amadan
Add the round four review brief
Round four covers the round three fixes and partial-month billing, which has had no independent review.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
1 file changed,
+32
−0
docs/superpowers/specs/CODEX-REVIEW-BRIEF-carloku-paid-launch-overnight-round4.md+32 −0
CI passed — run details
diff --git a/docs/superpowers/specs/CODEX-REVIEW-BRIEF-carloku-paid-launch-overnight-round4.md b/docs/superpowers/specs/CODEX-REVIEW-BRIEF-carloku-paid-launch-overnight-round4.md| new file mode 100644 |
| index 000000000..14c336855 |
| --- /dev/null |
| +++ b/docs/superpowers/specs/CODEX-REVIEW-BRIEF-carloku-paid-launch-overnight-round4.md |
| @@ -0,0 +1,32 @@ |
| +# Review brief, round 4: Carloku paid launch, overnight changes of 2026-10-01 |
| + |
| +Read the round 1 brief (`CODEX-REVIEW-BRIEF-carloku-paid-launch-overnight.md`) for the fixed rulings and the output rules, and the round 3 brief for rulings 6 and 7. Then read `CODEX-DISPOSITIONS-carloku-paid-launch-overnight.md`, whose last section covers round 3 (`CODEX-FINDINGS-...-round3.md` and `OPUS-REVIEW-...-round3.md`). |
| + |
| +Review the branch between `aed42815` and the commit named in the prompt. The changes since round 3 are `git diff e07f6475 <commit>`: `4abe94cb` (quantity worker), `c3913dd9` (partial-month billing and the other round 3 fixes) and one documents commit. |
| + |
| +One more ruling is fixed: |
| + |
| +8. Billing a month the paid plan covers only partly is required, not waived. The design is `docs/superpowers/plans/2026-10-01-partial-month-billing.md`: bill only the UTC days that lie wholly inside a paid span, against the allowance weighted over the paid spans, and keep completeness whole-month. Rounding toward the customer by the boundary days is intended. Whether that policy is right is not in question; whether the code does it, and nothing else, is. |
| + |
| +## First: a disposition table |
| + |
| +For every round 3 finding (Astra R1 to R5, Opus 1 to 8): closed, partly closed or not closed, with the file and line of the fix and of the test that reproduces the scenario, and whether that test would pass without the fix. The dispositions name a reproduction for each and say which were confirmed to fail with the fix disabled. Check those claims; do not take them. |
| + |
| +## Then: new findings only |
| + |
| +What changed since round 3, and where to push: |
| + |
| +- **Partial-month billing. It has had no independent review at all.** `internal/plans/month.go` (`AllowanceForMonth`, `CoveredInterval`, `Partial`), `internal/usage/statement.go` (`Days`), `internal/console/economicspass.go` (`usageSweep.PerAccountDay`, `addDay`, every place a meter is accumulated), `durabilityfold.go`, `storeegressfold.go`, `internal/console/billingcalculation.go` (`billingUsageOnPaidDays`, `CountedDays`, the arithmetic name), `billinginvoice.go`. Find a history of assignments (start mid-month, cancel, lapse, past_due, a quantity change, a plan change, a house flip, a paid-through that ends inside a span, two subscriptions in one month, a renewal on the first or last day) for which the month is billed for usage from an unpaid day, is billed against too small an allowance, bills a day twice, or is billed when it should hold. Find a meter whose days do not sum to its monthly total, a source that accumulates the month without the day, a time zone or day-boundary slip, and a float comparison that could flip. Check that a statement written before `Days` existed is held and not billed on its monthly total. Check that the frozen calculation reproduces: same statement, same history, same bytes. Check what a full month reads like now compared with before (it must be byte-identical in the frozen calculation). |
| +- `internal/console/billingquantity.go`: `beginQuantityOperation` is now a compare-and-set; `sendQuantityOperation` sends `proration_date` and checks the period end; `markQuantityAdditionsProcessed` acknowledges in the same transaction; `markOperationLanded`; `closeEndedQuantityAdditions` acknowledges; discovery includes unacknowledged operations; the key carries the creation instant. Find an interleaving, crash or clock that still double-charges, lowers a quantity, charges the wrong period, marks an addition the billed quantity does not cover, loses an addition, or leaves an operation outstanding forever. In particular: what the compare-and-set does not compare; whether `proration_date` at the operation's creation instant can be refused in a healthy case (clock skew against the provider, an operation created in the second a period starts) and what happens then; whether the fixed date makes a retry hours later charge a different amount than the customer should pay; whether `markOperationLanded` can mark additions the operation did not cover. |
| +- `internal/objstore/walk.go`: `GranteeProber`, completeness from the observation instant, the incomplete record written before a legacy teardown. Find a walk that still claims completeness for a name someone else can reach, and a teardown re-run that leaves the ledger wrong. |
| +- `internal/console/economicspass.go` `statementsPass` catch-up and `statementMonthState`: the window walk, gaps, unreadable statements, missing account statements, the process-lifetime memory of closed statements. Find a month that is never revisited, a month swept every pass forever at real cost, and a state the memory makes wrong. |
| +- `internal/console/durabilityfold.go`: spans compared to the hour. |
| + |
| +The dispositions list three things found and not fixed. Say whether any of them is wrongly left. |
| + |
| +## What to return |
| + |
| +1. The disposition table. |
| +2. New findings, most severe first, in the round 1 format. |
| +3. Handoff claims the code contradicts (`implementation/carloku-paid-launch/AGENT_HANDOFF.md`). |
| +4. A one-line verdict: accept, accept with fixes, or reject. |