amadan
Readiness and handoff at 06:25: round ten accepted with fixes, the fixes in and round eleven running; the replicator's ninth build gated and under review
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
3 files changed,
+28
−25
.claude/HANDOFF.md+8 −8implementation/carloku-paid-launch/ENABLEMENT.md+5 −4implementation/carloku-paid-launch/READINESS.md+15 −13
CI passed — run details
diff --git a/.claude/HANDOFF.md b/.claude/HANDOFF.md| index 9d9cd9239..27d2b0745 100644 |
| --- a/.claude/HANDOFF.md |
| +++ b/.claude/HANDOFF.md |
| @@ -7,37 +7,37 @@ |
| Get Carloku's paid plans live with Stripe Tax and the complete metered model; have the pricing page and signup flow reviewable in the morning. |
| **STATUS:** |
| -Written 05:55 Dublin on 2026-10-02, during the second overnight run (brief: "continue overnight until we're ready to enable payments"; ready means reviewed, tested, integrated code and a scoped enablement plan, not payments switched on). Billing is OFF everywhere. No live Stripe write, no AWS change, no charge, no merge to main. Every payment anyone can see is a labelled simulation. |
| +Written 06:25 Dublin on 2026-10-02, during the second overnight run (brief: "continue overnight until we're ready to enable payments"; ready means reviewed, tested, integrated code and a scoped enablement plan, not payments switched on). Billing is OFF everywhere. No live Stripe write, no AWS change, no charge, no merge to main. Every payment anyone can see is a labelled simulation. |
| -Review servers, all answering 200: pricing page `http://100.119.180.57:38009` (static, rebuilt from site `2fc6388`), signup and billing demo `http://100.119.180.57:41881` (rebuilt 05:5x from the currency branch's tip `faf1bd25`, price book configured, USD/EUR/GBP end to end; Keymail and Stripe simulated), console billing copy `http://100.119.180.57:45033` if still up. |
| +Review servers, all answering 200: pricing page `http://100.119.180.57:38009` (static, rebuilt from site `2fc6388`), signup and billing demo `http://100.119.180.57:41881` (rebuilt 06:2x from the currency branch's code tip `25487506`, price book configured, USD/EUR/GBP end to end; Keymail and Stripe simulated), console billing copy `http://100.119.180.57:45033` if still up. |
| The durable records are on this branch under `implementation/carloku-paid-launch/`: `READINESS.md` (every branch's tip, gate log, CI and review state, with the verified behaviour), `ENABLEMENT.md` (the scoped plan to enable payments: catalog of 36, cutovers, key permissions, webhook, portal, release order, rollback, approvals), `OVERAGE-RATES-PROPOSAL.md` (the USD/GBP rate table for approval), `stripe-live-readiness.json` (remaining list revised for 36 prices and the book), `OUTSTANDING.md` (the metered model's open items and approvals A to K). |
| Decisions received 2026-10-01 evening, applied: the annual bases (28/24/22, 6/5/4.50, 60/50/45 USD/EUR/GBP, team minimum ten) confirmed for implementation only; the currency rulings (USD default, EUR for EU member states, GBP for the UK, visible override, one stored currency for subscription and overages, bands by billing country only); the five currency strings and the regrouped pricing page copy, approved verbatim and applied. Still a draft: the book `2026-10-01-draft1` and the USD/GBP overage rates and floors. |
| Branches (all on the forge, none merged; the local gate is not CI): |
| -- `feat/carloku-multi-currency-20261001` `faf1bd25`: the price book and one stored currency per purchase end to end, the billing page as one form with a server-signed quote, ownership on every path, the refusal review keyed by its intent with the session recorded, the cookies, the demo. Nine review rounds, each Opus accept with fixes and Astra reject, each round's findings fixed in the next commit with distinguishing tests and mutation checks (dispositions "Review nine" is the latest; since round 7 each round has found one P2, in bookkeeping around a refusal, none in a money path). Gate and CI passed through `f8a23ef3`; gate on `faf1bd25` running at 05:55, CI pending; tenth review running. No round has yet ended with both reviewers accepting. |
| -- `feat/carloku-metered-replicator-20261001` `b5aecf13`: eighth build (the seventh review's bounded findings: a vanished file as doubt, relative targets walked as spelled, intermediate fleets' recorders, the chain let go once latched); gate and CI passed; eighth review: Opus in, Astra pending. The deep items stay open and are listed in `READINESS.md`; the walk by directory descriptor is required before wiring. |
| +- `feat/carloku-multi-currency-20261001` `28dc2629` (code tip `25487506`): the price book and one stored currency per purchase end to end, the billing page as one form with a server-signed quote, ownership on every path, the refusal review keyed by its intent with the session recorded, the cookies, the demo. **Round ten (at `faf1bd25`) is the first with both reviewers accepting**, each with fixes: the same P3 from both (reconcile judged the bound session on ownership and currency alone) and one more from Astra (a session naming two accounts); both fixed in `25487506` with distinguishing tests and killed mutants (dispositions "Review ten"). Gate and CI passed through `faf1bd25`; gate on `25487506` running at 06:25, CI pending; the eleventh review is reading the fixes. |
| +- `feat/carloku-metered-replicator-20261001` `e5e67b25` (code tip `142ef5d0`): ninth build. The eighth review (both reject) found one P1 the eighth build's own fix had made: a latched predecessor was taken for a closed one, so a replacement could open beside a running fleet; the ninth build asks each fleet's own closed flag first and latches under the stale lock, with two tests and four killed mutants, plus the bounded items (a `..` only in a link target's leading run, umask-proof fixtures, the comments both listed). Gate and CI passed on `142ef5d0`; ninth review running. The deep items stay open and are listed in `READINESS.md`; the walk by directory descriptor is required before wiring. |
| - `feat/carloku-storage-sole-holder-20261001` `eaf6e63e`: round 9 both accept; CI passed; needs approval K and a cutover date. |
| - `fix/carloku-observe-routes-cleanup-20261001` `023e106c`: both accept; CI passed; merged into this branch at `47c97fa6`; the gate on the launch tip `b953fae4` passed (exit 0, three cross builds). |
| - `feat/carloku-billing-layout-20261001` `c1ae91a0`: merged into the currency branch; its two-form page was replaced by one form. |
| - `feat/carloku-late-request-fencing-20261001` `1b61de82`, `feat/carloku-bucket-hour-evidence-20261001` `0aa1fbec`: unchanged (rejected / needs approval J). |
| -- Site `feat/paid-pricing-20260916` (GitHub) `9427c22`: every amount from the platform's export; country band wiring; exact rates; honest link parameters, static links included; a draft book cannot be published by `check` or `build`. |
| +- Site `feat/paid-pricing-20260916` (GitHub) `3f1610d`: every amount from the platform's export; country band wiring; exact rates; honest link parameters, static links included; a draft book cannot be published by `check` or `build`; the price-book test named for what it checks (18 tests pass: `node --test test/*.test.mjs`). |
| **NEEDED:** |
| - Paul, commercial: approve the 36 amounts as an `approved` book version (approval L) together with the USD/GBP overage rates and floors in `OVERAGE-RATES-PROPOSAL.md`, or state other figures; the HALF code word; the proration policy (B); the partial-month rule (C). |
| - Paul, copy: the console billing page's 40 strings; the store-refusal copy (`OUTSTANDING.md` 19g); a new sentence for the pricing page's `bands.p3` ("The euro price is what is charged" is wrong under fixed currencies); the approved pricing and currency strings themselves need nothing more. |
| - Paul, rulings: evidence for a held bucket-hour (J); storage on a bucket a store has left (K); the cutover note (M: purchases before the book stay legacy EUR; binary first, variables second). |
| - Scoped approvals, prepared as plans only: Stripe test mode (E) for the fence test and the rehearsal; Stripe live provisioning (F) after the approved book; the Cost and Usage Report export and the scratch-object write (G); Path B on a dev box (H). |
| -- Reviews to read when they land: the currency branch's tenth (`logs/opus-currency-review10.md`, `astra-currency-review10.md`) and the replicator's eighth (`astra-replicator-review8.md` pending). |
| +- Reviews to read when they land: the currency branch's eleventh (`logs/opus-currency-review11.md`, `astra-currency-review11.md`) and the replicator's ninth (`opus-replicator-review9.md`, `astra-replicator-review9.md`). |
| **RECOMMENDED:** |
| -- Read the tenth currency review. If both accept, merge the currency branch into this branch through the forge (`amadan branch merge`, CI green on the tip); if not, the next commit answers it the same way, as every round so far has. Rule on K to let the storage branch follow. |
| +- Read the eleventh currency review. If it confirms round ten's fixes (both accepted round ten with fixes; the fixes are in `25487506`) and CI is green on the tip, merge the currency branch into this branch: a merge commit pushed to this branch, as the observe-routes fix was at `47c97fa6` (`amadan branch merge` lands a branch on main and is not what this step is), then gate the merged tip. If it does not confirm, the next commit answers it the same way. Rule on K to let the storage branch follow. |
| - Publish the approved book version as soon as L is given; it is a new entry in `internal/plans/pricebook.json`, the export regenerated and copied to the site, and the 36 lookup keys renamed. |
| - Test-mode rehearsal (E) before anything live: the list in both reviews and in `ENABLEMENT.md` section 6. |
| - Then, each on its own branch: quantity reduction at renewal, the evidence door for a box's first minutes, the AWS principal inventory and the bucket ownership attestation door, Free-tier enforcement, dormancy and pool accounting. |
| **SESSION:** |
| -Running at 05:55: the gate on the currency tip `faf1bd25`, the two tenth-round currency reviews, Astra's eighth replicator review, the two replicator reviews (detached `setsid` processes; their output files are named in `READINESS.md`). The demo (pid in `layout-review/demo-redesigned.log`'s process, stop marker `layout-review/demo-redesigned.stop`) and the pricing preview (`python3 -m http.server 38009`) keep serving. |
| +Running at 06:25: the gate on the currency code tip `25487506`, the two eleventh-round currency reviews, the two ninth replicator reviews (detached `setsid` processes; their output files are named in `READINESS.md`). The demo (pid in `layout-review/demo-redesigned.log`'s process, stop marker `layout-review/demo-redesigned.stop`) and the pricing preview (`python3 -m http.server 38009`) keep serving. |
| Scratch on the box: `~/.cache/tmp/claude-1001/{currency-wt,replicator-wt,fencing-wt,evidence-wt}` (git worktrees), the demo binaries, `/var/tmp/ck`, `~/.cache/carloku-gate`. The void gate logs are named `*VOID*`. |
diff --git a/implementation/carloku-paid-launch/ENABLEMENT.md b/implementation/carloku-paid-launch/ENABLEMENT.md| index f94e32558..6665b632e 100644 |
| --- a/implementation/carloku-paid-launch/ENABLEMENT.md |
| +++ b/implementation/carloku-paid-launch/ENABLEMENT.md |
| @@ -192,10 +192,11 @@ tonight except as `OUTSTANDING.md` records. |
| Ready means: reviewed, tested, integrated code, and this plan with its |
| approvals granted. It does not mean payments switched on. |
| -- Code: the currency branch at its tip is gated locally and pushed; its third |
| - independent review (Opus and Astra) is the one to read before any merge. |
| - The readiness checklist (`READINESS.md`) names every commit, gate log, |
| - review verdict and CI run. |
| +- Code: the currency branch at its tip is gated locally and pushed; its |
| + tenth independent review (Opus and Astra) accepted it with fixes, the |
| + fixes are in `25487506`, and the eleventh review of those is the one to |
| + read before any merge. The readiness checklist (`READINESS.md`) names |
| + every commit, gate log, review verdict and CI run. |
| - Not code: approvals A (remaining parts), B, E, F, L, M; the test-mode |
| rehearsal; the live provisioning; the first live proof. |
| - Not part of enabling subscriptions, still part of the complete metered |
diff --git a/implementation/carloku-paid-launch/READINESS.md b/implementation/carloku-paid-launch/READINESS.md| index 61d8a6f9b..688657ce3 100644 |
| --- a/implementation/carloku-paid-launch/READINESS.md |
| +++ b/implementation/carloku-paid-launch/READINESS.md |
| @@ -14,17 +14,17 @@ Log files are under `/home/paulca/.local/share/carloku-paid-launch-20260930/logs |
| | Branch | Tip | Gate | CI | Reviews | State | |
| | --- | --- | --- | --- | --- | --- | |
| -| `feat/carloku-multi-currency-20261001` | `faf1bd25` (the ninth review's findings) | passed on every tip through `f8a23ef3` (04:43Z, `gate-currency-f8a23ef3.txt`, exit 0, three cross builds, clean tree); `faf1bd25`: started 04:54Z (`gate-currency-faf1bd25.txt`); the four billing packages passed in full on the same tree before the commit. Void logs, not evidence: `gate-currency-a9304f16.txt`, `gate-currency-f269365a-VOID-dirty-tree.txt` | passed on every pushed tip through `f8a23ef3`; `faf1bd25` pending | Rounds 1 to 9, each Opus accept with fixes and Astra reject, each round's findings fixed in the next commit with distinguishing tests and mutation checks (dispositions, one section per round). The findings have narrowed to one P2 a round since round 7, each time in bookkeeping around a refusal (round 7 an outcome list, round 8 a review-routing order, round 9 a heal sweep that round 8 had added and round 9 removed), none in a money path. Round 10 at `faf1bd25`: running. No round has yet ended with both reviewers accepting | integrated end to end; not merged | |
| +| `feat/carloku-multi-currency-20261001` | `28dc2629` (= `25487506`, the tenth review's findings, plus the tenth review's two reports) | passed on every code tip through `faf1bd25` (04:58Z, `gate-currency-faf1bd25.txt`, exit 0, three cross builds, clean tree); `25487506`: started 05:18Z (`gate-currency-25487506.txt`); the console package passed in full on the same tree before the commit. Void logs, not evidence: `gate-currency-a9304f16.txt`, `gate-currency-f269365a-VOID-dirty-tree.txt` | passed on every pushed tip through `faf1bd25`; `25487506` and `28dc2629` pending | Rounds 1 to 9, each Opus accept with fixes and Astra reject, each round's findings fixed in the next commit with distinguishing tests and mutation checks (dispositions, one section per round). **Round 10 at `faf1bd25`: both accept with fixes**, the first such round; each found the same P3 (reconcile judged the bound session on ownership and currency alone, so a subscription event before the completion event could record a purchase the binder would have reviewed for its plan or band) and Astra one more (a session naming two accounts passed the resume and listing paths); nothing in a money path. Fixed in `25487506` with distinguishing tests and three killed mutants (dispositions "Review ten"). Round 11 at `25487506`: running | integrated end to end; not merged; the merge waits on round 11 confirming the fixes and CI on the tip | |
| | `feat/carloku-billing-layout-20261001` | `c1ae91a0` | (templates only; gated inside the currency branch) | passed | none of its own | merged into the currency branch at `5047494b`; its two-form layout was replaced by one form in `8958392b` | |
| | `feat/carloku-storage-sole-holder-20261001` | `eaf6e63e` | passed on `3af02a65`; `eaf6e63e` is wording and reports | passed | 9 rounds; round 9 both accept (omitted-holder class closed) | needs approval K and a recorded cutover date; not merged | |
| -| `feat/carloku-metered-replicator-20261001` | `b5aecf13` (eighth build) | passed on every pushed tip through `b5aecf13` (04:51Z, three cross builds); the ops, registry and lease tests pass under `/tmp` and `~/.cache` | passed on every pushed tip through `b5aecf13` | 4 to 7: each Opus accept with fixes, Astra reject; the bounded findings of each fixed in the next build (dispositions, "Review four" to "Review seven"); the deep ones open and listed there: litestream's own opens by path, `dataDir` and shadow ancestry, requests tracked to completion across midnight and a crash, a walk by directory descriptor (a reboot primitive on a box with a watchdog device, per Opus round 7: required before wiring), a tenant sharing the platform's uid, an exec route's claimed file outside the globs. 8 at `b5aecf13`: Opus in, Astra pending at 05:55 | not merged; unwired side work gated on approval H | |
| +| `feat/carloku-metered-replicator-20261001` | `e5e67b25` (= `142ef5d0`, the ninth build, plus the eighth review's two reports) | passed on every code tip through `142ef5d0` (05:11Z, `gate-replicator-142ef5d0.txt`, exit 0, three cross builds); the ops package passes under `/tmp`, `~/.cache`, `umask 077` and the race detector | passed on every pushed tip through `142ef5d0`; `e5e67b25` pending | 4 to 7: each Opus accept with fixes, Astra reject; 8 at `b5aecf13`: both reject on one P1 the eighth build's own fix had made (a latched predecessor taken for a closed one, so a replacement could open beside a running fleet), fixed in the ninth build with two tests and four killed mutants (dispositions "Review eight"); 9 at `142ef5d0`: running. The deep items stay open and are listed there: litestream's own opens by path (every reopen), protected endpoints under tenant-replaceable ancestry, requests tracked to completion across midnight and a crash, a walk by directory descriptor (required before wiring), a tenant sharing the platform's uid or root-run units, an exec route's claimed file outside the globs, one tenant's deletion holding every account's days (a stated availability cost) | not merged; unwired side work gated on approval H | |
| | `fix/carloku-observe-routes-cleanup-20261001` | `023e106c` | passed on `51587e00`; `023e106c` changes a test and two docs | passed | both accept at `51587e00` | merged into the launch branch at `47c97fa6` | |
| -| `feat/carloku-paid-launch-20260916` (launch) | `b953fae4`: this night's documents (`ea7e3ea6`) + the merge of the observe-routes fix (`47c97fa6`) + the readiness update | passed 03:06Z on `b953fae4` (`gate-launch-b953fae4.txt`, exit 0, three cross builds); last code gate before it on `cd8821c6` | passed on `6a08f88d`; `b953fae4` pushed 04:10, run pending | 17 rounds, no whole-branch pass | the integration target; first accepted side branch merged | |
| -| site `feat/paid-pricing-20260916` (GitHub) | `9427c22` | `node --test`: 18 pass (04:4x) | n/a | read-only by the currency reviews (section K); rounds four and five's site findings fixed in `4feb1cd` and `9427c22` | preview served at `http://100.119.180.57:38009`, rebuilt from `4feb1cd` (the `9427c22` change is the build script alone) | |
| +| `feat/carloku-paid-launch-20260916` (launch) | this commit: documents only on top of `3d47602b`; last code change the merge of the observe-routes fix (`47c97fa6`) | passed 03:06Z on `b953fae4` (`gate-launch-b953fae4.txt`, exit 0, three cross builds); every commit since is documents | passed on `3d47602b` | 17 rounds, no whole-branch pass | the integration target; first accepted side branch merged | |
| +| site `feat/paid-pricing-20260916` (GitHub) | `3f1610d` (a test renamed for what it checks, after review ten) | `node --test test/*.test.mjs`: 18 pass (05:18Z) | n/a | read-only by the currency reviews (section K); rounds four, five and ten's site findings fixed in `4feb1cd`, `9427c22`, `3f1610d` | preview served at `http://100.119.180.57:38009`, rebuilt from `4feb1cd` (the later changes are the build script and a test name alone) | |
| ## The flow, behaviour the tests establish (2026-10-02) |
| -These are what the automated tests assert on `faf1bd25`, against fakes of Keymail and Stripe; none of it is proven against the real provider, and the tenth independent review of this code is running. Tests: (`internal/console`: `TestBillingFormPostsWhatItShows`, |
| +These are what the automated tests assert on `25487506`, against fakes of Keymail and Stripe; none of it is proven against the real provider; the tenth independent review accepted the code with fixes (applied in `25487506`) and the eleventh is reading them. Tests: (`internal/console`: `TestBillingFormPostsWhatItShows`, |
| `TestBillingPageCurrencyControls`, `TestPricingLinkSurvivesSignIn`, |
| `TestCurrencySuggestionCookie`, `TestCountrySuggestionCookie`, |
| `TestBillingInclusionsFollowTheQuotedBand`, |
| @@ -56,10 +56,13 @@ reconcile, calculation, invoice and recovery tests in |
| acted on only when it is the intent's own (id, account, customer, mode, |
| bound id); the page signs its quote with the session's own token, so a |
| post buys only a quote a page rendered for that session; resolving the |
| - review of a session paid in the wrong currency retires its intent. |
| - Reviews four and five each found some of these wanting; they hold at |
| - `b51c2a26` by the tests named, and round six is reading them. |
| -- Demo at `http://100.119.180.57:41881`: rebuilt 05:5x from `faf1bd25` |
| + review of a session paid in the wrong currency retires its intent; a |
| + subscription event delivered before the completion event meets the |
| + same judgement of the session as the completion would, and records |
| + nothing from a session the binder would review; a session naming two |
| + accounts is nobody's on every path. They hold at `25487506` by the |
| + tests named. |
| +- Demo at `http://100.119.180.57:41881`: rebuilt 06:2x from `25487506` |
| (binary `billing-redesigned.test`, started by the stop-marker procedure; |
| the EUR-only binary is kept as `billing-redesigned-eur-only.test.bak`), |
| serving with the price book configured: the whole path from the pricing |
| @@ -92,10 +95,9 @@ Each is scoped in `ENABLEMENT.md` section 8 and `OUTSTANDING.md`. |
| own review. |
| - `OUTSTANDING.md` items 7 and 9 (late requests past Stripe's key memory) |
| are open defects, held, not waived. |
| -- The replicator's deep open items after its fourth review: a swap during |
| - litestream's first open is never seen (needs a litestream change); |
| - shadow directories' ancestry; requests tracked to completion across |
| - midnight and a crash. Its fifth build fixed the bounded ones. |
| +- The replicator's deep open items after its eighth review are in its |
| + row above; each build fixes that round's bounded ones and the ninth |
| + build fixed the one P1 the eighth had made. |
| - Open on the currency branch after round nine: an operator's door to |
| clear a quantity-history gap whose cause the operator has established |
| (none exists; such an account stays held, and the roll note forbids the |