| index 63e4cc182..3c1b21eb3 100644 |
| --- a/.claude/HANDOFF.md |
| +++ b/.claude/HANDOFF.md |
| @@ -7,39 +7,39 @@ |
| Get Carloku's paid plans live with Stripe Tax and the complete metered model; have the pricing page and signup flow reviewable in the morning. |
| |
| **STATUS:** |
| -Written 08:55 Dublin on 2026-10-02 (the session hit a provider limit at about 08:00 Dublin and resumed at 08:40; nothing was lost: the uncommitted round-fifteen edits were intact and are now committed), during the second overnight run (brief: "continue overnight until we're ready to enable payments"; ready means reviewed, tested, integrated code and a scoped enablement plan, not payments switched on). Billing is OFF everywhere. No live Stripe write, no AWS change, no charge, no merge to main. Every payment anyone can see is a labelled simulation. |
| +Written 09:15 Dublin on 2026-10-02 (the session hit a provider limit at about 08:00 Dublin and resumed at 08:40; nothing was lost: the uncommitted round-fifteen edits were intact and are now committed), during the second overnight run (brief: "continue overnight until we're ready to enable payments"; ready means reviewed, tested, integrated code and a scoped enablement plan, not payments switched on). Billing is OFF everywhere. No live Stripe write, no AWS change, no charge, no merge to main. Every payment anyone can see is a labelled simulation. |
| |
| -Review servers, all answering 200: pricing page `http://100.119.180.57:38009` (static, rebuilt from site `2fc6388`), signup and billing demo `http://100.119.180.57:41881` (rebuilt 08:5x from the currency branch's tip `3527a066`, price book configured, USD/EUR/GBP end to end; Keymail and Stripe simulated), console billing copy `http://100.119.180.57:45033` if still up. |
| +Review servers, all answering 200: pricing page `http://100.119.180.57:38009` (static, rebuilt from site `2fc6388`), signup and billing demo `http://100.119.180.57:41881` (rebuilt 09:1x from the currency branch's tip `db130cfc`, price book configured, USD/EUR/GBP end to end; Keymail and Stripe simulated), console billing copy `http://100.119.180.57:45033` if still up. |
| |
| The durable records are on this branch under `implementation/carloku-paid-launch/`: `READINESS.md` (every branch's tip, gate log, CI and review state, with the verified behaviour), `ENABLEMENT.md` (the scoped plan to enable payments: catalog of 36, cutovers, key permissions, webhook, portal, release order, rollback, approvals), `OVERAGE-RATES-PROPOSAL.md` (the USD/GBP rate table for approval), `stripe-live-readiness.json` (remaining list revised for 36 prices and the book), `OUTSTANDING.md` (the metered model's open items and approvals A to K). |
| |
| Decisions received 2026-10-01 evening, applied: the annual bases (28/24/22, 6/5/4.50, 60/50/45 USD/EUR/GBP, team minimum ten) confirmed for implementation only; the currency rulings (USD default, EUR for EU member states, GBP for the UK, visible override, one stored currency for subscription and overages, bands by billing country only); the five currency strings and the regrouped pricing page copy, approved verbatim and applied. Still a draft: the book `2026-10-01-draft1` and the USD/GBP overage rates and floors. |
| |
| Branches (all on the forge, none merged; the local gate is not CI): |
| -- `feat/carloku-multi-currency-20261001` `3527a066`: the price book and one stored currency per purchase end to end, the billing page as one form with a server-signed quote, ownership on every path, the refusal review keyed by its intent with the session recorded, the cookies, the demo. Rounds ten to thirteen ended with both reviewers accepting with P3 fixes; **round fourteen did not: Astra found a P2** (a first purchase's record and its intent's retirement were two transactions under no common lock, so a reconciliation paused on the provider read while the operator resolved the review recorded the retired purchase). Fixed in `abd1b76e`: the record consumes the exact standing intent in its own transaction, and the same lifecycle holds on every path (an intent under an open review is never retired by an expiry; a retired intent's completion and subscription events are settled, not retried; a refusal whose session read came back as another session files nothing), with tests that fail without each fix and six killed mutants (dispositions "Review fourteen"). Round fifteen (both accept with fixes) found the last exception to that lifecycle, a purchase corrected at the provider recording under its open review; `3527a066` closes it by the ruling: nothing records on an intent under an open review, and the operator's resolution retires the intent (default) or keeps it (`outcome: keep`) for the corrected purchase to record; a retired intent's events settle whatever intent stands. Gate and CI passed through `abd1b76e`; gate on `3527a066` running at 08:55, CI pending; the sixteenth review is reading it. These findings were not minor: each round since ten found a real gap in the lifecycle of an intent under review. |
| -- `feat/carloku-metered-replicator-20261001` `03b19014`: fifteenth build. Reviews ten to fourteen (Opus accept with fixes, Astra reject) each found the previous build's own addition wanting; the fourteenth build made the link entry one to one and the fifteenth quotes every entry in the inventory's rendering (the drift key), classifies a link by the spelling its entry names, and makes the Accept test tell as-written from cleaned. Gate and CI passed on `ec55b639`; gate on `03b19014` running; the fifteenth review is reading it. The deep items stay open and are listed in `READINESS.md`; none is minor, and the branch cannot be wired until they are closed or decided (the walk by directory descriptor, litestream's opens by path, durable transition state, the uid binding under approval H, the box-wide refusal decision). |
| +- `feat/carloku-multi-currency-20261001` `db130cfc`: the price book and one stored currency per purchase end to end, the billing page as one form with a server-signed quote, ownership on every path, the refusal review keyed by its intent with the session recorded, the cookies, the demo. Rounds ten to thirteen ended with both reviewers accepting with P3 fixes; **round fourteen did not: Astra found a P2** (a first purchase's record and its intent's retirement were two transactions under no common lock, so a reconciliation paused on the provider read while the operator resolved the review recorded the retired purchase). Fixed in `abd1b76e`: the record consumes the exact standing intent in its own transaction, and the same lifecycle holds on every path (an intent under an open review is never retired by an expiry; a retired intent's completion and subscription events are settled, not retried; a refusal whose session read came back as another session files nothing), with tests that fail without each fix and six killed mutants (dispositions "Review fourteen"). Round fifteen (both accept with fixes) found the last exception to that lifecycle, a purchase corrected at the provider recording under its open review; `3527a066` closes it by the ruling: nothing records on an intent under an open review, and the operator's resolution retires the intent (default) or keeps it (`outcome: keep`) for the corrected purchase to record; a retired intent's events settle whatever intent stands. Round sixteen (both accept with fixes) tightened the new `keep` outcome: it is accepted only for an intent whose bound session reads back complete with a subscription (anything else would later expire unrecorded), and the outcome is written, replay-compared and audited; `db130cfc` carries those fixes, the operator's rejected-events listing (`GET /api/billing/rejected`, named missing by both reviewers since round eleven) and the provisioning script's currency-option notes aligned with the code. Gate and CI passed through `3527a066`; gate on `db130cfc` running at 09:15, CI pending; the seventeenth review is reading it. These findings were not minor: each round since ten found a real gap in the lifecycle of an intent under review; the last three rounds converged on the operator's door rather than the money path. |
| +- `feat/carloku-metered-replicator-20261001` `f306222c`: sixteenth build. Reviews ten to fourteen (Opus accept with fixes, Astra reject) each found the previous build's own addition wanting; the fourteenth build made the link entry one to one and the fifteenth quotes every entry in the inventory's rendering (the drift key), classifies a link by the spelling its entry names, and makes the Accept test tell as-written from cleaned. Review fifteen (Opus accept with fixes, Astra reject on the deep items) found a regression the fifteenth build made: a relative link target was joined and so cleaned, which is not how the kernel resolves a `..` after a link, so a link to a directory outside the tree passed in silence; the sixteenth build concatenates uncleaned, with the fixture both asked for. Gate and CI passed on `03b19014`; gate and CI on `f306222c` running; the sixteenth review is reading it. The seventeenth build will carry Astra's fifteenth report, the render test over every category and the registry witness's wording. The deep items stay open and are listed in `READINESS.md`; none is minor, and the branch cannot be wired until they are closed or decided (the walk by directory descriptor, litestream's opens by path, durable transition state, the uid binding under approval H, the box-wide refusal decision). |
| - `feat/carloku-storage-sole-holder-20261001` `eaf6e63e`: round 9 both accept; CI passed; needs approval K and a cutover date. |
| - `fix/carloku-observe-routes-cleanup-20261001` `023e106c`: both accept; CI passed; merged into this branch at `47c97fa6`; the gate on the launch tip `b953fae4` passed (exit 0, three cross builds). |
| - `feat/carloku-billing-layout-20261001` `c1ae91a0`: merged into the currency branch; its two-form page was replaced by one form. |
| - `feat/carloku-late-request-fencing-20261001` `1b61de82`, `feat/carloku-bucket-hour-evidence-20261001` `0aa1fbec`: unchanged (rejected / needs approval J). |
| -- Site `feat/paid-pricing-20260916` (GitHub) `a7283e7`: every amount from the platform's export; country band wiring; exact rates; honest link parameters, static links included; a draft book cannot be published by `check` or `build`; `bands.p3` carries the approved currency explanation; every priced slot, in every currency and band, and every banded inclusion equals its exported value; a figure is a whole number token on both sides (19 tests pass: `node --test test/*.test.mjs`). |
| +- Site `feat/paid-pricing-20260916` (GitHub) `c12318d`: every amount from the platform's export; country band wiring; exact rates; honest link parameters, static links included; a draft book cannot be published by `check` or `build`; `bands.p3` carries the approved currency explanation; every priced slot, in every currency and band, and every banded inclusion equals its exported value; a figure is a whole number token on both sides (19 tests pass: `node --test test/*.test.mjs`). |
| |
| **NEEDED:** |
| - Paul, commercial: approve the 36 amounts as an `approved` book version (approval L) together with the USD/GBP overage rates and floors in `OVERAGE-RATES-PROPOSAL.md`, or state other figures; the HALF code word; the proration policy (B); the partial-month rule (C). |
| - Paul, copy: the console billing page's 40 strings; the store-refusal copy (`OUTSTANDING.md` 19g). `bands.p3` is done: the approved currency explanation replaced the converted-euro sentence (site `e091e3f`, 07:0x); it now reads the same as the note under the currency selector. |
| - Paul, rulings: evidence for a held bucket-hour (J); storage on a bucket a store has left (K); the cutover note (M: purchases before the book stay legacy EUR; binary first, variables second). |
| - Scoped approvals, prepared as plans only: Stripe test mode (E) for the fence test and the rehearsal; Stripe live provisioning (F) after the approved book; the Cost and Usage Report export and the scratch-object write (G); Path B on a dev box (H). |
| -- Reviews to read when they land: the currency branch's sixteenth (`logs/opus-currency-review16.md`, `astra-currency-review16.md`) and the replicator's fifteenth (`opus-replicator-review15.md`, `astra-replicator-review15.md`). |
| +- Reviews to read when they land: the currency branch's seventeenth (`logs/opus-currency-review17.md`, `astra-currency-review17.md`) and the replicator's sixteenth (`opus-replicator-review16.md`, `astra-replicator-review16.md`). |
| |
| **STILL TO BUILD (code, not approvals; no fake completes these):** quantity reduction at renewal (`OUTSTANDING.md` 14), the Free tier (15), dormancy and pool accounting (16), per-line tax codes across a change (17), the operator doors (18, plus the quantity-history gap door and a rejected-events listing), the meters' own code (replicator unwired with deep items open; store transfer has no source), the two key-memory defects (7, 9). `READINESS.md` has the list with what each means. The tests on the currency branch establish the subscription and currency path against fakes, nothing beyond it. |
| |
| **RECOMMENDED:** |
| -- Read the sixteenth currency review. If both accept with nothing left to fix and CI is green on the tip, merge the currency branch into this branch: a merge commit pushed to this branch, as the observe-routes fix was at `47c97fa6` (`amadan branch merge` lands a branch on main and is not what this step is), then gate the merged tip. If it does not confirm, the next commit answers it the same way. Rule on K to let the storage branch follow. |
| +- Read the seventeenth currency review. If both accept with nothing left to fix and CI is green on the tip, merge the currency branch into this branch: a merge commit pushed to this branch, as the observe-routes fix was at `47c97fa6` (`amadan branch merge` lands a branch on main and is not what this step is), then gate the merged tip. If it does not confirm, the next commit answers it the same way. Rule on K to let the storage branch follow. |
| - Publish the approved book version as soon as L is given; it is a new entry in `internal/plans/pricebook.json`, the export regenerated and copied to the site, and the 36 lookup keys renamed. |
| - Test-mode rehearsal (E) before anything live: the list in both reviews and in `ENABLEMENT.md` section 6. |
| - Then, each on its own branch: quantity reduction at renewal, the evidence door for a box's first minutes, the AWS principal inventory and the bucket ownership attestation door, Free-tier enforcement, dormancy and pool accounting. |
| |
| **SESSION:** |
| -Running at 08:55: the gates on the currency tip `3527a066` and the replicator tip `03b19014`, the two sixteenth-round currency reviews, the two fifteenth replicator reviews (detached `setsid` processes; their output files are named in `READINESS.md`). The demo (pid in `layout-review/demo-redesigned.log`'s process, stop marker `layout-review/demo-redesigned.stop`) and the pricing preview (`python3 -m http.server 38009`) keep serving. |
| +Running at 09:15: the gates on the currency tip `db130cfc` and the replicator tip `f306222c`, the two seventeenth-round currency reviews, the two sixteenth replicator reviews (detached `setsid` processes; their output files are named in `READINESS.md`). The demo (pid in `layout-review/demo-redesigned.log`'s process, stop marker `layout-review/demo-redesigned.stop`) and the pricing preview (`python3 -m http.server 38009`) keep serving. |
| |
| Scratch on the box: `~/.cache/tmp/claude-1001/{currency-wt,replicator-wt,fencing-wt,evidence-wt}` (git worktrees), the demo binaries, `/var/tmp/ck`, `~/.cache/carloku-gate`. The void gate logs are named `*VOID*`. |
amadan