carlos / platform Public

Readiness and handoff at 07:25: rounds twelve and thirteen accepted with fixes, the fixes in and round fourteen running; the replicator's twelfth build; the provisioning note on currency options made one sentence

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

claude 3 weeks ago 4240ba8665d112248fa97c83d479b26b29cd6c51 parent 780180f

4 files changed, +30 −23

.claude/HANDOFF.md +8 −8
implementation/carloku-paid-launch/ENABLEMENT.md +4 −3
implementation/carloku-paid-launch/READINESS.md +13 −9
implementation/carloku-paid-launch/stripe-provisioning.md +5 −3

CI passed — run details

diff --git a/.claude/HANDOFF.md b/.claude/HANDOFF.md

index 85eb9dfb8..7e20f7314 100644

--- a/.claude/HANDOFF.md

+++ b/.claude/HANDOFF.md

@@ -7,39 +7,39 @@

Get Carloku's paid plans live with Stripe Tax and the complete metered model; have the pricing page and signup flow reviewable in the morning.

**STATUS:**

-Written 06:45 Dublin on 2026-10-02, during the second overnight run (brief: "continue overnight until we're ready to enable payments"; ready means reviewed, tested, integrated code and a scoped enablement plan, not payments switched on). Billing is OFF everywhere. No live Stripe write, no AWS change, no charge, no merge to main. Every payment anyone can see is a labelled simulation.

+Written 07:25 Dublin on 2026-10-02, during the second overnight run (brief: "continue overnight until we're ready to enable payments"; ready means reviewed, tested, integrated code and a scoped enablement plan, not payments switched on). Billing is OFF everywhere. No live Stripe write, no AWS change, no charge, no merge to main. Every payment anyone can see is a labelled simulation.

-Review servers, all answering 200: pricing page `http://100.119.180.57:38009` (static, rebuilt from site `2fc6388`), signup and billing demo `http://100.119.180.57:41881` (rebuilt 06:4x from the currency branch's tip `781bb1c2`, price book configured, USD/EUR/GBP end to end; Keymail and Stripe simulated), console billing copy `http://100.119.180.57:45033` if still up.

+Review servers, all answering 200: pricing page `http://100.119.180.57:38009` (static, rebuilt from site `2fc6388`), signup and billing demo `http://100.119.180.57:41881` (rebuilt 07:2x from the currency branch's tip `9574a798`, price book configured, USD/EUR/GBP end to end; Keymail and Stripe simulated), console billing copy `http://100.119.180.57:45033` if still up.

The durable records are on this branch under `implementation/carloku-paid-launch/`: `READINESS.md` (every branch's tip, gate log, CI and review state, with the verified behaviour), `ENABLEMENT.md` (the scoped plan to enable payments: catalog of 36, cutovers, key permissions, webhook, portal, release order, rollback, approvals), `OVERAGE-RATES-PROPOSAL.md` (the USD/GBP rate table for approval), `stripe-live-readiness.json` (remaining list revised for 36 prices and the book), `OUTSTANDING.md` (the metered model's open items and approvals A to K).

Decisions received 2026-10-01 evening, applied: the annual bases (28/24/22, 6/5/4.50, 60/50/45 USD/EUR/GBP, team minimum ten) confirmed for implementation only; the currency rulings (USD default, EUR for EU member states, GBP for the UK, visible override, one stored currency for subscription and overages, bands by billing country only); the five currency strings and the regrouped pricing page copy, approved verbatim and applied. Still a draft: the book `2026-10-01-draft1` and the USD/GBP overage rates and floors.

Branches (all on the forge, none merged; the local gate is not CI):

-- `feat/carloku-multi-currency-20261001` `781bb1c2`: the price book and one stored currency per purchase end to end, the billing page as one form with a server-signed quote, ownership on every path, the refusal review keyed by its intent with the session recorded, the cookies, the demo. **Rounds ten and eleven both ended with both reviewers accepting, each with P3 fixes**, applied in `25487506` and `781bb1c2` with distinguishing tests and killed mutants (dispositions "Review ten", "Review eleven"; round eleven's: a bound session read back as nobody's now files the intent-keyed review instead of wedging the intent, a subscription that is not the intent's purchase files it too, an expiry's answer must name the account). Gate and CI passed through `28dc2629`; gate on `781bb1c2` running at 06:45, CI pending; the twelfth review is reading the fixes.

-- `feat/carloku-metered-replicator-20261001` `9301ed62`: tenth build. The ninth review (Opus accept with fixes, Astra reject on the deep items) found one P2: `Close` took no last look at the files, so a swap still in place at a rebuild was held by nobody; the tenth build takes that look before the witness read, inventories an exec route's database outside the globs, reports a hibernating route over a unit claim, and pins the latch inside `Close`, with five killed mutants. Gate and CI passed on `9301ed62`; tenth review: Opus in, Astra pending. The deep items stay open and are listed in `READINESS.md`; the walk by directory descriptor is required before wiring.

+- `feat/carloku-multi-currency-20261001` `9574a798`: the price book and one stored currency per purchase end to end, the billing page as one form with a server-signed quote, ownership on every path, the refusal review keyed by its intent with the session recorded, the cookies, the demo. **Rounds ten to thirteen all ended with both reviewers accepting, each with P3 fixes**, applied in the next commit each time with distinguishing tests and killed mutants (dispositions "Review ten" to "Review thirteen"; nothing in a money path since round nine; the latest: a bound session read back as nobody's is expired by its own id and reviewed, a subscription edited to a plan, band or quantity not sold is the review rather than a 503 retry, a retired intent's events are settled). Gate and CI passed through `142293c5`; gate on `9574a798` running at 07:25, CI pending; the fourteenth review is reading the fixes.

+- `feat/carloku-metered-replicator-20261001` `c8e5e47b`: twelfth build. Reviews ten and eleven (Opus accept with fixes, Astra reject on the deep items) each found the previous build's own addition wanting (the exec-claim check too weak; then the ranked claim kinds not ordered and the link skip too broad); the twelfth build runs every check a file's claims imply, names links with their targets, counts a hibernating unit's file, and treats root and the platform's user as one owner, with killed mutants for each. Gate and CI passed on `56031316`; CI passed on `c8e5e47b`, its gate running; twelfth review running. The deep items stay open and are listed in `READINESS.md`; the walk by directory descriptor and a decision on whether one tenant's unaccepted links refuse the whole box are required before wiring.

- `feat/carloku-storage-sole-holder-20261001` `eaf6e63e`: round 9 both accept; CI passed; needs approval K and a cutover date.

- `fix/carloku-observe-routes-cleanup-20261001` `023e106c`: both accept; CI passed; merged into this branch at `47c97fa6`; the gate on the launch tip `b953fae4` passed (exit 0, three cross builds).

- `feat/carloku-billing-layout-20261001` `c1ae91a0`: merged into the currency branch; its two-form page was replaced by one form.

- `feat/carloku-late-request-fencing-20261001` `1b61de82`, `feat/carloku-bucket-hour-evidence-20261001` `0aa1fbec`: unchanged (rejected / needs approval J).

-- Site `feat/paid-pricing-20260916` (GitHub) `3f1610d`: every amount from the platform's export; country band wiring; exact rates; honest link parameters, static links included; a draft book cannot be published by `check` or `build`; the price-book test named for what it checks (18 tests pass: `node --test test/*.test.mjs`).

+- Site `feat/paid-pricing-20260916` (GitHub) `5be6b41`: every amount from the platform's export; country band wiring; exact rates; honest link parameters, static links included; a draft book cannot be published by `check` or `build`; `bands.p3` carries the approved currency explanation; every priced element's static text must be its own USD value (18 tests pass: `node --test test/*.test.mjs`).

**NEEDED:**

- Paul, commercial: approve the 36 amounts as an `approved` book version (approval L) together with the USD/GBP overage rates and floors in `OVERAGE-RATES-PROPOSAL.md`, or state other figures; the HALF code word; the proration policy (B); the partial-month rule (C).

- Paul, copy: the console billing page's 40 strings; the store-refusal copy (`OUTSTANDING.md` 19g). `bands.p3` is done: the approved currency explanation replaced the converted-euro sentence (site `e091e3f`, 07:0x); it now reads the same as the note under the currency selector.

- Paul, rulings: evidence for a held bucket-hour (J); storage on a bucket a store has left (K); the cutover note (M: purchases before the book stay legacy EUR; binary first, variables second).

- Scoped approvals, prepared as plans only: Stripe test mode (E) for the fence test and the rehearsal; Stripe live provisioning (F) after the approved book; the Cost and Usage Report export and the scratch-object write (G); Path B on a dev box (H).

-- Reviews to read when they land: the currency branch's twelfth (`logs/opus-currency-review12.md`, `astra-currency-review12.md`) and the replicator's tenth (`opus-replicator-review10.md` is in; `astra-replicator-review10.md` pending).

+- Reviews to read when they land: the currency branch's fourteenth (`logs/opus-currency-review14.md`, `astra-currency-review14.md`) and the replicator's twelfth (`opus-replicator-review12.md`, `astra-replicator-review12.md`).

**STILL TO BUILD (code, not approvals; no fake completes these):** quantity reduction at renewal (`OUTSTANDING.md` 14), the Free tier (15), dormancy and pool accounting (16), per-line tax codes across a change (17), the operator doors (18, plus the quantity-history gap door and a rejected-events listing), the meters' own code (replicator unwired with deep items open; store transfer has no source), the two key-memory defects (7, 9). `READINESS.md` has the list with what each means. The tests on the currency branch establish the subscription and currency path against fakes, nothing beyond it.

**RECOMMENDED:**

-- Read the twelfth currency review. If it confirms round eleven's fixes (both accepted rounds ten and eleven with fixes; the fixes are in `25487506` and `781bb1c2`) and CI is green on the tip, merge the currency branch into this branch: a merge commit pushed to this branch, as the observe-routes fix was at `47c97fa6` (`amadan branch merge` lands a branch on main and is not what this step is), then gate the merged tip. If it does not confirm, the next commit answers it the same way. Rule on K to let the storage branch follow.

+- Read the fourteenth currency review. If it confirms round thirteen's fixes (both accepted rounds ten to thirteen with fixes; each round's fixes are in the next commit, the latest `9574a798`) and CI is green on the tip, merge the currency branch into this branch: a merge commit pushed to this branch, as the observe-routes fix was at `47c97fa6` (`amadan branch merge` lands a branch on main and is not what this step is), then gate the merged tip. If it does not confirm, the next commit answers it the same way. Rule on K to let the storage branch follow.

- Publish the approved book version as soon as L is given; it is a new entry in `internal/plans/pricebook.json`, the export regenerated and copied to the site, and the 36 lookup keys renamed.

- Test-mode rehearsal (E) before anything live: the list in both reviews and in `ENABLEMENT.md` section 6.

- Then, each on its own branch: quantity reduction at renewal, the evidence door for a box's first minutes, the AWS principal inventory and the bucket ownership attestation door, Free-tier enforcement, dormancy and pool accounting.

**SESSION:**

-Running at 06:45: the gate on the currency tip `781bb1c2`, the two twelfth-round currency reviews, Astra's tenth replicator review (detached `setsid` processes; their output files are named in `READINESS.md`). The demo (pid in `layout-review/demo-redesigned.log`'s process, stop marker `layout-review/demo-redesigned.stop`) and the pricing preview (`python3 -m http.server 38009`) keep serving.

+Running at 07:25: the gates on the currency tip `9574a798` and the replicator tip `c8e5e47b`, the two fourteenth-round currency reviews, the two twelfth replicator reviews (detached `setsid` processes; their output files are named in `READINESS.md`). The demo (pid in `layout-review/demo-redesigned.log`'s process, stop marker `layout-review/demo-redesigned.stop`) and the pricing preview (`python3 -m http.server 38009`) keep serving.

Scratch on the box: `~/.cache/tmp/claude-1001/{currency-wt,replicator-wt,fencing-wt,evidence-wt}` (git worktrees), the demo binaries, `/var/tmp/ck`, `~/.cache/carloku-gate`. The void gate logs are named `*VOID*`.

diff --git a/implementation/carloku-paid-launch/ENABLEMENT.md b/implementation/carloku-paid-launch/ENABLEMENT.md

index 8971fd6e5..b9355014c 100644

--- a/implementation/carloku-paid-launch/ENABLEMENT.md

+++ b/implementation/carloku-paid-launch/ENABLEMENT.md

@@ -199,9 +199,10 @@ Ready means: reviewed, tested, integrated code, and this plan with its

approvals granted. It does not mean payments switched on.

- Code: the currency branch at its tip is gated locally and pushed; its

- tenth and eleventh independent reviews (Opus and Astra) accepted it with

- fixes, the fixes are in `25487506` and `781bb1c2`, and the twelfth

- review of those is the one to read before any merge. The readiness checklist (`READINESS.md`) names

+ tenth to thirteenth independent reviews (Opus and Astra) accepted it

+ with fixes, each round's fixes are in the next commit (the latest

+ `9574a798`), and the fourteenth review of those is the one to read

+ before any merge. The readiness checklist (`READINESS.md`) names

every commit, gate log, review verdict and CI run.

- Not code: approvals A (remaining parts), B, E, F, L, M; the test-mode

rehearsal; the live provisioning; the first live proof.

diff --git a/implementation/carloku-paid-launch/READINESS.md b/implementation/carloku-paid-launch/READINESS.md

index 4e7b2d56d..389a85aba 100644

--- a/implementation/carloku-paid-launch/READINESS.md

+++ b/implementation/carloku-paid-launch/READINESS.md

@@ -14,17 +14,17 @@ Log files are under `/home/paulca/.local/share/carloku-paid-launch-20260930/logs

| --- | --- | --- | --- | --- | --- |

-| `feat/carloku-multi-currency-20261001` | `781bb1c2` (the eleventh review's findings, with the tenth and eleventh reviews' reports) | passed on every code tip through `28dc2629` (05:28Z, `gate-currency-28dc2629.txt`, exit 0, three cross builds, clean tree; `25487506`'s own run is kept as `gate-currency-25487506-ended-on-28dc2629-reports-added-during-run.txt`, not used as evidence); `781bb1c2`: started 05:41Z (`gate-currency-781bb1c2.txt`); the console package passed in full on the same tree before the commit. Void logs, not evidence: `gate-currency-a9304f16.txt`, `gate-currency-f269365a-VOID-dirty-tree.txt` | passed on every pushed tip through `28dc2629`; `781bb1c2` pending | Rounds 1 to 9, each Opus accept with fixes and Astra reject, each round's findings fixed in the next commit with distinguishing tests and mutation checks (dispositions, one section per round). **Rounds 10 (at `faf1bd25`) and 11 (at `25487506`): both accept with fixes**, each round's P3s fixed in the next commit (round 10: reconcile's purchase judgement, a session naming two accounts; round 11: the bound session read back as nobody's now files the intent-keyed review instead of wedging the intent, a subscription that is not the intent's purchase files it too, an expiry's answer must name the account), nothing in a money path. Round 12 at `781bb1c2`: running | integrated end to end; not merged; the merge waits on round 12 confirming the fixes and CI on the tip |

+| `feat/carloku-multi-currency-20261001` | `9574a798` (the thirteenth review's findings, with reviews ten to thirteen's reports) | passed on every code tip through `142293c5` (06:05Z, `gate-currency-142293c5.txt`, exit 0, three cross builds, clean tree); `9574a798`: started 06:20Z (`gate-currency-9574a798.txt`); the console package passed in full on the same tree before the commit. Void or superseded logs, not evidence: `gate-currency-a9304f16.txt`, `gate-currency-f269365a-VOID-dirty-tree.txt`, `gate-currency-25487506-ended-on-28dc2629-reports-added-during-run.txt` | passed on every pushed tip through `142293c5`; `9574a798` pending | Rounds 1 to 9, each Opus accept with fixes and Astra reject, each round's findings fixed in the next commit with distinguishing tests and mutation checks (dispositions, one section per round). **Rounds 10 to 13 (at `faf1bd25`, `25487506`, `781bb1c2`, `142293c5`): both accept with fixes**, each round's P3s fixed in the next commit (round 12: the bound session read back as nobody's is expired by its own id and reviewed; round 13: a subscription edited to a plan, band or quantity not sold is the review, not a 503 retry; a hand-made subscription's open session is expired before the review names it; a retired intent's events are settled). Nothing in a money path since round 9. Round 14 at `9574a798`: running | integrated end to end; not merged; the merge waits on round 14 confirming the fixes and CI on the tip |

-| `feat/carloku-metered-replicator-20261001` | `9301ed62` (tenth build, with the eighth and ninth reviews' reports) | passed on every code tip through `9301ed62` (05:32Z, `gate-replicator-9301ed62.txt`, exit 0, three cross builds); the ops package passes under `/tmp`, `~/.cache`, `umask 077` and the race detector | passed on every pushed tip through `9301ed62` | 4 to 7: each Opus accept with fixes, Astra reject; 8 at `b5aecf13`: both reject on one P1 the eighth build's own fix had made (fixed in the ninth build with two tests and four killed mutants); 9 at `142ef5d0`: Opus accept with fixes (one P2: `Close` took no last look at the files), Astra reject (the deep items); the tenth build fixes the P2, inventories exec claims outside the globs and reports a hibernating route over a unit claim, with five killed mutants (dispositions "Review nine"); 10 at `9301ed62`: Opus in, Astra pending at 06:45. The deep items stay open and are listed there: litestream's own opens by path (every reopen), protected endpoints under tenant-replaceable ancestry, requests tracked to completion across midnight and a crash, a walk by directory descriptor (required before wiring), a tenant sharing the platform's uid or root-run units, one tenant's deletion holding every account's days (a stated availability cost) | not merged; unwired side work gated on approval H |

+| `feat/carloku-metered-replicator-20261001` | `c8e5e47b` (twelfth build, with reviews eight to eleven's reports) | passed on every code tip through `56031316` (05:53Z, `gate-replicator-56031316.txt`, exit 0, three cross builds); `c8e5e47b`: started 06:15Z (`gate-replicator-c8e5e47b.txt`); the ops package passes under `/tmp`, `~/.cache`, `umask 077` and the race detector | passed on every pushed tip through `c8e5e47b` | 4 to 7: each Opus accept with fixes, Astra reject; 8: both reject on one P1 the eighth build made (fixed in the ninth); 9: Opus accept with fixes (P2: `Close` took no last look at the files), Astra reject; 10: Opus accept with fixes, Astra reject, both on the tenth build's own exec-claim check (fixed in the eleventh); 11 at `56031316`: Opus accept with fixes, Astra reject, both on the eleventh build's ranked claim kinds and link skip (fixed in the twelfth: every claim's check must pass, links named with their targets, a hibernating unit's file counted, root and the platform's user one owner); 12 at `c8e5e47b`: running. Each build's dispositions section lists its killed mutants. The deep items stay open and are listed there: litestream's own opens by path (every reopen), protected endpoints under tenant-replaceable ancestry, a delayed admitted request past the margin, requests across a crash or restart, a walk by directory descriptor (required before wiring), a tenant sharing the platform's uid or root-run units and a route naming another user's coherent tree (approval H), whether one tenant's unaccepted links refuse the whole box (a decision before wiring), one tenant's deletion holding every account's days once (a stated cost) | not merged; unwired side work gated on approval H |

| `feat/carloku-paid-launch-20260916` (launch) | this commit: documents only on top of `3d47602b`; last code change the merge of the observe-routes fix (`47c97fa6`) | passed 03:06Z on `b953fae4` (`gate-launch-b953fae4.txt`, exit 0, three cross builds); every commit since is documents | passed on `3d47602b` | 17 rounds, no whole-branch pass | the integration target; first accepted side branch merged |

-| site `feat/paid-pricing-20260916` (GitHub) | `3f1610d` (a test renamed for what it checks, after review ten) | `node --test test/*.test.mjs`: 18 pass (05:18Z) | n/a | read-only by the currency reviews (section K); rounds four, five and ten's site findings fixed in `4feb1cd`, `9427c22`, `3f1610d` | preview served at `http://100.119.180.57:38009`, rebuilt from `4feb1cd` (the later changes are the build script and a test name alone) |

+| site `feat/paid-pricing-20260916` (GitHub) | `5be6b41` (`bands.p3` replaced by the approved explanation at `e091e3f`; the price test made exact per slot after reviews twelve and thirteen) | `node --test test/*.test.mjs`: 18 pass (06:17Z) | n/a | read-only by the currency reviews (section K); rounds four, five, ten, twelve and thirteen's site findings fixed | preview served at `http://100.119.180.57:38009` from the tree (rebuilt 07:0x with the `bands.p3` change) |

## The flow, behaviour the tests establish (2026-10-02)

-These are what the automated tests assert on `781bb1c2`, against fakes of Keymail and Stripe; none of it is proven against the real provider; the tenth and eleventh independent reviews accepted the code with fixes (applied in `25487506` and `781bb1c2`) and the twelfth is reading them. Tests: (`internal/console`: `TestBillingFormPostsWhatItShows`,

+These are what the automated tests assert on `9574a798`, against fakes of Keymail and Stripe; none of it is proven against the real provider; the tenth to thirteenth independent reviews accepted the code with fixes (applied in `25487506`, `781bb1c2`, `142293c5` and `9574a798`) and the fourteenth is reading them. Tests: (`internal/console`: `TestBillingFormPostsWhatItShows`,

`TestBillingPageCurrencyControls`, `TestPricingLinkSurvivesSignIn`,

`TestCurrencySuggestionCookie`, `TestCountrySuggestionCookie`,

`TestBillingInclusionsFollowTheQuotedBand`,

@@ -61,11 +61,15 @@ reconcile, calculation, invoice and recovery tests in

same judgement of the session as the completion would, and records

nothing from a session the binder would review; a session naming two

accounts is nobody's on every path, and when it is the session an

- intent is bound to, the operator is told through the intent-keyed

- review rather than the intent wedging in silence; an expiry's answer

- must name the account before anything is retired. They hold at

- `781bb1c2` by the tests named.

-- Demo at `http://100.119.180.57:41881`: rebuilt 06:4x from `781bb1c2`

+ intent is bound to, it is expired by the id the console bound and the

+ operator is told through the intent-keyed review rather than the

+ intent wedging in silence; a first purchase's subscription that names

+ the bound intent and is refused for anything the console can judge

+ (price, currency, plan, band, quantity) is the same review, its open

+ session expired first; an expiry's answer must name the account before

+ anything is retired; a retired intent's later events are settled, not

+ retried. They hold at `9574a798` by the tests named.

+- Demo at `http://100.119.180.57:41881`: rebuilt 07:2x from `9574a798`

(binary `billing-redesigned.test`, started by the stop-marker procedure;

the EUR-only binary is kept as `billing-redesigned-eur-only.test.bak`),

serving with the price book configured: the whole path from the pricing

diff --git a/implementation/carloku-paid-launch/stripe-provisioning.md b/implementation/carloku-paid-launch/stripe-provisioning.md

index f99251ad7..85ad07c11 100644

--- a/implementation/carloku-paid-launch/stripe-provisioning.md

+++ b/implementation/carloku-paid-launch/stripe-provisioning.md

@@ -99,9 +99,11 @@ Twelve prices, exactly the `required_catalog` in `stripe-live-readiness.json`.

Every price has these fixed fields: `currency=eur`, `tax_behavior=exclusive`,

`billing_scheme=per_unit`, `recurring[interval]=year`,

`recurring[interval_count]=1`, `recurring[usage_type]=licensed`. No

-`currency_options` on any price beyond its own currency (the console refuses a price whose options name another currency; an entry under the price's own currency at its own amount passes, see ENABLEMENT.md section 2); the earlier text here said "it would switch off Adaptive Pricing, and the

-console refuses a price that has any). Never pass `payment_method_types`

-anywhere.

+`currency_options` on any price beyond its own currency: the console

+refuses a price whose options name another currency, and accepts an entry

+under the price's own currency at its own amount (`ENABLEMENT.md` section

+2; the earlier text here said the console refuses any option at all).

+Never pass `payment_method_types` anywhere.

The unit amount is per seat. Personal has quantity 1. Community and Business

use the member count as the subscription quantity, with a floor of 10.