carlos / platform Public

Decision 16 (the tax code of an overage line when the plan changed in the month); readiness and handoff at 02:03: the merged tip 7399d9fe passed its gate and CI; the operator CLI at fc7daebd

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

claude 3 weeks ago 404e699fd3d172dabf5d29172bd0158225ab17d1 parent 7399d9f

4 files changed, +14 −7

.claude/HANDOFF.md +3 −3
implementation/carloku-paid-launch/DECISIONS-FOR-PAUL.md +7 −0
implementation/carloku-paid-launch/OUTSTANDING.md +2 −2
implementation/carloku-paid-launch/READINESS.md +2 −2

CI passed — run details

diff --git a/.claude/HANDOFF.md b/.claude/HANDOFF.md

index e8bcaaa3a..53931cb84 100644

--- a/.claude/HANDOFF.md

+++ b/.claude/HANDOFF.md

@@ -7,7 +7,7 @@

Get Carloku's paid plans live with Stripe Tax and the complete metered model; have the pricing page and signup flow reviewable in the morning.

**STATUS:**

-Written 01:58 Dublin on 2026-10-03 (resumed 21:40 on 2026-10-02 after a provider limit; nothing was lost), during the second overnight run (brief: "continue overnight until we're ready to enable payments"; ready means reviewed, tested, integrated code and a scoped enablement plan, not payments switched on). Billing is OFF everywhere. No live Stripe write, no AWS change, no charge, no merge to main. **At 01:55 the currency branch (the price book and the retirement protocol) merged into this branch at `d64180a7`, after its twenty-sixth and twenty-seventh reviews ended with both reviewers accepting; the AWS principal report merged at `c4ee8807` after its seventh.** The merged tip's gate runs after this commit. Every payment anyone can see is a labelled simulation.

+Written 02:03 Dublin on 2026-10-03 (resumed 21:40 on 2026-10-02 after a provider limit; nothing was lost), during the second overnight run (brief: "continue overnight until we're ready to enable payments"; ready means reviewed, tested, integrated code and a scoped enablement plan, not payments switched on). Billing is OFF everywhere. No live Stripe write, no AWS change, no charge, no merge to main. **At 01:55 the currency branch (the price book and the retirement protocol) merged into this branch at `d64180a7`, after its twenty-sixth and twenty-seventh reviews ended with both reviewers accepting; the AWS principal report merged at `c4ee8807` after its seventh.** The merged tip `7399d9fe` passed its gate (exit 0, three cross builds) and CI. Every payment anyone can see is a labelled simulation.

Review servers, all answering 200: pricing page `http://100.119.180.57:38009` (static, rebuilt from site `2fc6388`), signup and billing demo `http://100.119.180.57:41881` (**still the build from `68f6ee23`**; it exited on its own at 00:10 on 2026-10-03 after its fourteen-hour limit and was restarted at 00:16 with the same binary, so it runs until about 14:15 unless restarted again, same recipe: `layout-review/STATE-demo.txt`, before the retirement protocol; not the code under review, and not Stripe proof; price book configured, USD/EUR/GBP end to end; Keymail and Stripe simulated), console billing copy `http://100.119.180.57:45033` if still up.

@@ -27,7 +27,7 @@ Branches (all on the forge, none merged; the local gate is not CI):

- Site `feat/paid-pricing-20260916` (GitHub) `4026231`: `build` and `check` render from the export before the draft check (a stale page cannot be published past a newer export); a floor that is not whole cents is refused rather than shown as `$1.20.5`; after `c12318d`: every amount from the platform's export; country band wiring; exact rates; honest link parameters, static links included; a draft book cannot be published by `check` or `build`; `bands.p3` carries the approved currency explanation; every priced slot, in every currency and band, and every banded inclusion equals its exported value; a figure is a whole number token on both sides (21 tests pass: `node --test test/*.test.mjs`).

**NEEDED:**

-- **Start here: `implementation/carloku-paid-launch/DECISIONS-FOR-PAUL.md`.** Fifteen numbered choices in five groups (a refused purchase, including a dead subscription naming one; people who leave a team; who is Free; the replicator; how a store bucket is proven the tenant's alone), each with a proposal and what it unblocks, so they can be answered together. The lettered approvals A to M are separate and listed below.

+- **Start here: `implementation/carloku-paid-launch/DECISIONS-FOR-PAUL.md`.** Sixteen numbered choices in six groups (a refused purchase, including a dead subscription naming one; people who leave a team; who is Free; the replicator; how a store bucket is proven the tenant's alone; which tax code an overage line carries when the plan changed during the month), each with a proposal and what it unblocks, so they can be answered together. The lettered approvals A to M are separate and listed below.

- Paul, commercial: approve the 36 amounts as an `approved` book version (approval L) together with the USD/GBP overage rates and floors in `OVERAGE-RATES-PROPOSAL.md`, or state other figures; the HALF code word; the proration policy (B); the partial-month rule (C).

- Paul, copy: the console billing page's 40 strings; the store-refusal copy (`OUTSTANDING.md` 19g). `bands.p3` is done: the approved currency explanation replaced the converted-euro sentence (site `e091e3f`, 07:0x); it now reads the same as the note under the currency selector.

- Paul, rulings: evidence for a held bucket-hour (J); storage on a bucket a store has left (K); the cutover note (M: purchases before the book stay legacy EUR; binary first, variables second).

@@ -45,6 +45,6 @@ Branches (all on the forge, none merged; the local gate is not CI):

- Then, each on its own branch: quantity reduction at renewal, the evidence door for a box's first minutes, the AWS principal inventory and the bucket ownership attestation door, Free-tier enforcement, dormancy and pool accounting.

**SESSION:**

-Running at 01:58: the gate on this branch's tip (the currency merge `d64180a7` plus this records commit), then the gate on the operator CLI tip `fc7daebd`, chained. Done: the gates on `2b0abef1` (00:51Z), `0491ff76` (00:46Z), `9b872e38` (00:42Z), `4a1a92d9` (00:36Z). Then: the build list below, each on its own branch. Full package runs need `GOFLAGS=-buildvcs=false`, as the gate sets it. Detached `setsid` processes. A gate must be started with `logs/run-gate.sh`, which uses the default build cache; full runs take the gate's `-timeout 30m`.

+Running at 02:03: the gate on the operator CLI tip `fc7daebd` (alone; CI passed on it). Done: the gate on this branch's tip `7399d9fe` (exit 0; CI passed). Done: the gates on `2b0abef1` (00:51Z), `0491ff76` (00:46Z), `9b872e38` (00:42Z), `4a1a92d9` (00:36Z). Then: the build list below, each on its own branch. Full package runs need `GOFLAGS=-buildvcs=false`, as the gate sets it. Detached `setsid` processes. A gate must be started with `logs/run-gate.sh`, which uses the default build cache; full runs take the gate's `-timeout 30m`.

Scratch on the box: `~/.cache/tmp/claude-1001/{currency-wt,replicator-wt,fencing-wt,evidence-wt,opcli-wt,inventory-wt,flush-wt,reduction-wt}` (git worktrees), the demo binaries, `/var/tmp/ck`, `~/.cache/carloku-gate`. The void gate logs are named `*VOID*`.

diff --git a/implementation/carloku-paid-launch/DECISIONS-FOR-PAUL.md b/implementation/carloku-paid-launch/DECISIONS-FOR-PAUL.md

index ffaa1ae64..15ff5dca6 100644

--- a/implementation/carloku-paid-launch/DECISIONS-FOR-PAUL.md

+++ b/implementation/carloku-paid-launch/DECISIONS-FOR-PAUL.md

@@ -47,6 +47,12 @@ Context: a store bucket's transfer is billed to its tenant only if the ledger ca

14. **How a store bucket is proven to be the tenant's alone, and who else may reach one.** The first build tried to prove it by listing the account's principals; its review showed (rightly) that one listing of an eventually consistent account cannot prove it: a policy attached a moment before can be missing, a role set aside as the platform's is also everyone its trust policy lets assume it, and a bucket absent now can be created by someone else before the grant creates it. So the listing is now a report for a person, and the proof needs two things the account enforces, each a design and an infrastructure change for your approval: (a) a rule (an organization policy, or a required permissions boundary plus an account rule) that denies S3 on the store bucket prefix to every principal except the store users and a short list named by ARN; (b) bucket names the grant mints with a random part recorded before any provider call, and a grant that refuses a bucket that already exists for any reason. And the decision proper: who is on the named list. The host role (it creates and deletes store buckets; it cannot read objects) and administrator roles reach every store bucket; AWS charges transfer by bucket and does not say who moved the bytes, so if staff download from a tenant's bucket, that transfer lands on the tenant. Proposed: only the host role and roles that need account administration to assume, named one by one with each role's trust policy part of the record; staff do not read tenant buckets, and if support ever requires it the platform credits the bytes; and approve the direction of (a) and (b) or say what should stand in their place. The report itself can be run by an operator with their own credentials and needs no console permission.

+## F. A month in which the plan changed (per-line tax codes; OUTSTANDING item 17)

+Context: the overage invoice for a month is one line per meter, and every line carries one product tax code. Personal and Community share one code (`txcd_10102001`, software for personal use) and Business has another (`txcd_10102000`, software for business use). Allowances are already time-weighted across a month's paid spans and overage rates are per currency, not per plan, so a plan change inside a month changes nothing in the money; it changes which tax code the overage lines should carry. Today a month whose paid spans carry two tax codes (a change to or from Business) is not invoiced: it holds with a review (`billing_invoice_tax_code_mixed`) for a person. Nothing is built for it.

+16. **Which tax code an overage line carries when the plan changed during the month.** Proposed: split by span, so each meter has one line per tax code, with the usage of each UTC day attributed to the plan in force on that day and each line taxed by that plan's code (the amounts in total are unchanged; the box's daily usage then has to be carried for every month, not only for a partly covered one, which is a small change on the box side). The alternative: one line per meter taxed by the plan in force at the month's end, which needs no daily split and is a simpler invoice but taxes some days' usage under the other plan's code. If the accountant says one code per invoice is acceptable in that case, the alternative is the smaller build; otherwise the split. Until either is chosen the hold stays, and it is rare (a change to or from Business in a month with overage).

## What each answer unblocks

| Answers | Unblocks |

@@ -59,3 +65,4 @@ Context: a store bucket's transfer is billed to its tenant only if the ledger ca

| 10 to 13 | the replicator's design for the deferred items, then wiring, then the replication-writes meter |

| 14 | the design of the enforced rule and the minted bucket names, then their build and review, then the attestation of the four existing stores, then the store-transfer meter (which also needs the Cost and Usage Report export, approval G) |

| 15 | nothing until the test-mode rehearsal answers its question; if the provider does make such subscriptions, the code that reads an attached subscription's status before stage 1 can be enabled |

+| 16 | per-line tax codes for a month in which the plan changed (OUTSTANDING item 17): the split by span, or the month-end plan's code; the hold stays until then |

diff --git a/implementation/carloku-paid-launch/OUTSTANDING.md b/implementation/carloku-paid-launch/OUTSTANDING.md

index 038a3d0a5..b10e83e39 100644

--- a/implementation/carloku-paid-launch/OUTSTANDING.md

+++ b/implementation/carloku-paid-launch/OUTSTANDING.md

@@ -58,8 +58,8 @@ Each is concrete. None is waived.

14. Quantity reduction at renewal. **Absent.** Team plans cannot be sold without it: a renewal bills the old quantity.

15. Free tier. **Absent**: no Free entitlement, no app cap, no storage refusal, no per-plan idle, no flush-only class. Scoped 2026-10-02: the entitlement record already carries what the spec's step 13 needs (`Runtime.IdleSeconds`, `MaxApps`, `MaxMembers`, `Replication` with `hibernate-flush`, `StatusFree`, `PlanFree`), and **nothing consumes any of it**: `deriveEntitlement` returns a hold for Free, and no code in the console, the activator or a box reads `MaxApps`, `IdleSeconds` or the replication class from an entitlement. The Free caps (3 apps, 2-minute idle) are in the approved spec and not in `plans.json` (which has Free's pooled resources only). Building it is four pieces, each on its own reviewed branch: (a) the caps in the terms (a new terms version, since a published version is not edited) and a Free record from `deriveEntitlement`; (b) the console's app-creation gate on `MaxApps`; (c) the box reading idle and the replication class from the published entitlement, with `hibernate-flush` added to the activator's classes (the unset value means stream there today, the opposite of Free's intent); (d) storage refusal at the cap. **One decision is Paul's before (a)**: who is Free on the day it is switched on. Proposed policy for review: every account with no paid subscription and no house marker is Free from an announced date; accounts over a Free cap on that date keep what they have and can add nothing until under it (no app is stopped or archived by the switch); house accounts are unaffected. Without that ruling (a) would apply caps to every existing unpaid account on the flagship.

16. Dormancy archive and warnings; recognised-revenue pool accounting; the books site. **Absent.**

-17. Per-line tax codes for a month spanning two tax codes (it holds with a review today).

-18. A `carlos` verb and documentation for the operator doors (**built, not merged**: `feat/carloku-billing-operator-cli-20261002` `31731fdd`, gate passed, two Astra reviews answered, Opus's second and Astra's third running; its public reference section is unreviewed copy); a statement rebuild door for a closed month; an operator verb to backfill bucket ownership.

+17. Per-line tax codes for a month spanning two tax codes (it holds with a review today, `billing_invoice_tax_code_mixed`). Scoped 2026-10-03: allowances are already time-weighted across the paid spans and overage rates are per currency, so a plan change inside a month changes only the tax code of the overage lines; which code, or whether to split each meter's line by span from daily usage, is decision 16 in `DECISIONS-FOR-PAUL.md`. Nothing is built; the build follows the answer.

+18. A `carlos` verb and documentation for the operator doors (**built, not merged**: `feat/carloku-billing-operator-cli-20261002` `fc7daebd`, a merge of the currency tip; four reviews answered, the third and fourth both accept with fixes, P3s only; gates passed alone through `40ea61b1`, the gate on `fc7daebd` queued; its public reference section in `docs/site/cli.md` is unreviewed copy and the branch does not merge before Paul reads it); a statement rebuild door for a closed month; an operator verb to backfill bucket ownership.

### Process

diff --git a/implementation/carloku-paid-launch/READINESS.md b/implementation/carloku-paid-launch/READINESS.md

index 87a067eb9..437999b04 100644

--- a/implementation/carloku-paid-launch/READINESS.md

+++ b/implementation/carloku-paid-launch/READINESS.md

@@ -19,10 +19,10 @@ Log files are under `/home/paulca/.local/share/carloku-paid-launch-20260930/logs

| `feat/carloku-metered-replicator-20261001` | `e1280811` (review twenty answered with comments, a fixture and dispositions only; the code is the twentieth build `c9ec11eb`: a tree claim refuses a tenant's file in a platform directory too, the fixture's guard reachable, the no-recorder refusal quoted; after `53e3dcd8`, the nineteenth build: a tenant's file in a platform directory refused in both layouts, the long-target fixture within the pathname budget and under XFS's link limit, refusal messages quoted; after `6249af63`, the eighteenth; reviews eight to eighteen's reports in the tree) | passed on every code tip through `f306222c`, then **failed on `bffc76b5`** (`gate-replicator-bffc76b5.txt`, exit 2: the seventeenth build's long-target fixture held only under a temp root of about 34 bytes or more; the gate's `/var/tmp/ck` is shorter), passed on `6249af63` (09:04Z, `gate-replicator-6249af63.txt`, exit 0, three cross builds, clean tree); `53e3dcd8`: passed (09:38Z, `gate-replicator-53e3dcd8.txt`, exit 0, three cross builds); `c9ec11eb`: passed (09:52Z, `gate-replicator-c9ec11eb.txt`, exit 0, three cross builds); `e1280811`: passed (10:10Z, `gate-replicator-e1280811.txt`, exit 0, three cross builds). Void: `gate-replicator-e8211fc6-VOID-stopped-for-astra17-followup.txt` (stopped so Astra's report could be answered in the same build) | passed through `f306222c`; **failed on `bffc76b5`** (the same fixture); passed on `6249af63`, `53e3dcd8`, `c9ec11eb` and `e1280811` | 4 to 7: each Opus accept with fixes, Astra reject; 8: both reject on one P1 the eighth build made (fixed in the ninth); 9 to 15: Opus accept with fixes, Astra reject, each round finding the previous build's own addition wanting (15 at `03b19014`: the fifteenth build joined a relative link target and so cleaned a `..` the kernel resolves physically, a regression that let a link to a directory outside the tree pass in silence; fixed in the sixteenth build by concatenating uncleaned, with the fixture both asked for); 16 at `f306222c`: Opus accept with fixes, Astra reject; both found the fifteenth's regression closed and one bound Astra named (the concatenated spelling could outgrow PATH_MAX), fixed in the seventeenth build `bffc76b5` with `fstatat` against the link's directory. 17 at `bffc76b5`: Opus accept with fixes, Astra reject; both named the same two new defects in that fix: the directory was opened by path with Go's default flags (a FIFO a tenant swaps in blocks the watch and Close; a device would have its driver's open run) and the long-target fixture failed under any short temp root (which is what failed the gate and CI). The eighteenth build opens the directory with `O_DIRECTORY|O_NONBLOCK|O_NOCTTY|O_CLOEXEC` (anything but a directory refused by the open itself; three mutants killed: default flags, `O_DIRECTORY` alone dropped, the fixed fixture size under `/var/tmp/ck`), sizes the fixture from the temp root, compares `render` across sections, and corrects the comments and names Astra listed; the false "package tests pass under /tmp" claim of the seventeenth build is marked false in its dispositions. 18 at `6249af63`: Opus accept (three P3s: the fixture's 3 KB link target, which XFS refuses; a tenant's file in a platform directory accepted under the tenant's tree and refused under the platform's; wording), Astra reject on the deep items (and the fixture's fixed depth). The nineteenth build `53e3dcd8` answers them (two mutants killed). 19 at `53e3dcd8`: Opus accept (two P3s), Astra reject on the deep items; the twentieth build `c9ec11eb` makes the bounded changes (one mutant killed) and its dispositions list the deferred items separately, each as blocking wiring and needing a design or a decision. 20 at `c9ec11eb`: Opus accept with fixes, Astra reject on the deep items; `e1280811` changes no behaviour and is not sent for another round; the two refusals Opus named as decisions are in `DECISIONS-FOR-PAUL.md` (11, 12). Each build's dispositions section lists its killed mutants. The deep items stay open and are listed there: litestream's own opens by path (every reopen), protected endpoints under tenant-replaceable ancestry, a delayed admitted request past the margin, requests across a crash or restart, the header open through a swapped ancestor (a walk by directory descriptor, required before wiring), a tenant sharing the platform's uid, root-run units and a route naming another user's coherent tree (approval H), hibernating aliases and claims on skipped files, required coverage that can vanish without an entry, whether one tenant's unaccepted links refuse the whole box (a decision before wiring), one tenant's deletion holding every account's days once (a stated cost). None of these is minor: the branch cannot be wired until they are closed or decided | not merged; unwired side work gated on approval H |

-| `feat/carloku-paid-launch-20260916` (launch) | this commit: documents only on top of `d64180a7`, the merge of the currency branch (2026-10-03 01:55); before it `c4ee8807`, the merge of the AWS principal report; before those, documents on top of `3d47602b` and the merge of the observe-routes fix (`47c97fa6`) | the gate on this commit (the first after the currency merge) runs next, alone; `0491ff76` (the inventory merge plus records): **passed** (00:46Z, `gate-launch-0491ff76.txt`, exit 0, three cross builds). passed 03:06Z on `b953fae4` (`gate-launch-b953fae4.txt`, exit 0, three cross builds); every commit since is documents | passed on `3d47602b` | 17 rounds, no whole-branch pass | **the currency branch and the AWS principal report are merged in; the operator CLI (`fc7daebd`, a merge of `2b0abef1`) waits on Paul's reading of its public section; everything else is as listed below.** the integration target; first accepted side branch merged |

+| `feat/carloku-paid-launch-20260916` (launch) | this commit: documents only on top of `d64180a7`, the merge of the currency branch (2026-10-03 01:55); before it `c4ee8807`, the merge of the AWS principal report; before those, documents on top of `3d47602b` and the merge of the observe-routes fix (`47c97fa6`) | `7399d9fe` (the currency merge `d64180a7` plus records): **passed** (`gate-launch-7399d9fe.txt`, exit 0, three cross builds, alone); CI passed on `7399d9fe`. `0491ff76` (the inventory merge plus records): **passed** (00:46Z, `gate-launch-0491ff76.txt`, exit 0, three cross builds). passed 03:06Z on `b953fae4` (`gate-launch-b953fae4.txt`, exit 0, three cross builds); every commit since is documents | passed on `3d47602b` | 17 rounds, no whole-branch pass | **the currency branch and the AWS principal report are merged in; the operator CLI (`fc7daebd`, a merge of `2b0abef1`) waits on Paul's reading of its public section; everything else is as listed below.** the integration target; first accepted side branch merged |

| `feat/carloku-quantity-reduction-20261002` | `978ddc8a` (design only, off `68f6ee23`) | n/a (no code) | n/a | Astra's design review rejected revision 1 on four P1s (a request can cross the renewal and its confirmation proves nothing about the invoiced quantity; a future-dated assignment blocks every change before the renewal; a missed window postpones the reduction a year in silence; fence-only enablement leaves no path to restore returning seats). Revision 2 waits on three decisions that are Paul's (`2026-10-02-quantity-reduction-at-renewal-design.md`, last section) | OUTSTANDING 14 stays absent in code |

| `feat/carloku-flush-only-class-20261002` | `5f43a0e4` (off the launch branch at `65363554`; a unit-backed route's rung can be cleared; the test waits for the start-up snapshot; after `5c327226`): the `hibernate-flush` word in the registry's vocabulary and the activator's interval map, **withdrawn from the rungs on offer and set by nothing**; the CLI rail refuses any rung on a unit-backed route | `0e8ea227` **failed** (the CLI's word test; `gate-flush-0e8ea227-FAILED-cli-word-test-stopped.txt`); `5c327226` passed (12:54Z); `5f43a0e4` passed (13:35Z, `gate-flush-5f43a0e4.txt`, exit 0, three cross builds) | `0e8ea227` failed; `5c327226` and `5f43a0e4` passed | 1 at `0e8ea227`: Opus accept with fixes, Astra reject: the ten-year interval does not give "wake and sleep only" against the vendored litestream (daily snapshot while awake; the awake backlog waits for a 30-second flush at sleep; the local log untrimmed), so the class's contract is decision 10a and nothing of its options is built; the inherited defect Astra found (`Replicator.Close` can return nil having flushed nothing) is forge discussion 200. 2 at `5c327226`: both accept with fixes (the unit-backed refusal blocked clearing an existing rung; the test raced the start-up snapshot; listings print the raw word; three inaccurate statements), fixed in `5f43a0e4`, which has not been read by a reviewer. Stated open and unchanged: `Replicator.Close` can return nil having flushed nothing and a failed flush still ends in hibernation (inherited, every class, forge discussion 200); the unbounded awake backlog; no verified wake boundary; class-blind restore drill and lag thresholds | **does not implement the Free plan's durability**; not mergeable as a feature until 10a; the rest of OUTSTANDING 15 waits on who is Free |

-| `feat/carloku-billing-operator-cli-20261002` | `40ea61b1` (a merge of the currency tip `35356ad0`); before it `6d4c2912` (the fourth review's P3s answered: `account_deleted` always on the wire and printed; the console's own 5xx on a write; the moved console after the offer; the help's two facts); before it `4e9cac43` (`f9683fbe`: the third review's twelve P3s answered: a write names its console or is refused; refusals from in front of the console; the moved console through the interactive offer; the whole command tested through `runBillingWith`; then the currency tip `e152df30` merged in); before it `31731fdd` (Astra's second review answered in `f155e543`: ambiguous flag values refused, the keep wording, strict listing envelopes, write advice that fits the write, the console's note predicate, `billingRun` tested; then the currency tip `05ccec07` merged in); before it `51ef27ac` (the first review answered in `57f70c16`, then the currency tip `b260ac8e` merged in): `carlos billing reviews\|resolve\|rejected\|house`, a client for the four operator doors | `40ea61b1`: **passed** (00:08Z, `gate-opcli-40ea61b1.txt`, exit 0, three cross builds, alone). `6d4c2912` was not gated on its own (superseded by the merge). `4e9cac43`: **passed** (23:09Z, `gate-opcli-4e9cac43.txt`, exit 0, three cross builds, alone). `51ef27ac`: **passed** (21:29Z, exit 0, three cross builds); `31731fdd`: **passed** (22:16Z, `gate-opcli-31731fdd.txt`, exit 0, three cross builds). `0f507bff` **failed** (exit 2, `gate-opcli-0f507bff.txt`): one test, the docs gate, which requires a `carlos billing` heading in the public CLI reference. `51ef27ac`: started 21:18Z, run alone (`gate-opcli-51ef27ac.txt`) | passed on `6d4c2912` and `40ea61b1`; `0f507bff` failed (the docs gate) | 4 at `4e9cac43`: **both accept with fixes, all P3**, answered in `6d4c2912` (CI passed); no fifth review unless the client changes. 3 at `31731fdd`: **both accept with fixes** (six P3 each), answered in `f9683fbe`; a fourth reading not started. 2 at `51ef27ac`: Astra accept with fixes (three P2, six P3), answered in `f155e543`; Opus's second reading and Astra's third running on `31731fdd`. 1 at `0f507bff`: Opus accept with fixes (P1 the docs gate, four P2), Astra reject (five P2). Answered in `57f70c16`: arguments are one unambiguous request or refused before anything is sent; writes are reported only on the door's acknowledgement and name the console; one wire-contract file both sides' tests read. Second review not started | not merged (it is built on the currency branch, which merges first). **Its `docs/site/cli.md` section is new public copy and is unreviewed**: it does not merge before Paul reads it

+| `feat/carloku-billing-operator-cli-20261002` | `fc7daebd` (a merge of the currency tip `2b0abef1`); before it `6d4c2912` (the fourth review's P3s answered: `account_deleted` always on the wire and printed; the console's own 5xx on a write; the moved console after the offer; the help's two facts); before it `4e9cac43` (`f9683fbe`: the third review's twelve P3s answered: a write names its console or is refused; refusals from in front of the console; the moved console through the interactive offer; the whole command tested through `runBillingWith`; then the currency tip `e152df30` merged in); before it `31731fdd` (Astra's second review answered in `f155e543`: ambiguous flag values refused, the keep wording, strict listing envelopes, write advice that fits the write, the console's note predicate, `billingRun` tested; then the currency tip `05ccec07` merged in); before it `51ef27ac` (the first review answered in `57f70c16`, then the currency tip `b260ac8e` merged in): `carlos billing reviews\|resolve\|rejected\|house`, a client for the four operator doors | `fc7daebd`: running, alone (`gate-opcli-fc7daebd.txt`), after the launch tip's. `40ea61b1`: **passed** (00:08Z, `gate-opcli-40ea61b1.txt`, exit 0, three cross builds, alone). `6d4c2912` was not gated on its own (superseded by the merge). `4e9cac43`: **passed** (23:09Z, `gate-opcli-4e9cac43.txt`, exit 0, three cross builds, alone). `51ef27ac`: **passed** (21:29Z, exit 0, three cross builds); `31731fdd`: **passed** (22:16Z, `gate-opcli-31731fdd.txt`, exit 0, three cross builds). `0f507bff` **failed** (exit 2, `gate-opcli-0f507bff.txt`): one test, the docs gate, which requires a `carlos billing` heading in the public CLI reference. `51ef27ac`: started 21:18Z, run alone (`gate-opcli-51ef27ac.txt`) | passed on `6d4c2912`, `40ea61b1` and `fc7daebd`; `0f507bff` failed (the docs gate) | 4 at `4e9cac43`: **both accept with fixes, all P3**, answered in `6d4c2912` (CI passed); no fifth review unless the client changes. 3 at `31731fdd`: **both accept with fixes** (six P3 each), answered in `f9683fbe`; a fourth reading not started. 2 at `51ef27ac`: Astra accept with fixes (three P2, six P3), answered in `f155e543`; Opus's second reading and Astra's third running on `31731fdd`. 1 at `0f507bff`: Opus accept with fixes (P1 the docs gate, four P2), Astra reject (five P2). Answered in `57f70c16`: arguments are one unambiguous request or refused before anything is sent; writes are reported only on the door's acknowledgement and name the console; one wire-contract file both sides' tests read. Second review not started | not merged (it is built on the currency branch, which merges first). **Its `docs/site/cli.md` section is new public copy and is unreviewed**: it does not merge before Paul reads it

| `feat/carloku-principal-inventory-20261002` | `4a1a92d9` (the sixth review answered: an S3 action on an Object Lambda resource is a possible reach, the "possibly" label and the legend extended, the mutation paragraph as the logs have it); before it `36e5ff2d` (the fifth review answered: the possible reach decided by one text test on the pattern and its padded form, decision 14 names what the host role can mint through a store user, the legend's other spellings, a nil page an error); before it `403384c2` (the fourth review answered: a resource pattern read as text and, when it is an incomplete ARN, as padded fields too, a reach under either reported; nothing S3 names excluded, Storage Lens included; an empty condition, an operator with no key and an empty value list are errors; the `AssumableBy` legend and the "does not read" lists reworded for same-account trust, control of compute and IAM writes; counts tagged; the CUR plan and OUTSTANDING item 2 no longer name an inventory in the provisioner as the mechanism); before it `434cdf48` (the third review answered: every S3 resource that is not the bucket a possible reach; incomplete ARNs as IAM reads them; version ids unique; condition values checked; a group's possible reach carried to its members; the label renamed `named_by_deployment`; the attestation plan marked superseded in part); before it `0e1bc298` (the second review answered: a repeated JSON member is an error; a managed policy's default-version id must agree with the version marked default; every trust-policy statement read in full; a grant on an access point, a multi-region access point or an Object Lambda access point reported as a possible reach, marked; the two proposals stated with what they lack); before it `199a9736`: **a report for a person** (`PrincipalReport.BucketPrincipals`: who reaches a name, through which policies, and who each role's trust policy lets assume it), **not a `GranteeProber`** and a test says so; before it `d61f4f27`, which offered itself as the ledger's proof | `4a1a92d9`: **passed** (00:36Z, `gate-inventory-4a1a92d9.txt`, exit 0, three cross builds, alone). `36e5ff2d`: **passed** (00:26Z, alone). `403384c2`: **passed** (00:14Z, alone). `434cdf48`: **passed** (23:44Z, alone). Mutants in git-less tree copies with the killing tests logged from round five on: `inventory-mutants-round{1..6}.txt` | passed on `0e1bc298`, `434cdf48`, `403384c2`, `36e5ff2d` and `4a1a92d9` | **7 at `4a1a92d9`: both accept** (Opus: every sixth-round finding closed, two P3 bookkeeping items, neither required; Astra: accept, no new finding). 6 at `36e5ff2d`: Opus accept (three P3), Astra accept with fixes (one P2: Object Lambda's management actions in the s3 namespace on an Object Lambda resource), answered in `4a1a92d9`. 5 at `403384c2`: both accept with fixes (one P2 each: the possible-reach rule's text reading skipped for a complete pattern with a question mark across a colon; decision 14 understating the host role), answered in `36e5ff2d`. 5 at `403384c2`: running since 00:57 (Opus's third reading and Astra). 4 at `434cdf48`: Opus accept with fixes (two P2 required: an incomplete ARN read only as padded fields dropped grants the text reading reported; the legend wrong in the under-reporting direction), Astra reject (three P2: the Storage Lens exclusion dropped a write path; empty condition shapes read as a report; the legend), all answered in `403384c2`. 3 at `0e1bc298`: Opus accept with fixes (two P2 required: other S3 resource types dropped; the attestation plan still claiming an IAM read proves completeness), Astra reject (four P2, two P3). Answered; gate not yet run; never run against AWS. 1 at `d61f4f27`: Astra reject (three P1). Answered in `199a9736` by making it a report. 2 at `199a9736`: Astra reject (six P2: access-point grants under-reported; duplicate JSON members; default-version metadata not checked; trust-policy grammar; the two proposals overstated). Opus not yet read. Answered in `0e1bc298`; the third review (Astra) and Opus's first reading running on it | **merged into this branch at `c4ee8807` (01:40, a merge commit) after round seven's two acceptances, the gate and CI on `4a1a92d9`; the gate on the merged tip `c4ee8807` is queued behind the currency gate**; a report for a person, unwired; what a completeness claim needs is now decision 14 (an enforced rule; minted bucket names); the report can be run by an operator with their own credentials; never run against AWS

| site `feat/paid-pricing-20260916` (GitHub) | `01b62f7` (the money renderer a module the test calls); before it `4026231` (`build` and `check` render from the export before the draft check, so a stale page cannot be published past a newer export; a floor that is not whole cents is refused by the renderer rather than shown as `$1.20.5`; after `c12318d`: `bands.p3` replaced by the approved explanation, every priced slot, inclusion band and figure token pinned exactly) | `node --test test/*.test.mjs`: 21 pass (09:1xZ) | n/a | read-only by the currency reviews (section K); rounds four, five, ten, twelve to seventeen's site findings fixed | preview served at `http://100.119.180.57:38009` from the tree (rebuilt with the `bands.p3` change) |