writer.

Review surfaces, each answering 200 on the IP form: pricing copy http://100.119.180.57:38009, billing page copy http://100.119.180.57:45033, signup and billing demo http://100.119.180.57:41881.

Correction to the status above: it was posted at 01:55 Dublin, not 02:20. The servers were checked at 01:50 and CI was seen queued at 01:54. I had written the times from memory and they were about 25 minutes ahead of the clock.

Status at 02:46 Dublin, 2026-10-01 (clock read, not remembered). Tip 6a0c99d8, pushed, not merged. Billing off. No AWS, Stripe or production change.

Round 4 reviews, both against 4bbe94b6. Astra rejected (three P1, two P2). Opus accepted with fixes (eight P3) and found nothing that bills an unpaid day, bills too small an allowance, leaks an identifier or lets attestation read true. All thirteen are fixed, each with a reproduction that fails with the fix disabled. The dispositions file has the table.

• A retried seat charge and its allowance now start at the same instant.
• A store's first clock hour no longer resolves an owner. A charged line in it holds the month, and nothing releases that hold yet. That needs a ruling.
• A missing platform statement no longer hides the oldest metered month.

Done on supervision's direction.

• Read-only look at the flagship's AWS billing. No export exists. S3 carried only usage lines from July to September, so no credit or discount would hold the transfer meter. No free transfer allowance reaches the account. Ireland's usage types are written EU-; a test now pins every real name. Inter-region transfer out of Ireland rose from 34 GB in August to 1,395 GB in September, which is worth finding the cause of.
• The teardown hazard in discussion 191 is fixed on the branch, not only filed.
• Replication attestation: the scoped path is chosen. The per-account fold, the scope rule and the reader of the replicator's state are built and tested. Nothing in the agent calls them. The flagship's litestream config is kept by hand and must be generated before that box could attest.
• Partial months: the approved spec only prorates the allowance. The whole-paid-day usage rule is this branch's proposal and is marked as needing Paul's approval. Its boundary is pinned case by case.

Gate. Build, vet, gofmt and make test passed on 14ef574a (60 packages). The two commits after daa32cb6 had only their own packages' tests run; the full gate at the tip is being re-run. Five cross builds pass on daa32cb6.

Hub. The repository endpoints returned HTTP 500 from about 02:36 to 02:44, so CI for 4bbe94b6 was never read. CI for 6a0c99d8 is queued.

Round 5 of Astra and Opus is running against daa32cb6.

Status at 06:15 Dublin, 2026-10-01.

Code tip 3d4104cb (f5538467 on top is the round 9 brief). Full gate passes on it: build, vet, gofmt, make test with 61 packages, and cross builds for darwin, linux arm64 and windows. CI is queued on f5538467.

Billing is off, the quantity worker is off, nothing attests, nothing was deployed, and no live Stripe or AWS write was made.

Three things, kept apart:

• Draft copy to review, not approved: pricing http://100.119.180.57:38009, console billing page http://100.119.180.57:45033.
• A demo to click through: http://100.119.180.57:41881. Real console handlers, simulated Keymail and Stripe. Not Stripe proof.
• A tested branch that is not production-ready. implementation/carloku-paid-launch/OUTSTANDING.md lists what is reviewable, tested and proven, and every launch blocker.

Review: Astra rejected rounds 1 to 8 and Opus accepted each with fixes. The last three Astra rounds found 14, 9 and 5. Round 8 is fixed except two findings recorded as accepted and open. Round 9 is running against f5538467.

Launch blockers, shortest form: no box can prove its replication writes (path A cannot, path B is not built); no Cost and Usage Report export; no Stripe catalog, portal, webhook or runtime key; the quantity fence is unverified against Stripe; two open late-request defects whose paths are disabled; copy, proration policy and the partial-month usage rule await Paul; renewal reduction and Free-tier enforcement are not built.

The late-request design is on feat/carloku-late-request-fencing-20261001 (833a403c), not gated and not reviewed.