amadan
Decisions for Paul in one file (thirteen, with proposals and what each unblocks); readiness and handoff at 11:03 with the replicator's twentieth review processed
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
3 files changed,
+51
−2
.claude/HANDOFF.md+2 −1implementation/carloku-paid-launch/DECISIONS-FOR-PAUL.md+48 −0implementation/carloku-paid-launch/READINESS.md+1 −1
CI passed — run details
diff --git a/.claude/HANDOFF.md b/.claude/HANDOFF.md| index 4029dd4be..ee9e62176 100644 |
| --- a/.claude/HANDOFF.md |
| +++ b/.claude/HANDOFF.md |
| @@ -17,7 +17,7 @@ Decisions received 2026-10-01 evening, applied: the annual bases (28/24/22, 6/5/ |
| Branches (all on the forge, none merged; the local gate is not CI): |
| - `feat/carloku-multi-currency-20261001` `68f6ee23`: the price book and one stored currency per purchase end to end, the billing page as one form with a server-signed quote, ownership on every path, the refusal review keyed by its intent with the session recorded, the cookies, the demo. Rounds ten to thirteen ended with both reviewers accepting with P3 fixes; **round fourteen did not: Astra found a P2** (a first purchase's record and its intent's retirement were two transactions under no common lock, so a reconciliation paused on the provider read while the operator resolved the review recorded the retired purchase). Fixed in `abd1b76e`: the record consumes the exact standing intent in its own transaction, and the same lifecycle holds on every path (an intent under an open review is never retired by an expiry; a retired intent's completion and subscription events are settled, not retried; a refusal whose session read came back as another session files nothing), with tests that fail without each fix and six killed mutants (dispositions "Review fourteen"). Round fifteen (both accept with fixes) found the last exception to that lifecycle, a purchase corrected at the provider recording under its open review; `3527a066` closes it by the ruling: nothing records on an intent under an open review, and the operator's resolution retires the intent (default) or keeps it (`outcome: keep`) for the corrected purchase to record; a retired intent's events settle whatever intent stands. Round sixteen (both accept with fixes) tightened the new `keep` outcome: it is accepted only for an intent whose bound session reads back complete with a subscription (anything else would later expire unrecorded), and the outcome is written, replay-compared and audited; `db130cfc` carries those fixes, the operator's rejected-events listing (`GET /api/billing/rejected`, named missing by both reviewers since round eleven) and the provisioning script's currency-option notes aligned with the code. Round seventeen did not confirm either: Opus accepted with four P3s on the `keep` door and the rejected listing; **Astra found a P2 in the refusal's own order**: both sites that expire a bound session expired first and filed the review second, so a pass that read the expired session in between, or a crash between the two, retired the intent with no record. `68f6ee23` files the review first at both sites (a two-path race test runs the store's retirement inside the fake's expiry and wants the conflict; it fails with either order put back), closes the four P3s, adds two tests (an older resolutions table migrates with `retire`; the listing's 200-row bound, newest first, the account on each row) and corrects the comments and the design sentence both reviewers named. Gate and CI passed on `68f6ee23`. **Round eighteen did not confirm**: both reviewers found that with the review filed first, an operator's `retire` can delete the intent while its bound session is still open and payable (the expiry failed; nothing retries it; the resume path still offers the URL). Per the 10:20 supervision this is not fixed by moving calls again: a durable retirement protocol is designed instead (`docs/superpowers/specs/2026-10-02-intent-retirement-protocol-design.md`: the refusal recorded and authoritative; the session's fate proven from provider evidence and recorded on the intent, with a dispute state; the expiry requested under one fixed key by reader, pass and operator; the operator's completion atomic, `retire` only on a proven expiry, a paid session `settled` by a separate disposition or `keep`; the click offers no URL). Astra rejected revision 1 (four P2s) and revision 2 (five P2s); revision 3 (`15041ca2`) narrows what is built first to `retire` and `keep`, with a paid or disputed refusal held until Paul rules, and is under its third and last bounded review. **The P2 is open in code.** Round eighteen's bounded findings are fixed in `15041ca2` (gate running). These findings were not minor: each round since ten found a real gap in the lifecycle of an intent under review; the last three rounds converged on the operator's door rather than the money path. |
| -- `feat/carloku-metered-replicator-20261001` `6249af63`: eighteenth build. Reviews ten to fourteen (Opus accept with fixes, Astra reject) each found the previous build's own addition wanting; the fourteenth build made the link entry one to one and the fifteenth quotes every entry in the inventory's rendering (the drift key), classifies a link by the spelling its entry names, and makes the Accept test tell as-written from cleaned. Review fifteen (Opus accept with fixes, Astra reject on the deep items) found a regression the fifteenth build made: a relative link target was joined and so cleaned, which is not how the kernel resolves a `..` after a link, so a link to a directory outside the tree passed in silence; the sixteenth build concatenates uncleaned, with the fixture both asked for. Review sixteen (both) found that fixed and one bound left (the concatenated spelling could outgrow PATH_MAX); the seventeenth build `bffc76b5` stat'ed the target by itself against the link's directory, and **failed the gate and CI on its own fixture** (sized for a long temp root only), which review seventeen (Opus accept with fixes, Astra reject) had worked out, together with a worse defect in the same fix: the directory was opened by path with Go's default flags, so a FIFO a tenant swaps in would block the watch and Close. The eighteenth build (`e8211fc6`, `6249af63`) opens the directory as a directory and nothing else, sizes the fixture from the temp root, compares the rendering across sections, and corrects the comments, the test name and the outstanding item Astra listed; three mutants killed. Gate (exit 0, three cross builds) and CI passed on `6249af63`. Review eighteen: Opus accept with three P3s, Astra reject on the deep items. The nineteenth build `53e3dcd8` answered them (gate exit 0, three cross builds; CI passed). Review nineteen: Opus accept, Astra reject on the deep items. The twentieth build `c9ec11eb` makes the bounded changes (a tree claim refuses what a file claim refuses; the fixture's guard reachable; the no-recorder refusal quoted) and separates them in its dispositions from the deferred items; its gate and round twenty are running. The deep items stay open and are listed in `READINESS.md`; none is minor, and the branch cannot be wired until they are closed or decided (the walk by directory descriptor, litestream's opens by path, durable transition state, the uid binding under approval H, the box-wide refusal decision). |
| +- `feat/carloku-metered-replicator-20261001` `6249af63`: eighteenth build. Reviews ten to fourteen (Opus accept with fixes, Astra reject) each found the previous build's own addition wanting; the fourteenth build made the link entry one to one and the fifteenth quotes every entry in the inventory's rendering (the drift key), classifies a link by the spelling its entry names, and makes the Accept test tell as-written from cleaned. Review fifteen (Opus accept with fixes, Astra reject on the deep items) found a regression the fifteenth build made: a relative link target was joined and so cleaned, which is not how the kernel resolves a `..` after a link, so a link to a directory outside the tree passed in silence; the sixteenth build concatenates uncleaned, with the fixture both asked for. Review sixteen (both) found that fixed and one bound left (the concatenated spelling could outgrow PATH_MAX); the seventeenth build `bffc76b5` stat'ed the target by itself against the link's directory, and **failed the gate and CI on its own fixture** (sized for a long temp root only), which review seventeen (Opus accept with fixes, Astra reject) had worked out, together with a worse defect in the same fix: the directory was opened by path with Go's default flags, so a FIFO a tenant swaps in would block the watch and Close. The eighteenth build (`e8211fc6`, `6249af63`) opens the directory as a directory and nothing else, sizes the fixture from the temp root, compares the rendering across sections, and corrects the comments, the test name and the outstanding item Astra listed; three mutants killed. Gate (exit 0, three cross builds) and CI passed on `6249af63`. Review eighteen: Opus accept with three P3s, Astra reject on the deep items. The nineteenth build `53e3dcd8` answered them (gate exit 0, three cross builds; CI passed). Review nineteen: Opus accept, Astra reject on the deep items. The twentieth build `c9ec11eb` makes the bounded changes (a tree claim refuses what a file claim refuses; the fixture's guard reachable; the no-recorder refusal quoted) and separates them in its dispositions from the deferred items; `c9ec11eb`: gate exit 0 with three cross builds (09:52Z), CI passed. Review twenty: Opus accept with fixes, Astra reject on the deep items. `e1280811` answers it with comments, a fixture and dispositions only (no behaviour change; gate running; not sent for another round): the two refusals Opus named as widening what stops a whole box are listed as decisions (11 and 12 in the decisions file), not made as changes. The deep items stay open and are listed in `READINESS.md`; none is minor, and the branch cannot be wired until they are closed or decided (the walk by directory descriptor, litestream's opens by path, durable transition state, the uid binding under approval H, the box-wide refusal decision). |
| - `feat/carloku-storage-sole-holder-20261001` `eaf6e63e`: round 9 both accept; CI passed; needs approval K and a cutover date. |
| - `fix/carloku-observe-routes-cleanup-20261001` `023e106c`: both accept; CI passed; merged into this branch at `47c97fa6`; the gate on the launch tip `b953fae4` passed (exit 0, three cross builds). |
| - `feat/carloku-billing-layout-20261001` `c1ae91a0`: merged into the currency branch; its two-form page was replaced by one form. |
| @@ -25,6 +25,7 @@ Branches (all on the forge, none merged; the local gate is not CI): |
| - Site `feat/paid-pricing-20260916` (GitHub) `4026231`: `build` and `check` render from the export before the draft check (a stale page cannot be published past a newer export); a floor that is not whole cents is refused rather than shown as `$1.20.5`; after `c12318d`: every amount from the platform's export; country band wiring; exact rates; honest link parameters, static links included; a draft book cannot be published by `check` or `build`; `bands.p3` carries the approved currency explanation; every priced slot, in every currency and band, and every banded inclusion equals its exported value; a figure is a whole number token on both sides (21 tests pass: `node --test test/*.test.mjs`). |
| **NEEDED:** |
| +- **Start here: `implementation/carloku-paid-launch/DECISIONS-FOR-PAUL.md`.** Thirteen numbered choices in four groups (a refused purchase; people who leave a team; who is Free; the replicator), each with a proposal and what it unblocks, so they can be answered together. The lettered approvals A to M are separate and listed below. |
| - Paul, commercial: approve the 36 amounts as an `approved` book version (approval L) together with the USD/GBP overage rates and floors in `OVERAGE-RATES-PROPOSAL.md`, or state other figures; the HALF code word; the proration policy (B); the partial-month rule (C). |
| - Paul, copy: the console billing page's 40 strings; the store-refusal copy (`OUTSTANDING.md` 19g). `bands.p3` is done: the approved currency explanation replaced the converted-euro sentence (site `e091e3f`, 07:0x); it now reads the same as the note under the currency selector. |
| - Paul, rulings: evidence for a held bucket-hour (J); storage on a bucket a store has left (K); the cutover note (M: purchases before the book stay legacy EUR; binary first, variables second). |
diff --git a/implementation/carloku-paid-launch/DECISIONS-FOR-PAUL.md b/implementation/carloku-paid-launch/DECISIONS-FOR-PAUL.md| new file mode 100644 |
| index 000000000..1d24ab498 |
| --- /dev/null |
| +++ b/implementation/carloku-paid-launch/DECISIONS-FOR-PAUL.md |
| @@ -0,0 +1,48 @@ |
| +# Decisions for Paul, in one place |
| + |
| +Written 2026-10-02, 11:05 Dublin. Each item is a choice only Paul can make, with what was proposed and what it unblocks. Nothing here is decided. Billing is off; nothing was deployed. The lettered approvals A to M (copy, proration, partial month, test mode, live provisioning, the book, the cutover note, and the meters' G, H, J, K) are in `OUTSTANDING.md` and `ENABLEMENT.md` section 8 and are not repeated here. |
| + |
| +Answer by number. "As proposed" is a complete answer to any of them. |
| + |
| +## A. A refused purchase (multi-currency branch; blocks its merge) |
| + |
| +Context: when a checkout is refused (wrong currency, a hand-made subscription), the console files a review and holds the account. Review eighteen found that an operator's `retire` can delete the purchase while its checkout page is still payable. The fix is a recorded protocol, designed in `2026-10-02-intent-retirement-protocol-design.md` (multi-currency branch). **This defect is open in code.** The first stage needs none of these answers: it lets an operator retire only an expired, unpaid checkout, or keep a corrected paid one, and holds everything else. These decide what happens to what is held. |
| + |
| +1. **Money taken on a refused purchase.** May the platform ever keep it without recording a purchase (a one-off)? Proposed: no. It is refunded and the case closed as settled, or corrected at Stripe and kept. |
| +2. **What "settled" requires.** Before a paid, refused purchase can be closed. Proposed: the payment refunded in full (a refund that has succeeded, not one pending), the subscription it created canceled, no open or collectible invoice on it; the operator names the refund and the subscription; the console checks the subscription is canceled and holds the case while a refund is pending. |
| +3. **Stripe contradicting itself** about one checkout (expired, then paid; or its account changed). Proposed: hold the account and let a person close it only after a fresh read of Stripe agrees with what they are closing it as; no exception for a checkout whose account stays wrong (it stays held). |
| +4. **A checkout the console never bound** (its creation answer was lost, and it was found paid later). May it be kept as the purchase? Proposed: no; it can be closed (expired or settled), never kept. |
| +5. **What the buyer sees** while their purchase is under review. Proposed copy, for review: "we are checking this purchase. nothing more will be charged. we will email you." |
| + |
| +## B. People who leave a team (quantity reduction at renewal; team plans cannot be sold without it) |
| + |
| +Context: the approved rule is "people who leave come off at renewal". The design (`feat/carloku-quantity-reduction-20261002`) was rejected in review and needs these before it is redrawn. |
| + |
| +6. **A member who leaves and is replaced before the renewal.** Lowering the seat count early and raising it again charges a prorated seat that was already paid for, each time it happens. Options: (a) lower only at the renewal itself by a Stripe schedule, no re-charge, needs test-mode proof that a schedule coexists with seat additions; (b) lower in the last 72 hours, re-charge possible in that window only; (c) lower at once. Proposed: (a), falling back to (b) if test mode shows (a) does not work. |
| +7. **A reduction that was missed** (the worker down, or Stripe renewed first), so a year was billed at the old seat count. Proposed: the console detects and holds it; the difference is refunded by credit note. |
| +8. **Reductions wait for the proration policy (approval B).** A reduction cannot run safely unless seats that come back can be billed again. Proposed: yes, both switches. |
| + |
| +## C. The Free plan |
| + |
| +Context: the approved Free plan (3 apps, 100 awake hours, 250 MB, 1 GB egress, 2-minute hibernation, flush-only durability) has no enforcement in code. One piece is built and needs no decision (the flush-only replication class, `feat/carloku-flush-only-class-20261002`). The rest starts with: |
| + |
| +9. **Who is Free on the day it is switched on.** Proposed: every account with no paid subscription and no house marker, from a date announced beforehand; an account over a Free cap that day keeps what it has and can add nothing until it is under the cap (no app is stopped or archived by the switch); house accounts are unaffected. |
| + |
| +## D. The platform's own replicator (replication-writes meter; unwired) |
| + |
| +Context: `feat/carloku-metered-replicator-20261001` has had twenty builds; Opus accepts, Astra rejects on items that need a design, not another build. These decide what that design must do. |
| + |
| +10. **One tenant's files stopping the whole box.** Today a file that looks like a database and cannot be vouched for refuses replication for every account on the box until an operator accepts it by name. Proposed: keep refusing for a file nobody is billed for (fail closed), but per tenant: refuse that tenant's replication and hold only its days, not the box's. That is a design change and is why it is asked first. |
| +11. **A tenant's database in a directory the platform owns** (for example a tmpfiles-made `root:app` directory inside a unit's state). Bill it to the tenant, refuse it, or let an operator accept it by name? Proposed: let an operator accept it by name; until accepted, refuse. |
| +12. **Another user's directory inside a tenant's tree.** That user could put a sidecar beside the tenant's database and have its writes billed to the tenant. Proposed: refuse it, as a named file already is. |
| +13. **Approval H** (running the replicator as the only writer on a dev box, and which uid owns what) is unchanged and still needed before any of it is wired. |
| + |
| +## What each answer unblocks |
| + |
| +| Answers | Unblocks | |
| +| --- | --- | |
| +| 1 to 4 | stage 2 of the retirement protocol (closing paid and contradicted cases); stage 1 is built without them | |
| +| 5 | the billing page under review; with the 40 billing strings (approval A) | |
| +| 6 to 8 | the reduction design's second draft, then team plans | |
| +| 9 | the Free entitlement, the app cap, per-plan idle, storage refusal | |
| +| 10 to 13 | the replicator's design for the deferred items, then wiring, then the replication-writes meter | |
diff --git a/implementation/carloku-paid-launch/READINESS.md b/implementation/carloku-paid-launch/READINESS.md| index 7237b2da0..4ee8d980b 100644 |
| --- a/implementation/carloku-paid-launch/READINESS.md |
| +++ b/implementation/carloku-paid-launch/READINESS.md |
| @@ -17,7 +17,7 @@ Log files are under `/home/paulca/.local/share/carloku-paid-launch-20260930/logs |
| | `feat/carloku-multi-currency-20261001` | `15041ca2` (round eighteen's bounded findings fixed; the P2 open and routed to the retirement protocol design, revision 3; round eighteen's and both design reviews' reports in the tree) (`68f6ee23`: the seventeenth review's findings: the review filed before the expiry on both paths, the `keep` door's replay, nil billing and purchase check, the rejected listing's account, order and bound, two new tests; reviews ten to seventeen's reports in the tree) | passed on every code tip through `db130cfc` (`gate-currency-db130cfc.txt`, exit 0, three cross builds, clean tree); `68f6ee23`: passed (09:17Z, `gate-currency-68f6ee23.txt`, exit 0, three cross builds, clean tree); the console, plans and billingstripe packages passed in full on the same tree before the commit (console 525 s). `15041ca2`: started 10:2xZ (`gate-currency-15041ca2.txt`); console, plans and billingstripe passed in full on the same tree before the commit (console 534 s). Void or superseded logs, not evidence: `gate-currency-a9304f16.txt`, `gate-currency-f269365a-VOID-dirty-tree.txt`, `gate-currency-25487506-ended-on-28dc2629-reports-added-during-run.txt`, `gate-currency-db130cfc-VOID-dirty-tree-second-run.txt` (started by mistake on staged, uncommitted changes and stopped) | passed on every pushed tip through `68f6ee23`; `15041ca2` pending | Rounds 1 to 9: Opus accept with fixes, Astra reject. Rounds 10 to 13: both accept with fixes (P3s). Round 14: Astra reject on a P2 (a reconciliation paused on the provider read while the operator resolved the review recorded the retired purchase), fixed in `abd1b76e`. Rounds 15 and 16: both accept with fixes, each closing what the previous fix left open in the intent's lifecycle (15: nothing records under an open review, the resolution retires or keeps; 16: `keep` only for an intent whose bound session is complete with a subscription, the outcome written, replay-compared and audited). Each fix has a test that fails without it and a killed mutant (dispositions, one section per round). Round 17 at `db130cfc`: Opus accept with fixes (four P3s on the `keep` door and the rejected listing), Astra reject on a P2: both sites that expire a bound session expired first and filed the review second, so a pass reading the expired session in between, or a crash between the two, retired the intent with no record; fixed in `68f6ee23` by filing first (a two-path race test runs the store's retirement inside the fake's expiry and wants the conflict; it fails with either site's order put back), with the P3s, two new tests (an older resolutions table migrates with `retire`; the listing's 200-row bound, newest first, account on each row) and the comments and design sentence both named. The first form of the listing's account fix looked the account up under open rows and deadlocked the store's one connection in the test; rows are read to the end first. Round 18 at `68f6ee23`: Opus accept with fixes, Astra reject, on the same P2: with the review now filed before the expiry, an operator's `retire` can delete the intent while its bound session is still open and payable (the expiry failed; nothing retries it; the resume path still offers the URL). The supervisor ruled that this is not fixed by moving calls again but by a durable protocol (recorded refusal authoritative; the session's fate proven from provider evidence and recorded; atomic operator completion; a paid session settled by a separate disposition) with one bounded design review before another implementation cycle. Revision 1 of that design (`8c72e88b`) was rejected by Astra (four P2s), and revision 2 (`b4ff6b72`) too (five P2s: the hand-made subscription's own obligations at `retire`; the settlement predicate; observation times against cached answers; which evidence a dispute's resolution makes authoritative; the migration barrier). Revision 3 (`15041ca2`) answers each and narrows what is built first to `retire` and `keep` (a paid or disputed refusal stays held until Paul rules on the settlement predicate and on disputes); its third and last bounded review is running. **The P2 is open in code at `15041ca2`.** The bounded findings of round eighteen are fixed there with tests and four killed mutants (attribution of a retired session's completion beside a replacement; a `keep` decided during the gate answered by the replay comparison; the nil-billing and tie-break tests). The findings since round ten were not minor: each was a real gap in the lifecycle of an intent under review, and the rounds have converged on the operator's door rather than the money path | integrated end to end; not merged; the merge waits on a round ending with both accepting and nothing left to fix, and CI on the tip | |
| | `feat/carloku-billing-layout-20261001` | `c1ae91a0` | (templates only; gated inside the currency branch) | passed | none of its own | merged into the currency branch at `5047494b`; its two-form layout was replaced by one form in `8958392b` | |
| | `feat/carloku-storage-sole-holder-20261001` | `eaf6e63e` | passed on `3af02a65`; `eaf6e63e` is wording and reports | passed | 9 rounds; round 9 both accept (omitted-holder class closed) | needs approval K and a recorded cutover date; not merged | |
| -| `feat/carloku-metered-replicator-20261001` | `c9ec11eb` (twentieth build: a tree claim refuses a tenant's file in a platform directory too, the fixture's guard reachable, the no-recorder refusal quoted; after `53e3dcd8`, the nineteenth build: a tenant's file in a platform directory refused in both layouts, the long-target fixture within the pathname budget and under XFS's link limit, refusal messages quoted; after `6249af63`, the eighteenth; reviews eight to eighteen's reports in the tree) | passed on every code tip through `f306222c`, then **failed on `bffc76b5`** (`gate-replicator-bffc76b5.txt`, exit 2: the seventeenth build's long-target fixture held only under a temp root of about 34 bytes or more; the gate's `/var/tmp/ck` is shorter), passed on `6249af63` (09:04Z, `gate-replicator-6249af63.txt`, exit 0, three cross builds, clean tree); `53e3dcd8`: passed (09:38Z, `gate-replicator-53e3dcd8.txt`, exit 0, three cross builds); `c9ec11eb`: started 10:0xZ (`gate-replicator-c9ec11eb.txt`). Void: `gate-replicator-e8211fc6-VOID-stopped-for-astra17-followup.txt` (stopped so Astra's report could be answered in the same build) | passed through `f306222c`; **failed on `bffc76b5`** (the same fixture); passed on `6249af63` and `53e3dcd8`; `c9ec11eb` pending | 4 to 7: each Opus accept with fixes, Astra reject; 8: both reject on one P1 the eighth build made (fixed in the ninth); 9 to 15: Opus accept with fixes, Astra reject, each round finding the previous build's own addition wanting (15 at `03b19014`: the fifteenth build joined a relative link target and so cleaned a `..` the kernel resolves physically, a regression that let a link to a directory outside the tree pass in silence; fixed in the sixteenth build by concatenating uncleaned, with the fixture both asked for); 16 at `f306222c`: Opus accept with fixes, Astra reject; both found the fifteenth's regression closed and one bound Astra named (the concatenated spelling could outgrow PATH_MAX), fixed in the seventeenth build `bffc76b5` with `fstatat` against the link's directory. 17 at `bffc76b5`: Opus accept with fixes, Astra reject; both named the same two new defects in that fix: the directory was opened by path with Go's default flags (a FIFO a tenant swaps in blocks the watch and Close; a device would have its driver's open run) and the long-target fixture failed under any short temp root (which is what failed the gate and CI). The eighteenth build opens the directory with `O_DIRECTORY|O_NONBLOCK|O_NOCTTY|O_CLOEXEC` (anything but a directory refused by the open itself; three mutants killed: default flags, `O_DIRECTORY` alone dropped, the fixed fixture size under `/var/tmp/ck`), sizes the fixture from the temp root, compares `render` across sections, and corrects the comments and names Astra listed; the false "package tests pass under /tmp" claim of the seventeenth build is marked false in its dispositions. 18 at `6249af63`: Opus accept (three P3s: the fixture's 3 KB link target, which XFS refuses; a tenant's file in a platform directory accepted under the tenant's tree and refused under the platform's; wording), Astra reject on the deep items (and the fixture's fixed depth). The nineteenth build `53e3dcd8` answers them (two mutants killed). 19 at `53e3dcd8`: Opus accept (two P3s), Astra reject on the deep items; the twentieth build `c9ec11eb` makes the bounded changes (one mutant killed) and its dispositions list the deferred items separately, each as blocking wiring and needing a design or a decision; 20 running. Each build's dispositions section lists its killed mutants. The deep items stay open and are listed there: litestream's own opens by path (every reopen), protected endpoints under tenant-replaceable ancestry, a delayed admitted request past the margin, requests across a crash or restart, the header open through a swapped ancestor (a walk by directory descriptor, required before wiring), a tenant sharing the platform's uid, root-run units and a route naming another user's coherent tree (approval H), hibernating aliases and claims on skipped files, required coverage that can vanish without an entry, whether one tenant's unaccepted links refuse the whole box (a decision before wiring), one tenant's deletion holding every account's days once (a stated cost). None of these is minor: the branch cannot be wired until they are closed or decided | not merged; unwired side work gated on approval H | |
| +| `feat/carloku-metered-replicator-20261001` | `e1280811` (review twenty answered with comments, a fixture and dispositions only; the code is the twentieth build `c9ec11eb`: a tree claim refuses a tenant's file in a platform directory too, the fixture's guard reachable, the no-recorder refusal quoted; after `53e3dcd8`, the nineteenth build: a tenant's file in a platform directory refused in both layouts, the long-target fixture within the pathname budget and under XFS's link limit, refusal messages quoted; after `6249af63`, the eighteenth; reviews eight to eighteen's reports in the tree) | passed on every code tip through `f306222c`, then **failed on `bffc76b5`** (`gate-replicator-bffc76b5.txt`, exit 2: the seventeenth build's long-target fixture held only under a temp root of about 34 bytes or more; the gate's `/var/tmp/ck` is shorter), passed on `6249af63` (09:04Z, `gate-replicator-6249af63.txt`, exit 0, three cross builds, clean tree); `53e3dcd8`: passed (09:38Z, `gate-replicator-53e3dcd8.txt`, exit 0, three cross builds); `c9ec11eb`: passed (09:52Z, `gate-replicator-c9ec11eb.txt`, exit 0, three cross builds); `e1280811`: started 11:03 Dublin (`gate-replicator-e1280811.txt`). Void: `gate-replicator-e8211fc6-VOID-stopped-for-astra17-followup.txt` (stopped so Astra's report could be answered in the same build) | passed through `f306222c`; **failed on `bffc76b5`** (the same fixture); passed on `6249af63`, `53e3dcd8` and `c9ec11eb`; `e1280811` pending | 4 to 7: each Opus accept with fixes, Astra reject; 8: both reject on one P1 the eighth build made (fixed in the ninth); 9 to 15: Opus accept with fixes, Astra reject, each round finding the previous build's own addition wanting (15 at `03b19014`: the fifteenth build joined a relative link target and so cleaned a `..` the kernel resolves physically, a regression that let a link to a directory outside the tree pass in silence; fixed in the sixteenth build by concatenating uncleaned, with the fixture both asked for); 16 at `f306222c`: Opus accept with fixes, Astra reject; both found the fifteenth's regression closed and one bound Astra named (the concatenated spelling could outgrow PATH_MAX), fixed in the seventeenth build `bffc76b5` with `fstatat` against the link's directory. 17 at `bffc76b5`: Opus accept with fixes, Astra reject; both named the same two new defects in that fix: the directory was opened by path with Go's default flags (a FIFO a tenant swaps in blocks the watch and Close; a device would have its driver's open run) and the long-target fixture failed under any short temp root (which is what failed the gate and CI). The eighteenth build opens the directory with `O_DIRECTORY|O_NONBLOCK|O_NOCTTY|O_CLOEXEC` (anything but a directory refused by the open itself; three mutants killed: default flags, `O_DIRECTORY` alone dropped, the fixed fixture size under `/var/tmp/ck`), sizes the fixture from the temp root, compares `render` across sections, and corrects the comments and names Astra listed; the false "package tests pass under /tmp" claim of the seventeenth build is marked false in its dispositions. 18 at `6249af63`: Opus accept (three P3s: the fixture's 3 KB link target, which XFS refuses; a tenant's file in a platform directory accepted under the tenant's tree and refused under the platform's; wording), Astra reject on the deep items (and the fixture's fixed depth). The nineteenth build `53e3dcd8` answers them (two mutants killed). 19 at `53e3dcd8`: Opus accept (two P3s), Astra reject on the deep items; the twentieth build `c9ec11eb` makes the bounded changes (one mutant killed) and its dispositions list the deferred items separately, each as blocking wiring and needing a design or a decision. 20 at `c9ec11eb`: Opus accept with fixes, Astra reject on the deep items; `e1280811` changes no behaviour and is not sent for another round; the two refusals Opus named as decisions are in `DECISIONS-FOR-PAUL.md` (11, 12). Each build's dispositions section lists its killed mutants. The deep items stay open and are listed there: litestream's own opens by path (every reopen), protected endpoints under tenant-replaceable ancestry, a delayed admitted request past the margin, requests across a crash or restart, the header open through a swapped ancestor (a walk by directory descriptor, required before wiring), a tenant sharing the platform's uid, root-run units and a route naming another user's coherent tree (approval H), hibernating aliases and claims on skipped files, required coverage that can vanish without an entry, whether one tenant's unaccepted links refuse the whole box (a decision before wiring), one tenant's deletion holding every account's days once (a stated cost). None of these is minor: the branch cannot be wired until they are closed or decided | not merged; unwired side work gated on approval H | |
| | `fix/carloku-observe-routes-cleanup-20261001` | `023e106c` | passed on `51587e00`; `023e106c` changes a test and two docs | passed | both accept at `51587e00` | merged into the launch branch at `47c97fa6` | |
| | `feat/carloku-paid-launch-20260916` (launch) | this commit: documents only on top of `3d47602b`; last code change the merge of the observe-routes fix (`47c97fa6`) | passed 03:06Z on `b953fae4` (`gate-launch-b953fae4.txt`, exit 0, three cross builds); every commit since is documents | passed on `3d47602b` | 17 rounds, no whole-branch pass | the integration target; first accepted side branch merged | |
| | `feat/carloku-quantity-reduction-20261002` | `978ddc8a` (design only, off `68f6ee23`) | n/a (no code) | n/a | Astra's design review rejected revision 1 on four P1s (a request can cross the renewal and its confirmation proves nothing about the invoiced quantity; a future-dated assignment blocks every change before the renewal; a missed window postpones the reduction a year in silence; fence-only enablement leaves no path to restore returning seats). Revision 2 waits on three decisions that are Paul's (`2026-10-02-quantity-reduction-at-renewal-design.md`, last section) | OUTSTANDING 14 stays absent in code | |