carlos / platform Public

Readiness and handoff at 06:45: round eleven accepted with fixes, the fixes in and round twelve running; the replicator's tenth build gated and under review

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

claude 3 weeks ago 0e6ff4829b390786619cc375941a24dea1d7a2c6 parent 3112408

3 files changed, +25 −20

.claude/HANDOFF.md +7 −7
implementation/carloku-paid-launch/ENABLEMENT.md +3 −3
implementation/carloku-paid-launch/READINESS.md +15 −10

CI passed — run details

diff --git a/.claude/HANDOFF.md b/.claude/HANDOFF.md

index 27d2b0745..88c63dc85 100644

--- a/.claude/HANDOFF.md

+++ b/.claude/HANDOFF.md

@@ -7,17 +7,17 @@

Get Carloku's paid plans live with Stripe Tax and the complete metered model; have the pricing page and signup flow reviewable in the morning.

**STATUS:**

-Written 06:25 Dublin on 2026-10-02, during the second overnight run (brief: "continue overnight until we're ready to enable payments"; ready means reviewed, tested, integrated code and a scoped enablement plan, not payments switched on). Billing is OFF everywhere. No live Stripe write, no AWS change, no charge, no merge to main. Every payment anyone can see is a labelled simulation.

+Written 06:45 Dublin on 2026-10-02, during the second overnight run (brief: "continue overnight until we're ready to enable payments"; ready means reviewed, tested, integrated code and a scoped enablement plan, not payments switched on). Billing is OFF everywhere. No live Stripe write, no AWS change, no charge, no merge to main. Every payment anyone can see is a labelled simulation.

-Review servers, all answering 200: pricing page `http://100.119.180.57:38009` (static, rebuilt from site `2fc6388`), signup and billing demo `http://100.119.180.57:41881` (rebuilt 06:2x from the currency branch's code tip `25487506`, price book configured, USD/EUR/GBP end to end; Keymail and Stripe simulated), console billing copy `http://100.119.180.57:45033` if still up.

+Review servers, all answering 200: pricing page `http://100.119.180.57:38009` (static, rebuilt from site `2fc6388`), signup and billing demo `http://100.119.180.57:41881` (rebuilt 06:4x from the currency branch's tip `781bb1c2`, price book configured, USD/EUR/GBP end to end; Keymail and Stripe simulated), console billing copy `http://100.119.180.57:45033` if still up.

The durable records are on this branch under `implementation/carloku-paid-launch/`: `READINESS.md` (every branch's tip, gate log, CI and review state, with the verified behaviour), `ENABLEMENT.md` (the scoped plan to enable payments: catalog of 36, cutovers, key permissions, webhook, portal, release order, rollback, approvals), `OVERAGE-RATES-PROPOSAL.md` (the USD/GBP rate table for approval), `stripe-live-readiness.json` (remaining list revised for 36 prices and the book), `OUTSTANDING.md` (the metered model's open items and approvals A to K).

Decisions received 2026-10-01 evening, applied: the annual bases (28/24/22, 6/5/4.50, 60/50/45 USD/EUR/GBP, team minimum ten) confirmed for implementation only; the currency rulings (USD default, EUR for EU member states, GBP for the UK, visible override, one stored currency for subscription and overages, bands by billing country only); the five currency strings and the regrouped pricing page copy, approved verbatim and applied. Still a draft: the book `2026-10-01-draft1` and the USD/GBP overage rates and floors.

Branches (all on the forge, none merged; the local gate is not CI):

-- `feat/carloku-multi-currency-20261001` `28dc2629` (code tip `25487506`): the price book and one stored currency per purchase end to end, the billing page as one form with a server-signed quote, ownership on every path, the refusal review keyed by its intent with the session recorded, the cookies, the demo. **Round ten (at `faf1bd25`) is the first with both reviewers accepting**, each with fixes: the same P3 from both (reconcile judged the bound session on ownership and currency alone) and one more from Astra (a session naming two accounts); both fixed in `25487506` with distinguishing tests and killed mutants (dispositions "Review ten"). Gate and CI passed through `faf1bd25`; gate on `25487506` running at 06:25, CI pending; the eleventh review is reading the fixes.

-- `feat/carloku-metered-replicator-20261001` `e5e67b25` (code tip `142ef5d0`): ninth build. The eighth review (both reject) found one P1 the eighth build's own fix had made: a latched predecessor was taken for a closed one, so a replacement could open beside a running fleet; the ninth build asks each fleet's own closed flag first and latches under the stale lock, with two tests and four killed mutants, plus the bounded items (a `..` only in a link target's leading run, umask-proof fixtures, the comments both listed). Gate and CI passed on `142ef5d0`; ninth review running. The deep items stay open and are listed in `READINESS.md`; the walk by directory descriptor is required before wiring.

+- `feat/carloku-multi-currency-20261001` `781bb1c2`: the price book and one stored currency per purchase end to end, the billing page as one form with a server-signed quote, ownership on every path, the refusal review keyed by its intent with the session recorded, the cookies, the demo. **Rounds ten and eleven both ended with both reviewers accepting, each with P3 fixes**, applied in `25487506` and `781bb1c2` with distinguishing tests and killed mutants (dispositions "Review ten", "Review eleven"; round eleven's: a bound session read back as nobody's now files the intent-keyed review instead of wedging the intent, a subscription that is not the intent's purchase files it too, an expiry's answer must name the account). Gate and CI passed through `28dc2629`; gate on `781bb1c2` running at 06:45, CI pending; the twelfth review is reading the fixes.

+- `feat/carloku-metered-replicator-20261001` `9301ed62`: tenth build. The ninth review (Opus accept with fixes, Astra reject on the deep items) found one P2: `Close` took no last look at the files, so a swap still in place at a rebuild was held by nobody; the tenth build takes that look before the witness read, inventories an exec route's database outside the globs, reports a hibernating route over a unit claim, and pins the latch inside `Close`, with five killed mutants. Gate and CI passed on `9301ed62`; tenth review: Opus in, Astra pending. The deep items stay open and are listed in `READINESS.md`; the walk by directory descriptor is required before wiring.

- `feat/carloku-storage-sole-holder-20261001` `eaf6e63e`: round 9 both accept; CI passed; needs approval K and a cutover date.

- `fix/carloku-observe-routes-cleanup-20261001` `023e106c`: both accept; CI passed; merged into this branch at `47c97fa6`; the gate on the launch tip `b953fae4` passed (exit 0, three cross builds).

- `feat/carloku-billing-layout-20261001` `c1ae91a0`: merged into the currency branch; its two-form page was replaced by one form.

@@ -29,15 +29,15 @@ Branches (all on the forge, none merged; the local gate is not CI):

- Paul, copy: the console billing page's 40 strings; the store-refusal copy (`OUTSTANDING.md` 19g); a new sentence for the pricing page's `bands.p3` ("The euro price is what is charged" is wrong under fixed currencies); the approved pricing and currency strings themselves need nothing more.

- Paul, rulings: evidence for a held bucket-hour (J); storage on a bucket a store has left (K); the cutover note (M: purchases before the book stay legacy EUR; binary first, variables second).

- Scoped approvals, prepared as plans only: Stripe test mode (E) for the fence test and the rehearsal; Stripe live provisioning (F) after the approved book; the Cost and Usage Report export and the scratch-object write (G); Path B on a dev box (H).

-- Reviews to read when they land: the currency branch's eleventh (`logs/opus-currency-review11.md`, `astra-currency-review11.md`) and the replicator's ninth (`opus-replicator-review9.md`, `astra-replicator-review9.md`).

+- Reviews to read when they land: the currency branch's twelfth (`logs/opus-currency-review12.md`, `astra-currency-review12.md`) and the replicator's tenth (`opus-replicator-review10.md` is in; `astra-replicator-review10.md` pending).

**RECOMMENDED:**

-- Read the eleventh currency review. If it confirms round ten's fixes (both accepted round ten with fixes; the fixes are in `25487506`) and CI is green on the tip, merge the currency branch into this branch: a merge commit pushed to this branch, as the observe-routes fix was at `47c97fa6` (`amadan branch merge` lands a branch on main and is not what this step is), then gate the merged tip. If it does not confirm, the next commit answers it the same way. Rule on K to let the storage branch follow.

+- Read the twelfth currency review. If it confirms round eleven's fixes (both accepted rounds ten and eleven with fixes; the fixes are in `25487506` and `781bb1c2`) and CI is green on the tip, merge the currency branch into this branch: a merge commit pushed to this branch, as the observe-routes fix was at `47c97fa6` (`amadan branch merge` lands a branch on main and is not what this step is), then gate the merged tip. If it does not confirm, the next commit answers it the same way. Rule on K to let the storage branch follow.

- Publish the approved book version as soon as L is given; it is a new entry in `internal/plans/pricebook.json`, the export regenerated and copied to the site, and the 36 lookup keys renamed.

- Test-mode rehearsal (E) before anything live: the list in both reviews and in `ENABLEMENT.md` section 6.

- Then, each on its own branch: quantity reduction at renewal, the evidence door for a box's first minutes, the AWS principal inventory and the bucket ownership attestation door, Free-tier enforcement, dormancy and pool accounting.

**SESSION:**

-Running at 06:25: the gate on the currency code tip `25487506`, the two eleventh-round currency reviews, the two ninth replicator reviews (detached `setsid` processes; their output files are named in `READINESS.md`). The demo (pid in `layout-review/demo-redesigned.log`'s process, stop marker `layout-review/demo-redesigned.stop`) and the pricing preview (`python3 -m http.server 38009`) keep serving.

+Running at 06:45: the gate on the currency tip `781bb1c2`, the two twelfth-round currency reviews, Astra's tenth replicator review (detached `setsid` processes; their output files are named in `READINESS.md`). The demo (pid in `layout-review/demo-redesigned.log`'s process, stop marker `layout-review/demo-redesigned.stop`) and the pricing preview (`python3 -m http.server 38009`) keep serving.

Scratch on the box: `~/.cache/tmp/claude-1001/{currency-wt,replicator-wt,fencing-wt,evidence-wt}` (git worktrees), the demo binaries, `/var/tmp/ck`, `~/.cache/carloku-gate`. The void gate logs are named `*VOID*`.

diff --git a/implementation/carloku-paid-launch/ENABLEMENT.md b/implementation/carloku-paid-launch/ENABLEMENT.md

index 6665b632e..eb9d2da9a 100644

--- a/implementation/carloku-paid-launch/ENABLEMENT.md

+++ b/implementation/carloku-paid-launch/ENABLEMENT.md

@@ -193,9 +193,9 @@ Ready means: reviewed, tested, integrated code, and this plan with its

approvals granted. It does not mean payments switched on.

- Code: the currency branch at its tip is gated locally and pushed; its

- tenth independent review (Opus and Astra) accepted it with fixes, the

- fixes are in `25487506`, and the eleventh review of those is the one to

- read before any merge. The readiness checklist (`READINESS.md`) names

+ tenth and eleventh independent reviews (Opus and Astra) accepted it with

+ fixes, the fixes are in `25487506` and `781bb1c2`, and the twelfth

+ review of those is the one to read before any merge. The readiness checklist (`READINESS.md`) names

every commit, gate log, review verdict and CI run.

- Not code: approvals A (remaining parts), B, E, F, L, M; the test-mode

rehearsal; the live provisioning; the first live proof.

diff --git a/implementation/carloku-paid-launch/READINESS.md b/implementation/carloku-paid-launch/READINESS.md

index 688657ce3..bf55c4d87 100644

--- a/implementation/carloku-paid-launch/READINESS.md

+++ b/implementation/carloku-paid-launch/READINESS.md

@@ -14,17 +14,17 @@ Log files are under `/home/paulca/.local/share/carloku-paid-launch-20260930/logs

| --- | --- | --- | --- | --- | --- |

-| `feat/carloku-multi-currency-20261001` | `28dc2629` (= `25487506`, the tenth review's findings, plus the tenth review's two reports) | passed on every code tip through `faf1bd25` (04:58Z, `gate-currency-faf1bd25.txt`, exit 0, three cross builds, clean tree); `25487506`: started 05:18Z (`gate-currency-25487506.txt`); the console package passed in full on the same tree before the commit. Void logs, not evidence: `gate-currency-a9304f16.txt`, `gate-currency-f269365a-VOID-dirty-tree.txt` | passed on every pushed tip through `faf1bd25`; `25487506` and `28dc2629` pending | Rounds 1 to 9, each Opus accept with fixes and Astra reject, each round's findings fixed in the next commit with distinguishing tests and mutation checks (dispositions, one section per round). **Round 10 at `faf1bd25`: both accept with fixes**, the first such round; each found the same P3 (reconcile judged the bound session on ownership and currency alone, so a subscription event before the completion event could record a purchase the binder would have reviewed for its plan or band) and Astra one more (a session naming two accounts passed the resume and listing paths); nothing in a money path. Fixed in `25487506` with distinguishing tests and three killed mutants (dispositions "Review ten"). Round 11 at `25487506`: running | integrated end to end; not merged; the merge waits on round 11 confirming the fixes and CI on the tip |

+| `feat/carloku-multi-currency-20261001` | `781bb1c2` (the eleventh review's findings, with the tenth and eleventh reviews' reports) | passed on every code tip through `28dc2629` (05:28Z, `gate-currency-28dc2629.txt`, exit 0, three cross builds, clean tree; `25487506`'s own run is kept as `gate-currency-25487506-ended-on-28dc2629-reports-added-during-run.txt`, not used as evidence); `781bb1c2`: started 05:41Z (`gate-currency-781bb1c2.txt`); the console package passed in full on the same tree before the commit. Void logs, not evidence: `gate-currency-a9304f16.txt`, `gate-currency-f269365a-VOID-dirty-tree.txt` | passed on every pushed tip through `28dc2629`; `781bb1c2` pending | Rounds 1 to 9, each Opus accept with fixes and Astra reject, each round's findings fixed in the next commit with distinguishing tests and mutation checks (dispositions, one section per round). **Rounds 10 (at `faf1bd25`) and 11 (at `25487506`): both accept with fixes**, each round's P3s fixed in the next commit (round 10: reconcile's purchase judgement, a session naming two accounts; round 11: the bound session read back as nobody's now files the intent-keyed review instead of wedging the intent, a subscription that is not the intent's purchase files it too, an expiry's answer must name the account), nothing in a money path. Round 12 at `781bb1c2`: running | integrated end to end; not merged; the merge waits on round 12 confirming the fixes and CI on the tip |

-| `feat/carloku-metered-replicator-20261001` | `e5e67b25` (= `142ef5d0`, the ninth build, plus the eighth review's two reports) | passed on every code tip through `142ef5d0` (05:11Z, `gate-replicator-142ef5d0.txt`, exit 0, three cross builds); the ops package passes under `/tmp`, `~/.cache`, `umask 077` and the race detector | passed on every pushed tip through `142ef5d0`; `e5e67b25` pending | 4 to 7: each Opus accept with fixes, Astra reject; 8 at `b5aecf13`: both reject on one P1 the eighth build's own fix had made (a latched predecessor taken for a closed one, so a replacement could open beside a running fleet), fixed in the ninth build with two tests and four killed mutants (dispositions "Review eight"); 9 at `142ef5d0`: running. The deep items stay open and are listed there: litestream's own opens by path (every reopen), protected endpoints under tenant-replaceable ancestry, requests tracked to completion across midnight and a crash, a walk by directory descriptor (required before wiring), a tenant sharing the platform's uid or root-run units, an exec route's claimed file outside the globs, one tenant's deletion holding every account's days (a stated availability cost) | not merged; unwired side work gated on approval H |

+| `feat/carloku-metered-replicator-20261001` | `9301ed62` (tenth build, with the eighth and ninth reviews' reports) | passed on every code tip through `9301ed62` (05:32Z, `gate-replicator-9301ed62.txt`, exit 0, three cross builds); the ops package passes under `/tmp`, `~/.cache`, `umask 077` and the race detector | passed on every pushed tip through `9301ed62` | 4 to 7: each Opus accept with fixes, Astra reject; 8 at `b5aecf13`: both reject on one P1 the eighth build's own fix had made (fixed in the ninth build with two tests and four killed mutants); 9 at `142ef5d0`: Opus accept with fixes (one P2: `Close` took no last look at the files), Astra reject (the deep items); the tenth build fixes the P2, inventories exec claims outside the globs and reports a hibernating route over a unit claim, with five killed mutants (dispositions "Review nine"); 10 at `9301ed62`: Opus in, Astra pending at 06:45. The deep items stay open and are listed there: litestream's own opens by path (every reopen), protected endpoints under tenant-replaceable ancestry, requests tracked to completion across midnight and a crash, a walk by directory descriptor (required before wiring), a tenant sharing the platform's uid or root-run units, one tenant's deletion holding every account's days (a stated availability cost) | not merged; unwired side work gated on approval H |

| `feat/carloku-paid-launch-20260916` (launch) | this commit: documents only on top of `3d47602b`; last code change the merge of the observe-routes fix (`47c97fa6`) | passed 03:06Z on `b953fae4` (`gate-launch-b953fae4.txt`, exit 0, three cross builds); every commit since is documents | passed on `3d47602b` | 17 rounds, no whole-branch pass | the integration target; first accepted side branch merged |

| site `feat/paid-pricing-20260916` (GitHub) | `3f1610d` (a test renamed for what it checks, after review ten) | `node --test test/*.test.mjs`: 18 pass (05:18Z) | n/a | read-only by the currency reviews (section K); rounds four, five and ten's site findings fixed in `4feb1cd`, `9427c22`, `3f1610d` | preview served at `http://100.119.180.57:38009`, rebuilt from `4feb1cd` (the later changes are the build script and a test name alone) |

## The flow, behaviour the tests establish (2026-10-02)

-These are what the automated tests assert on `25487506`, against fakes of Keymail and Stripe; none of it is proven against the real provider; the tenth independent review accepted the code with fixes (applied in `25487506`) and the eleventh is reading them. Tests: (`internal/console`: `TestBillingFormPostsWhatItShows`,

+These are what the automated tests assert on `781bb1c2`, against fakes of Keymail and Stripe; none of it is proven against the real provider; the tenth and eleventh independent reviews accepted the code with fixes (applied in `25487506` and `781bb1c2`) and the twelfth is reading them. Tests: (`internal/console`: `TestBillingFormPostsWhatItShows`,

`TestBillingPageCurrencyControls`, `TestPricingLinkSurvivesSignIn`,

`TestCurrencySuggestionCookie`, `TestCountrySuggestionCookie`,

`TestBillingInclusionsFollowTheQuotedBand`,

@@ -60,9 +60,12 @@ reconcile, calculation, invoice and recovery tests in

subscription event delivered before the completion event meets the

same judgement of the session as the completion would, and records

nothing from a session the binder would review; a session naming two

- accounts is nobody's on every path. They hold at `25487506` by the

- tests named.

-- Demo at `http://100.119.180.57:41881`: rebuilt 06:2x from `25487506`

+ accounts is nobody's on every path, and when it is the session an

+ intent is bound to, the operator is told through the intent-keyed

+ review rather than the intent wedging in silence; an expiry's answer

+ must name the account before anything is retired. They hold at

+ `781bb1c2` by the tests named.

+- Demo at `http://100.119.180.57:41881`: rebuilt 06:4x from `781bb1c2`

(binary `billing-redesigned.test`, started by the stop-marker procedure;

the EUR-only binary is kept as `billing-redesigned-eur-only.test.bak`),

serving with the price book configured: the whole path from the pricing

@@ -98,9 +101,11 @@ Each is scoped in `ENABLEMENT.md` section 8 and `OUTSTANDING.md`.

- The replicator's deep open items after its eighth review are in its

row above; each build fixes that round's bounded ones and the ninth

build fixed the one P1 the eighth had made.

-- Open on the currency branch after round nine: an operator's door to

+- Open on the currency branch after round eleven: an operator's door to

clear a quantity-history gap whose cause the operator has established

(none exists; such an account stays held, and the roll note forbids the

- rollback that makes one); two unreviewed system strings on the billing

- page (`billing.quote.unknown`, `billing.currency.unknown`); everything

- else waits on Stripe test mode.

+ rollback that makes one); a listing of rejected webhook events for the

+ operator (none exists; the intent-keyed reviews are what reaches the

+ operator); two unreviewed system strings on the billing page

+ (`billing.quote.unknown`, `billing.currency.unknown`); everything else

+ waits on Stripe test mode.