amadan
Readiness and handoff: the design branch's fourth code review answered with design revision 11 and the inventory's first slice on retained descriptors (ccfd331a), fifth review running
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2 files changed,
+3
−3
.claude/HANDOFF.md+2 −2implementation/carloku-paid-launch/READINESS.md+1 −1
CI passed — run details
diff --git a/.claude/HANDOFF.md b/.claude/HANDOFF.md| index ee5c54ca0..60e31ea58 100644 |
| --- a/.claude/HANDOFF.md |
| +++ b/.claude/HANDOFF.md |
| @@ -7,7 +7,7 @@ |
| Get Carloku's paid plans live with Stripe Tax and the complete metered model; have the pricing page and signup flow reviewable in the morning. |
| **STATUS:** |
| -Written 09:07 Dublin on 2026-10-03 (resumed 21:40 on 2026-10-02 after a provider limit; nothing was lost), during the second overnight run (brief: "continue overnight until we're ready to enable payments"; ready means reviewed, tested, integrated code and a scoped enablement plan, not payments switched on). Billing is OFF everywhere. No live Stripe write, no AWS change, no charge, no merge to main. **At 01:55 the currency branch (the price book and the retirement protocol) merged into this branch at `d64180a7`, after its twenty-sixth and twenty-seventh reviews ended with both reviewers accepting; the AWS principal report merged at `c4ee8807` after its seventh; the operator CLI at `1cd5a0d8`; per-line tax codes (OUTSTANDING item 17, built behind its hold, decision 16 untouched) at `e2adf26f` after three code reviews.** The merged tip `7399d9fe` passed its gate (exit 0, three cross builds) and CI. Every payment anyone can see is a labelled simulation. |
| +Written 09:44 Dublin on 2026-10-03 (resumed 21:40 on 2026-10-02 after a provider limit; nothing was lost), during the second overnight run (brief: "continue overnight until we're ready to enable payments"; ready means reviewed, tested, integrated code and a scoped enablement plan, not payments switched on). Billing is OFF everywhere. No live Stripe write, no AWS change, no charge, no merge to main. **At 01:55 the currency branch (the price book and the retirement protocol) merged into this branch at `d64180a7`, after its twenty-sixth and twenty-seventh reviews ended with both reviewers accepting; the AWS principal report merged at `c4ee8807` after its seventh; the operator CLI at `1cd5a0d8`; per-line tax codes (OUTSTANDING item 17, built behind its hold, decision 16 untouched) at `e2adf26f` after three code reviews.** The merged tip `7399d9fe` passed its gate (exit 0, three cross builds) and CI. Every payment anyone can see is a labelled simulation. |
| Review servers, all answering 200: pricing page `http://100.119.180.57:38009` (static, rebuilt from site `2fc6388`), signup and billing demo `http://100.119.180.57:41881` (**rebuilt at 02:10 from the integrated launch branch, `404e699f`, whose code is `7399d9fe`: the currency branch and the AWS principal report merged, gate and CI passed**; it runs until about 17:10 Dublin, restart recipe in `layout-review/STATE-demo.txt`; a labelled simulation, not Stripe proof: Keymail and Stripe simulated on the same listener; the `68f6ee23` build served until 02:06), console billing copy `http://100.119.180.57:45033` if still up. |
| @@ -45,6 +45,6 @@ Branches (all on the forge, none merged; the local gate is not CI): |
| - Then, each on its own branch: quantity reduction at renewal, the evidence door for a box's first minutes, the AWS principal inventory and the bucket ownership attestation door, Free-tier enforcement, dormancy and pool accounting. |
| **SESSION:** |
| -Running at 09:07: the fourth code review (Opus and Astra) of the design branch at `7ba5fc72`, which answers the third (both accepted with fixes, no P1; **design revision 10**: the lower bound's threshold is the earlier of the proof and the clean look, empty terminals excluded, every look reads the witness and rechecks every chain first; `Result.Within` for sibling tenants under one pin; one row per token across a crash). The step-1 task plan is on the branch. The third review was of `0a527924`, which answered the second (both accepted with fixes, no P1; Opus found the design's lower bound missing an in-flight request across a change that settled clean before the discovery, which is **design revision 9**: the bound also takes the admission instant of every admission settled at or after the last clean look's start; Astra found a landed ambiguous commit invisible to the barrier until its read-back). The second review was of `50a6f056`, which answered the first (both reviewers converged: a tenant boundary, retained facts in Recheck, slash as a pin, descriptor accounting; the model's boundaries and barrier). The first review was of `5bfcc7ba`: plan step 0's admission model (`internal/ops/admissionmodel`, `f331b55a`) and step 1's `internal/authority` (`5bfcc7ba`), both committed and pushed, tests and cross-builds passing, imported by nothing. Done at about 08:05: **the replicator's authority design is accepted** (`design-replicator-pinned-root` `8a877936`: review 7 accepted revision 7 with fixes, no P1; review 8 confirmed revision 8 with no finding). Running: plan step 0's admission model (`internal/ops/admissionmodel`: the transition table, both holds, the latch and its replay, backfill, reach, acknowledgement, helper death, the fence and recovery, as code; the design's named sequences as tests; randomised schedules under a barrier invariant, a hazard invariant against a truth kept apart from the ledger, a reach check and a liveness check at quiescence), its seed sweep and mutants. Next on that branch: `internal/authority` (Part A), then required coverage; the VFS spike needs a box with amd64 and arm64. Six revisions were rejected before the seventh, each answered; the seventh reconciles a failed discovery's replay with the settlements that landed meanwhile, registers the recorder at Start, completes the abort edges, and gives the lineage record a crash-durable write protocol; the sixth separated ownership proof from request admission, orders the admission against discovery under the fleet's mutex, backfills a new fleet's owners with its ancestry's intervals, makes the transition table authoritative, and names the sleeping binding's invalidators; the fifth gave the helper its own per-inode lock bookkeeping, shares the producer fence with every helper, settles a dead helper's admissions in the running agent, gates closure on committed discoveries, computes reach over the unacknowledged ancestry with root-first acknowledgement, binds a sleeping route to its directory's incarnation, and keeps lineage to the filesystem incarnation). Done: the gate and CI on this branch's tip `8777d28e`. Next: revise the design, then its parameter-independent tasks on that branch. Done tonight: the currency branch (`d64180a7`), the AWS principal report (`c4ee8807`), the operator CLI (`1cd5a0d8`) and per-line tax codes (`e2adf26f`) merged, each after its reviews, its gate alone and CI; `29ea6676` gate and CI passed. Next: the build list below; the approvals and decisions 1 to 16 are Paul's. Next: item 17's design (per-line tax codes; the mechanics that need no decision) on its own branch with an Astra design review; the rest of the build list. Done: the gates on `2b0abef1` (00:51Z), `0491ff76` (00:46Z), `9b872e38` (00:42Z), `4a1a92d9` (00:36Z). Then: the build list below, each on its own branch. Full package runs need `GOFLAGS=-buildvcs=false`, as the gate sets it. Detached `setsid` processes. A gate must be started with `logs/run-gate.sh`, which uses the default build cache; full runs take the gate's `-timeout 30m`. |
| +Running at 09:44: the fifth code review (Opus and Astra) of the design branch at `ccfd331a`: `a26cba8e` answers the fourth review (both accepted with fixes, no P1: the design's historical term had excluded `unrecorded`, a settlement that did send, and the model's cutoff drifted with the running minimum; **design revision 11** fixes the text, the model takes a fixed bound) and `ccfd331a` is plan Task 2's first slice (the fleet's pins, the platform-link predicate on descriptors, `strictTreeDBs` on Dirs with every link class named; the owners tests pass with three expectations moved to the design's classes). The fourth review was of `7ba5fc72`, which answered the third (both accepted with fixes, no P1; **design revision 10**: the lower bound's threshold is the earlier of the proof and the clean look, empty terminals excluded, every look reads the witness and rechecks every chain first; `Result.Within` for sibling tenants under one pin; one row per token across a crash). The step-1 task plan is on the branch. The third review was of `0a527924`, which answered the second (both accepted with fixes, no P1; Opus found the design's lower bound missing an in-flight request across a change that settled clean before the discovery, which is **design revision 9**: the bound also takes the admission instant of every admission settled at or after the last clean look's start; Astra found a landed ambiguous commit invisible to the barrier until its read-back). The second review was of `50a6f056`, which answered the first (both reviewers converged: a tenant boundary, retained facts in Recheck, slash as a pin, descriptor accounting; the model's boundaries and barrier). The first review was of `5bfcc7ba`: plan step 0's admission model (`internal/ops/admissionmodel`, `f331b55a`) and step 1's `internal/authority` (`5bfcc7ba`), both committed and pushed, tests and cross-builds passing, imported by nothing. Done at about 08:05: **the replicator's authority design is accepted** (`design-replicator-pinned-root` `8a877936`: review 7 accepted revision 7 with fixes, no P1; review 8 confirmed revision 8 with no finding). Running: plan step 0's admission model (`internal/ops/admissionmodel`: the transition table, both holds, the latch and its replay, backfill, reach, acknowledgement, helper death, the fence and recovery, as code; the design's named sequences as tests; randomised schedules under a barrier invariant, a hazard invariant against a truth kept apart from the ledger, a reach check and a liveness check at quiescence), its seed sweep and mutants. Next on that branch: `internal/authority` (Part A), then required coverage; the VFS spike needs a box with amd64 and arm64. Six revisions were rejected before the seventh, each answered; the seventh reconciles a failed discovery's replay with the settlements that landed meanwhile, registers the recorder at Start, completes the abort edges, and gives the lineage record a crash-durable write protocol; the sixth separated ownership proof from request admission, orders the admission against discovery under the fleet's mutex, backfills a new fleet's owners with its ancestry's intervals, makes the transition table authoritative, and names the sleeping binding's invalidators; the fifth gave the helper its own per-inode lock bookkeeping, shares the producer fence with every helper, settles a dead helper's admissions in the running agent, gates closure on committed discoveries, computes reach over the unacknowledged ancestry with root-first acknowledgement, binds a sleeping route to its directory's incarnation, and keeps lineage to the filesystem incarnation). Done: the gate and CI on this branch's tip `8777d28e`. Next: revise the design, then its parameter-independent tasks on that branch. Done tonight: the currency branch (`d64180a7`), the AWS principal report (`c4ee8807`), the operator CLI (`1cd5a0d8`) and per-line tax codes (`e2adf26f`) merged, each after its reviews, its gate alone and CI; `29ea6676` gate and CI passed. Next: the build list below; the approvals and decisions 1 to 16 are Paul's. Next: item 17's design (per-line tax codes; the mechanics that need no decision) on its own branch with an Astra design review; the rest of the build list. Done: the gates on `2b0abef1` (00:51Z), `0491ff76` (00:46Z), `9b872e38` (00:42Z), `4a1a92d9` (00:36Z). Then: the build list below, each on its own branch. Full package runs need `GOFLAGS=-buildvcs=false`, as the gate sets it. Detached `setsid` processes. A gate must be started with `logs/run-gate.sh`, which uses the default build cache; full runs take the gate's `-timeout 30m`. |
| Scratch on the box: `~/.cache/tmp/claude-1001/{currency-wt,replicator-wt,fencing-wt,evidence-wt,opcli-wt,inventory-wt,flush-wt,reduction-wt}` (git worktrees), the demo binaries, `/var/tmp/ck`, `~/.cache/carloku-gate`. The void gate logs are named `*VOID*`. |
diff --git a/implementation/carloku-paid-launch/READINESS.md b/implementation/carloku-paid-launch/READINESS.md| index 5118f1547..afdf658f5 100644 |
| --- a/implementation/carloku-paid-launch/READINESS.md |
| +++ b/implementation/carloku-paid-launch/READINESS.md |
| @@ -25,7 +25,7 @@ Log files are under `/home/paulca/.local/share/carloku-paid-launch-20260930/logs |
| | `feat/carloku-billing-operator-cli-20261002` | `fc7daebd` (a merge of the currency tip `2b0abef1`); before it `6d4c2912` (the fourth review's P3s answered: `account_deleted` always on the wire and printed; the console's own 5xx on a write; the moved console after the offer; the help's two facts); before it `4e9cac43` (`f9683fbe`: the third review's twelve P3s answered: a write names its console or is refused; refusals from in front of the console; the moved console through the interactive offer; the whole command tested through `runBillingWith`; then the currency tip `e152df30` merged in); before it `31731fdd` (Astra's second review answered in `f155e543`: ambiguous flag values refused, the keep wording, strict listing envelopes, write advice that fits the write, the console's note predicate, `billingRun` tested; then the currency tip `05ccec07` merged in); before it `51ef27ac` (the first review answered in `57f70c16`, then the currency tip `b260ac8e` merged in): `carlos billing reviews\|resolve\|rejected\|house`, a client for the four operator doors | `fc7daebd`: **passed** (01:04Z, `gate-opcli-fc7daebd.txt`, exit 0, three cross builds, alone). `40ea61b1`: **passed** (00:08Z, `gate-opcli-40ea61b1.txt`, exit 0, three cross builds, alone). `6d4c2912` was not gated on its own (superseded by the merge). `4e9cac43`: **passed** (23:09Z, `gate-opcli-4e9cac43.txt`, exit 0, three cross builds, alone). `51ef27ac`: **passed** (21:29Z, exit 0, three cross builds); `31731fdd`: **passed** (22:16Z, `gate-opcli-31731fdd.txt`, exit 0, three cross builds). `0f507bff` **failed** (exit 2, `gate-opcli-0f507bff.txt`): one test, the docs gate, which requires a `carlos billing` heading in the public CLI reference. `51ef27ac`: started 21:18Z, run alone (`gate-opcli-51ef27ac.txt`) | passed on `6d4c2912`, `40ea61b1` and `fc7daebd`; `0f507bff` failed (the docs gate) | 4 at `4e9cac43`: **both accept with fixes, all P3**, answered in `6d4c2912` (CI passed); no fifth review unless the client changes. 3 at `31731fdd`: **both accept with fixes** (six P3 each), answered in `f9683fbe`; a fourth reading not started. 2 at `51ef27ac`: Astra accept with fixes (three P2, six P3), answered in `f155e543`; Opus's second reading and Astra's third running on `31731fdd`. 1 at `0f507bff`: Opus accept with fixes (P1 the docs gate, four P2), Astra reject (five P2). Answered in `57f70c16`: arguments are one unambiguous request or refused before anything is sent; writes are reported only on the door's acknowledgement and name the console; one wire-contract file both sides' tests read. Second review not started | **merged into this branch at `1cd5a0d8` (02:12, a merge commit) after the gate and CI on `fc7daebd`; its `docs/site/cli.md` section is unreviewed public copy and must be read before anything publishes the site's CLI page (merging publishes nothing)**; before: not merged (it is built on the currency branch, which merges first). **Its `docs/site/cli.md` section is new public copy and is unreviewed**: it does not merge before Paul reads it |
| | `feat/carloku-principal-inventory-20261002` | `4a1a92d9` (the sixth review answered: an S3 action on an Object Lambda resource is a possible reach, the "possibly" label and the legend extended, the mutation paragraph as the logs have it); before it `36e5ff2d` (the fifth review answered: the possible reach decided by one text test on the pattern and its padded form, decision 14 names what the host role can mint through a store user, the legend's other spellings, a nil page an error); before it `403384c2` (the fourth review answered: a resource pattern read as text and, when it is an incomplete ARN, as padded fields too, a reach under either reported; nothing S3 names excluded, Storage Lens included; an empty condition, an operator with no key and an empty value list are errors; the `AssumableBy` legend and the "does not read" lists reworded for same-account trust, control of compute and IAM writes; counts tagged; the CUR plan and OUTSTANDING item 2 no longer name an inventory in the provisioner as the mechanism); before it `434cdf48` (the third review answered: every S3 resource that is not the bucket a possible reach; incomplete ARNs as IAM reads them; version ids unique; condition values checked; a group's possible reach carried to its members; the label renamed `named_by_deployment`; the attestation plan marked superseded in part); before it `0e1bc298` (the second review answered: a repeated JSON member is an error; a managed policy's default-version id must agree with the version marked default; every trust-policy statement read in full; a grant on an access point, a multi-region access point or an Object Lambda access point reported as a possible reach, marked; the two proposals stated with what they lack); before it `199a9736`: **a report for a person** (`PrincipalReport.BucketPrincipals`: who reaches a name, through which policies, and who each role's trust policy lets assume it), **not a `GranteeProber`** and a test says so; before it `d61f4f27`, which offered itself as the ledger's proof | `4a1a92d9`: **passed** (00:36Z, `gate-inventory-4a1a92d9.txt`, exit 0, three cross builds, alone). `36e5ff2d`: **passed** (00:26Z, alone). `403384c2`: **passed** (00:14Z, alone). `434cdf48`: **passed** (23:44Z, alone). Mutants in git-less tree copies with the killing tests logged from round five on: `inventory-mutants-round{1..6}.txt` | passed on `0e1bc298`, `434cdf48`, `403384c2`, `36e5ff2d` and `4a1a92d9` | **7 at `4a1a92d9`: both accept** (Opus: every sixth-round finding closed, two P3 bookkeeping items, neither required; Astra: accept, no new finding). 6 at `36e5ff2d`: Opus accept (three P3), Astra accept with fixes (one P2: Object Lambda's management actions in the s3 namespace on an Object Lambda resource), answered in `4a1a92d9`. 5 at `403384c2`: both accept with fixes (one P2 each: the possible-reach rule's text reading skipped for a complete pattern with a question mark across a colon; decision 14 understating the host role), answered in `36e5ff2d`. 5 at `403384c2`: running since 00:57 (Opus's third reading and Astra). 4 at `434cdf48`: Opus accept with fixes (two P2 required: an incomplete ARN read only as padded fields dropped grants the text reading reported; the legend wrong in the under-reporting direction), Astra reject (three P2: the Storage Lens exclusion dropped a write path; empty condition shapes read as a report; the legend), all answered in `403384c2`. 3 at `0e1bc298`: Opus accept with fixes (two P2 required: other S3 resource types dropped; the attestation plan still claiming an IAM read proves completeness), Astra reject (four P2, two P3). Answered; gate not yet run; never run against AWS. 1 at `d61f4f27`: Astra reject (three P1). Answered in `199a9736` by making it a report. 2 at `199a9736`: Astra reject (six P2: access-point grants under-reported; duplicate JSON members; default-version metadata not checked; trust-policy grammar; the two proposals overstated). Opus not yet read. Answered in `0e1bc298`; the third review (Astra) and Opus's first reading running on it | **merged into this branch at `c4ee8807` (01:40, a merge commit) after round seven's two acceptances, the gate and CI on `4a1a92d9`; the gate on the merged tip `c4ee8807` is queued behind the currency gate**; a report for a person, unwired; what a completeness claim needs is now decision 14 (an enforced rule; minted bucket names); the report can be run by an operator with their own credentials; never run against AWS |
| | `design-per-line-tax-codes` | `12590e3a` (per-line tax codes for a month in which the plan changed, OUTSTANDING item 17: the mechanics either answer to decision 16 needs, built behind the hold; design revision 6 after three Astra design rounds; Tasks 0 to 4, the activation glue uncalled, three mutant batches) | `12590e3a`: **passed** (05:08Z, `gate-taxcodes-12590e3a.txt`, exit 0, three cross builds, alone); also `6488c198`, `8715e4cd`, `61313bec`, each alone; each commit had the full console, plans and billingstripe run | passed on `61313bec`, `8715e4cd`, `6488c198` and `12590e3a` | 1 at `61313bec`: both accept with fixes (Opus one P2, Astra three P2); 2 at `8715e4cd`: both accept with fixes (P3s only); 3 at `6488c198`, confirming: both accept with fixes (P3s only, no further round required), the fixes in `12590e3a` | **merged into this branch at `e2adf26f` (06:10, a merge commit) with Task 5's records; a two-code month still holds; decision 16 and 16a to 16d are Paul's; every one-code month is byte-identical (pinned); one behaviour changes for every month: a resumed finalize validates the draft it read** | |
| -| `design-replicator-pinned-root` | `7ba5fc72` (the design at **revision 10**: revision 8 `8a877936` was accepted; revisions 9 and 10 correct the uncertainty's lower bound after the admission model's code reviews found an in-flight request across a change, settled clean before the discovery, outside it, and then a witness change known only to be after the proof; the step-1 task plan `docs/superpowers/plans/2026-10-03-replicator-authority-plan.md`; plan step 0's admission model and step 1's `internal/authority` on it, reviews one and two answered; nothing wired, imported by nothing in `internal/ops`) (revision 8: the replicator's authority, answering review twenty's eleven deferred findings: retained descriptors with a stack, anchors and named-edge rechecks; the litestream fork and a SQLite VFS owning every file method in a helper process per fleet; a durable admission before every send, settled by the last participant, with a temporary barrier, a permanent uncertainty linked at construction and inherited transitively, a pending-discovery latch, and a producer fence for recovery; owner holds as a specified ledger change with box-wide the default; claims by owner and identity with one replication authority and a durable lineage record; a uid lifecycle and a sleeping route's binding from the unit observer; decisions 10-13 and approval H kept as parameters; off the replicator branch at `e1280811`) | not applicable (a document) | not applicable | design reviews 1 to 6 (Astra): reject (five, three, five, four, two, one P1), each answered; **review 7 (Astra): accept with fixes, no P1** (one P2: a cancellation was not conclusive while the admission writer could still commit, and the pending set had three definitions; one P3: the restore wording), both applied in revision 8 (a cancellation waits for the writer to return, a read-back only after its handle is closed, one pending-set contract, the restore sentence limited to what the fork's verification chooses); **review 8 (Astra): accept, no finding** (both fixes meet the smallest acceptable fix; the design stands at `8a877936`); revision 7 reconciles a failed discovery's replay with the settlements that landed meanwhile, registers the recorder at Start and closes a never-started one as unrecorded after proven helper exit, completes the transition table's abort edges and pending-set cleanup, and gives the lineage record its own crash-durable write protocol; revision 6 separates ownership proof from request admission, gives the admission one ordering point against discovery under the fleet's mutex, backfills a new fleet's owners with its ancestry's intervals, makes the transition table authoritative with a dead helper's transport lost and its recorder never synthesised, and names the sleeping binding's invalidators; plan step 0's admission model committed (`f331b55a`: thirteen named sequences, 30000 random schedules under barrier, hazard, reach and liveness invariants, fourteen mutants killed, one equivalent; the spike note records it); plan step 1's `internal/authority` committed (`5bfcc7ba`: Dir, Root, Walk, the Part A tests; cross-builds for darwin and windows; two findings while building: Linux answers ENOTDIR for a link under O_DIRECTORY, so a link is named by one look; the walk's grammar is refused before any syscall); **code review 1 (Opus: accept with fixes, no P1; Astra: reject, five P2 two P3, the same points) answered at `50a6f056`** (Confine, Equal in Recheck, slash as a pin, descriptor accounting, the model's boundaries as separate actions and the ancestry barrier; `DISPOSITIONS-replicator-pinned-root.md` names each); **code review 2 (Opus and Astra: both accept with fixes, no P1) answered at `0a527924`**, with design revision 9's bound; **code review 3 (both accept with fixes, no P1) answered at `7ba5fc72`** with revision 10; **code review 4 running since 09:07** | nothing wired; next the inventory on `internal/authority` (the rest of step 1), then required coverage (Part D); the VFS spike needs a box with both architectures | |
| +| `design-replicator-pinned-root` | `ccfd331a` (the design at **revision 11**; plan Task 2's first slice, the inventory's tree walk on retained descriptors, with the pathname link look deleted and every link class named; revision 8 `8a877936` was accepted; revisions 9 and 10 correct the uncertainty's lower bound after the admission model's code reviews found an in-flight request across a change, settled clean before the discovery, outside it, and then a witness change known only to be after the proof; the step-1 task plan `docs/superpowers/plans/2026-10-03-replicator-authority-plan.md`; plan step 0's admission model and step 1's `internal/authority` on it, reviews one and two answered; nothing wired, imported by nothing in `internal/ops`) (revision 8: the replicator's authority, answering review twenty's eleven deferred findings: retained descriptors with a stack, anchors and named-edge rechecks; the litestream fork and a SQLite VFS owning every file method in a helper process per fleet; a durable admission before every send, settled by the last participant, with a temporary barrier, a permanent uncertainty linked at construction and inherited transitively, a pending-discovery latch, and a producer fence for recovery; owner holds as a specified ledger change with box-wide the default; claims by owner and identity with one replication authority and a durable lineage record; a uid lifecycle and a sleeping route's binding from the unit observer; decisions 10-13 and approval H kept as parameters; off the replicator branch at `e1280811`) | not applicable (a document) | not applicable | design reviews 1 to 6 (Astra): reject (five, three, five, four, two, one P1), each answered; **review 7 (Astra): accept with fixes, no P1** (one P2: a cancellation was not conclusive while the admission writer could still commit, and the pending set had three definitions; one P3: the restore wording), both applied in revision 8 (a cancellation waits for the writer to return, a read-back only after its handle is closed, one pending-set contract, the restore sentence limited to what the fork's verification chooses); **review 8 (Astra): accept, no finding** (both fixes meet the smallest acceptable fix; the design stands at `8a877936`); revision 7 reconciles a failed discovery's replay with the settlements that landed meanwhile, registers the recorder at Start and closes a never-started one as unrecorded after proven helper exit, completes the transition table's abort edges and pending-set cleanup, and gives the lineage record its own crash-durable write protocol; revision 6 separates ownership proof from request admission, gives the admission one ordering point against discovery under the fleet's mutex, backfills a new fleet's owners with its ancestry's intervals, makes the transition table authoritative with a dead helper's transport lost and its recorder never synthesised, and names the sleeping binding's invalidators; plan step 0's admission model committed (`f331b55a`: thirteen named sequences, 30000 random schedules under barrier, hazard, reach and liveness invariants, fourteen mutants killed, one equivalent; the spike note records it); plan step 1's `internal/authority` committed (`5bfcc7ba`: Dir, Root, Walk, the Part A tests; cross-builds for darwin and windows; two findings while building: Linux answers ENOTDIR for a link under O_DIRECTORY, so a link is named by one look; the walk's grammar is refused before any syscall); **code review 1 (Opus: accept with fixes, no P1; Astra: reject, five P2 two P3, the same points) answered at `50a6f056`** (Confine, Equal in Recheck, slash as a pin, descriptor accounting, the model's boundaries as separate actions and the ancestry barrier; `DISPOSITIONS-replicator-pinned-root.md` names each); **code review 2 (Opus and Astra: both accept with fixes, no P1) answered at `0a527924`**, with design revision 9's bound; **code review 3 (both accept with fixes, no P1) answered at `7ba5fc72`** with revision 10; **code review 4 (both accept with fixes, no P1) answered at `a26cba8e`** with revision 11 (the historical term counts every settlement whose transport sent; the cutoff is the fixed bound); **code review 5 of `ccfd331a` (revision 11 and the inventory slice) running since 09:44** | nothing wired; next the inventory on `internal/authority` (the rest of step 1), then required coverage (Part D); the VFS spike needs a box with both architectures | |
| | site `feat/paid-pricing-20260916` (GitHub) | `01b62f7` (the money renderer a module the test calls); before it `4026231` (`build` and `check` render from the export before the draft check, so a stale page cannot be published past a newer export; a floor that is not whole cents is refused by the renderer rather than shown as `$1.20.5`; after `c12318d`: `bands.p3` replaced by the approved explanation, every priced slot, inclusion band and figure token pinned exactly) | `node --test test/*.test.mjs`: 21 pass (09:1xZ) | n/a | read-only by the currency reviews (section K); rounds four, five, ten, twelve to seventeen's site findings fixed | preview served at `http://100.119.180.57:38009` from the tree (rebuilt with the `bands.p3` change) | |
| ## The flow, behaviour the tests establish (2026-10-02) |