amadan
Readiness and handoff at 17:02: round nineteen answered as one evidence invariant in 43d326b5; gate and round twenty running; the P2 stays open
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
2 files changed,
+5
−5
.claude/HANDOFF.md+4 −4implementation/carloku-paid-launch/READINESS.md+1 −1
CI passed — run details
diff --git a/.claude/HANDOFF.md b/.claude/HANDOFF.md| index caf3368fa..0434f118a 100644 |
| --- a/.claude/HANDOFF.md |
| +++ b/.claude/HANDOFF.md |
| @@ -7,7 +7,7 @@ |
| Get Carloku's paid plans live with Stripe Tax and the complete metered model; have the pricing page and signup flow reviewable in the morning. |
| **STATUS:** |
| -Written 16:43 Dublin on 2026-10-02 (resumed at 16:40 after a provider limit; nothing was lost), during the second overnight run (brief: "continue overnight until we're ready to enable payments"; ready means reviewed, tested, integrated code and a scoped enablement plan, not payments switched on). Billing is OFF everywhere. No live Stripe write, no AWS change, no charge, no merge to main. Every payment anyone can see is a labelled simulation. |
| +Written 17:02 Dublin on 2026-10-02 (resumed at 16:40 after a provider limit; nothing was lost), during the second overnight run (brief: "continue overnight until we're ready to enable payments"; ready means reviewed, tested, integrated code and a scoped enablement plan, not payments switched on). Billing is OFF everywhere. No live Stripe write, no AWS change, no charge, no merge to main. Every payment anyone can see is a labelled simulation. |
| Review servers, all answering 200: pricing page `http://100.119.180.57:38009` (static, rebuilt from site `2fc6388`), signup and billing demo `http://100.119.180.57:41881` (**still the build from `68f6ee23`**, before the retirement protocol; not the code under review, and not Stripe proof; price book configured, USD/EUR/GBP end to end; Keymail and Stripe simulated), console billing copy `http://100.119.180.57:45033` if still up. |
| @@ -16,7 +16,7 @@ The durable records are on this branch under `implementation/carloku-paid-launch |
| Decisions received 2026-10-01 evening, applied: the annual bases (28/24/22, 6/5/4.50, 60/50/45 USD/EUR/GBP, team minimum ten) confirmed for implementation only; the currency rulings (USD default, EUR for EU member states, GBP for the UK, visible override, one stored currency for subscription and overages, bands by billing country only); the five currency strings and the regrouped pricing page copy, approved verbatim and applied. Still a draft: the book `2026-10-01-draft1` and the USD/GBP overage rates and floors. |
| Branches (all on the forge, none merged; the local gate is not CI): |
| -- `feat/carloku-multi-currency-20261001` `59666bab`: the price book and one stored currency per purchase end to end, the billing page as one form with a server-signed quote, ownership on every path, the refusal review keyed by its intent with the session recorded, the cookies, the demo. Rounds ten to thirteen ended with both reviewers accepting with P3 fixes; **round fourteen did not: Astra found a P2** (a first purchase's record and its intent's retirement were two transactions under no common lock, so a reconciliation paused on the provider read while the operator resolved the review recorded the retired purchase). Fixed in `abd1b76e`: the record consumes the exact standing intent in its own transaction, and the same lifecycle holds on every path (an intent under an open review is never retired by an expiry; a retired intent's completion and subscription events are settled, not retried; a refusal whose session read came back as another session files nothing), with tests that fail without each fix and six killed mutants (dispositions "Review fourteen"). Round fifteen (both accept with fixes) found the last exception to that lifecycle, a purchase corrected at the provider recording under its open review; `3527a066` closes it by the ruling: nothing records on an intent under an open review, and the operator's resolution retires the intent (default) or keeps it (`outcome: keep`) for the corrected purchase to record; a retired intent's events settle whatever intent stands. Round sixteen (both accept with fixes) tightened the new `keep` outcome: it is accepted only for an intent whose bound session reads back complete with a subscription (anything else would later expire unrecorded), and the outcome is written, replay-compared and audited; `db130cfc` carries those fixes, the operator's rejected-events listing (`GET /api/billing/rejected`, named missing by both reviewers since round eleven) and the provisioning script's currency-option notes aligned with the code. Round seventeen did not confirm either: Opus accepted with four P3s on the `keep` door and the rejected listing; **Astra found a P2 in the refusal's own order**: both sites that expire a bound session expired first and filed the review second, so a pass that read the expired session in between, or a crash between the two, retired the intent with no record. `68f6ee23` files the review first at both sites (a two-path race test runs the store's retirement inside the fake's expiry and wants the conflict; it fails with either order put back), closes the four P3s, adds two tests (an older resolutions table migrates with `retire`; the listing's 200-row bound, newest first, the account on each row) and corrects the comments and the design sentence both reviewers named. Gate and CI passed on `68f6ee23`. **Round eighteen did not confirm**: both reviewers found that with the review filed first, an operator's `retire` can delete the intent while its bound session is still open and payable (the expiry failed; nothing retries it; the resume path still offers the URL). Per the 10:20 supervision this is not fixed by moving calls again: a durable retirement protocol is designed instead (`docs/superpowers/specs/2026-10-02-intent-retirement-protocol-design.md`: the refusal recorded and authoritative; the session's fate proven from provider evidence and recorded on the intent, with a dispute state; the expiry requested under one fixed key by reader, pass and operator; the operator's completion atomic, `retire` only on a proven expiry, a paid session `settled` by a separate disposition or `keep`; the click offers no URL). Astra rejected revisions 1, 2 and 3; revision 4 applies the third review's conservative holds and **stage one is built** in `59666bab` (`internal/console/billingretirement.go`, eight tests, eleven reworked, seventeen mutants killed): `retire` only on a session proven expired and unpaid with nothing attached; `keep` only for a completed, paid session with nothing attached but its own subscription; everything else held (a paid session not kept, a hand-made subscription's case, a contradicted case, every review from before the build). `59666bab` gate exit 0 with three cross builds, CI passed. **Round nineteen did not accept it** (Opus accept with fixes, one P2; Astra reject, three P2s): evidence was recorded at some call sites and not others, and a refusal and its subscription were two transactions. The answer is one invariant (every provider observation classified and recorded in one store transaction against the purchase as it stands; a refusal and its subscription one transaction; nothing dropped), with crash and interleaving counterexample tests; it is in the currency worktree, **uncommitted at 16:43** (backup `notes/currency-uncommitted-20261002-1440.patch` plus later edits), with its mutants and full run in progress. **Review eighteen's P2 stays open and blocks the merge.** These findings were not minor: each round since ten found a real gap in the lifecycle of an intent under review; the last three rounds converged on the operator's door rather than the money path. |
| +- `feat/carloku-multi-currency-20261001` `43d326b5`: the price book and one stored currency per purchase end to end, the billing page as one form with a server-signed quote, ownership on every path, the refusal review keyed by its intent with the session recorded, the cookies, the demo. Rounds ten to thirteen ended with both reviewers accepting with P3 fixes; **round fourteen did not: Astra found a P2** (a first purchase's record and its intent's retirement were two transactions under no common lock, so a reconciliation paused on the provider read while the operator resolved the review recorded the retired purchase). Fixed in `abd1b76e`: the record consumes the exact standing intent in its own transaction, and the same lifecycle holds on every path (an intent under an open review is never retired by an expiry; a retired intent's completion and subscription events are settled, not retried; a refusal whose session read came back as another session files nothing), with tests that fail without each fix and six killed mutants (dispositions "Review fourteen"). Round fifteen (both accept with fixes) found the last exception to that lifecycle, a purchase corrected at the provider recording under its open review; `3527a066` closes it by the ruling: nothing records on an intent under an open review, and the operator's resolution retires the intent (default) or keeps it (`outcome: keep`) for the corrected purchase to record; a retired intent's events settle whatever intent stands. Round sixteen (both accept with fixes) tightened the new `keep` outcome: it is accepted only for an intent whose bound session reads back complete with a subscription (anything else would later expire unrecorded), and the outcome is written, replay-compared and audited; `db130cfc` carries those fixes, the operator's rejected-events listing (`GET /api/billing/rejected`, named missing by both reviewers since round eleven) and the provisioning script's currency-option notes aligned with the code. Round seventeen did not confirm either: Opus accepted with four P3s on the `keep` door and the rejected listing; **Astra found a P2 in the refusal's own order**: both sites that expire a bound session expired first and filed the review second, so a pass that read the expired session in between, or a crash between the two, retired the intent with no record. `68f6ee23` files the review first at both sites (a two-path race test runs the store's retirement inside the fake's expiry and wants the conflict; it fails with either order put back), closes the four P3s, adds two tests (an older resolutions table migrates with `retire`; the listing's 200-row bound, newest first, the account on each row) and corrects the comments and the design sentence both reviewers named. Gate and CI passed on `68f6ee23`. **Round eighteen did not confirm**: both reviewers found that with the review filed first, an operator's `retire` can delete the intent while its bound session is still open and payable (the expiry failed; nothing retries it; the resume path still offers the URL). Per the 10:20 supervision this is not fixed by moving calls again: a durable retirement protocol is designed instead (`docs/superpowers/specs/2026-10-02-intent-retirement-protocol-design.md`: the refusal recorded and authoritative; the session's fate proven from provider evidence and recorded on the intent, with a dispute state; the expiry requested under one fixed key by reader, pass and operator; the operator's completion atomic, `retire` only on a proven expiry, a paid session `settled` by a separate disposition or `keep`; the click offers no URL). Astra rejected revisions 1, 2 and 3; revision 4 applies the third review's conservative holds and **stage one is built** in `59666bab` (`internal/console/billingretirement.go`, eight tests, eleven reworked, seventeen mutants killed): `retire` only on a session proven expired and unpaid with nothing attached; `keep` only for a completed, paid session with nothing attached but its own subscription; everything else held (a paid session not kept, a hand-made subscription's case, a contradicted case, every review from before the build). `59666bab` gate exit 0 with three cross builds, CI passed. **Round nineteen did not accept it** (Opus accept with fixes, one P2; Astra reject, three P2s): evidence was recorded at some call sites and not others, and a refusal and its subscription were two transactions. The answer is one invariant (every provider observation classified and recorded in one store transaction against the purchase as it stands; a refusal and its subscription one transaction; nothing dropped), with crash and interleaving counterexample tests; it is committed as `43d326b5` (seven counterexample tests, four reworked, twenty mutants killed; the full console run passed before the commit); its gate and round twenty (Opus and Astra) are running. **Review eighteen's P2 stays open and blocks the merge.** These findings were not minor: each round since ten found a real gap in the lifecycle of an intent under review; the last three rounds converged on the operator's door rather than the money path. |
| - `feat/carloku-metered-replicator-20261001` `6249af63`: eighteenth build. Reviews ten to fourteen (Opus accept with fixes, Astra reject) each found the previous build's own addition wanting; the fourteenth build made the link entry one to one and the fifteenth quotes every entry in the inventory's rendering (the drift key), classifies a link by the spelling its entry names, and makes the Accept test tell as-written from cleaned. Review fifteen (Opus accept with fixes, Astra reject on the deep items) found a regression the fifteenth build made: a relative link target was joined and so cleaned, which is not how the kernel resolves a `..` after a link, so a link to a directory outside the tree passed in silence; the sixteenth build concatenates uncleaned, with the fixture both asked for. Review sixteen (both) found that fixed and one bound left (the concatenated spelling could outgrow PATH_MAX); the seventeenth build `bffc76b5` stat'ed the target by itself against the link's directory, and **failed the gate and CI on its own fixture** (sized for a long temp root only), which review seventeen (Opus accept with fixes, Astra reject) had worked out, together with a worse defect in the same fix: the directory was opened by path with Go's default flags, so a FIFO a tenant swaps in would block the watch and Close. The eighteenth build (`e8211fc6`, `6249af63`) opens the directory as a directory and nothing else, sizes the fixture from the temp root, compares the rendering across sections, and corrects the comments, the test name and the outstanding item Astra listed; three mutants killed. Gate (exit 0, three cross builds) and CI passed on `6249af63`. Review eighteen: Opus accept with three P3s, Astra reject on the deep items. The nineteenth build `53e3dcd8` answered them (gate exit 0, three cross builds; CI passed). Review nineteen: Opus accept, Astra reject on the deep items. The twentieth build `c9ec11eb` makes the bounded changes (a tree claim refuses what a file claim refuses; the fixture's guard reachable; the no-recorder refusal quoted) and separates them in its dispositions from the deferred items; `c9ec11eb`: gate exit 0 with three cross builds (09:52Z), CI passed. Review twenty: Opus accept with fixes, Astra reject on the deep items. `e1280811` answers it with comments, a fixture and dispositions only (no behaviour change; gate running; not sent for another round): the two refusals Opus named as widening what stops a whole box are listed as decisions (11 and 12 in the decisions file), not made as changes. The deep items stay open and are listed in `READINESS.md`; none is minor, and the branch cannot be wired until they are closed or decided (the walk by directory descriptor, litestream's opens by path, durable transition state, the uid binding under approval H, the box-wide refusal decision). |
| - `feat/carloku-storage-sole-holder-20261001` `eaf6e63e`: round 9 both accept; CI passed; needs approval K and a cutover date. |
| - `fix/carloku-observe-routes-cleanup-20261001` `023e106c`: both accept; CI passed; merged into this branch at `47c97fa6`; the gate on the launch tip `b953fae4` passed (exit 0, three cross builds). |
| @@ -30,7 +30,7 @@ Branches (all on the forge, none merged; the local gate is not CI): |
| - Paul, copy: the console billing page's 40 strings; the store-refusal copy (`OUTSTANDING.md` 19g). `bands.p3` is done: the approved currency explanation replaced the converted-euro sentence (site `e091e3f`, 07:0x); it now reads the same as the note under the currency selector. |
| - Paul, rulings: evidence for a held bucket-hour (J); storage on a bucket a store has left (K); the cutover note (M: purchases before the book stay legacy EUR; binary first, variables second). |
| - Scoped approvals, prepared as plans only: Stripe test mode (E) for the fence test and the rehearsal; Stripe live provisioning (F) after the approved book; the Cost and Usage Report export and the scratch-object write (G); Path B on a dev box (H). |
| -- Reviews to read when they land: the currency branch's nineteenth, on stage one of the retirement protocol (`logs/opus-currency-review19.md`, `astra-currency-review19.md`); the flush-only class's second (`opus-flush-review2.md`, `astra-flush-review2.md`). |
| +- Reviews to read when they land: the currency branch's twentieth, on the evidence invariant (`logs/opus-currency-review20.md`, `astra-currency-review20.md`). |
| - Branch `feat/carloku-flush-only-class-20261002` `5f43a0e4` (gate and CI green; second review: both accept with fixes, fixed here, unread). It does not implement the Free plan's durability: its first review showed the class's durability contract is itself a decision (10a in the decisions file): against the vendored litestream "wake and sleep only" is not what a long interval gives. Nothing of the options is built; the class is a word the column may hold, withdrawn from offer. The inherited `Replicator.Close` defect the review found is forge discussion 200, not fixed. |
| - Paul, rulings for the retirement design (five, its last section): may money ever be accepted without the purchase recording (the design says no); how contradictory provider evidence is adjudicated; the buyer's copy under review; the settlement predicate for a paid refused purchase; whether a never-bound session may be kept. Rulings for quantity reduction at renewal (`feat/carloku-quantity-reduction-20261002`, design rejected by Astra on four P1s; its last section): a member replaced before the renewal (window, schedule or immediate); a missed reduction's remedy; reductions behind both switches. |
| @@ -43,6 +43,6 @@ Branches (all on the forge, none merged; the local gate is not CI): |
| - Then, each on its own branch: quantity reduction at renewal, the evidence door for a box's first minutes, the AWS principal inventory and the bucket ownership attestation door, Free-tier enforcement, dormancy and pool accounting. |
| **SESSION:** |
| -Running at 16:43: the full console, plans and billingstripe run on the uncommitted currency tree (`logs/currency-stage1-run3.txt`). No reviewer and no gate is running. |
| +Running at 17:02: the gate on the currency tip `43d326b5` (`logs/gate-currency-43d326b5.txt`) and round twenty on it (`logs/opus-currency-review20.md`, `astra-currency-review20.md`). Detached `setsid` processes. |
| Scratch on the box: `~/.cache/tmp/claude-1001/{currency-wt,replicator-wt,fencing-wt,evidence-wt}` (git worktrees), the demo binaries, `/var/tmp/ck`, `~/.cache/carloku-gate`. The void gate logs are named `*VOID*`. |
diff --git a/implementation/carloku-paid-launch/READINESS.md b/implementation/carloku-paid-launch/READINESS.md| index 2193a2a42..ddaa67c20 100644 |
| --- a/implementation/carloku-paid-launch/READINESS.md |
| +++ b/implementation/carloku-paid-launch/READINESS.md |
| @@ -14,7 +14,7 @@ Log files are under `/home/paulca/.local/share/carloku-paid-launch-20260930/logs |
| | Branch | Tip | Gate | CI | Reviews | State | |
| | --- | --- | --- | --- | --- | --- | |
| -| `feat/carloku-multi-currency-20261001` | `59666bab` (stage one of the retirement protocol, built; before it `15041ca2`: round eighteen's bounded findings fixed; round eighteen's and the three design reviews' reports in the tree) (`68f6ee23`: the seventeenth review's findings: the review filed before the expiry on both paths, the `keep` door's replay, nil billing and purchase check, the rejected listing's account, order and bound, two new tests; reviews ten to seventeen's reports in the tree) | passed on every code tip through `db130cfc` (`gate-currency-db130cfc.txt`, exit 0, three cross builds, clean tree); `68f6ee23`: passed (09:17Z, `gate-currency-68f6ee23.txt`, exit 0, three cross builds, clean tree); the console, plans and billingstripe packages passed in full on the same tree before the commit (console 525 s). `15041ca2`: passed (10:06Z, `gate-currency-15041ca2.txt`, exit 0, three cross builds); `59666bab`: passed (13:20Z, `gate-currency-59666bab.txt`, exit 0, three cross builds). Void or superseded logs, not evidence: `gate-currency-a9304f16.txt`, `gate-currency-f269365a-VOID-dirty-tree.txt`, `gate-currency-25487506-ended-on-28dc2629-reports-added-during-run.txt`, `gate-currency-db130cfc-VOID-dirty-tree-second-run.txt` (started by mistake on staged, uncommitted changes and stopped) | passed on every pushed tip through `59666bab` | Rounds 1 to 9: Opus accept with fixes, Astra reject. Rounds 10 to 13: both accept with fixes (P3s). Round 14: Astra reject on a P2 (a reconciliation paused on the provider read while the operator resolved the review recorded the retired purchase), fixed in `abd1b76e`. Rounds 15 and 16: both accept with fixes, each closing what the previous fix left open in the intent's lifecycle (15: nothing records under an open review, the resolution retires or keeps; 16: `keep` only for an intent whose bound session is complete with a subscription, the outcome written, replay-compared and audited). Each fix has a test that fails without it and a killed mutant (dispositions, one section per round). Round 17 at `db130cfc`: Opus accept with fixes (four P3s on the `keep` door and the rejected listing), Astra reject on a P2: both sites that expire a bound session expired first and filed the review second, so a pass reading the expired session in between, or a crash between the two, retired the intent with no record; fixed in `68f6ee23` by filing first (a two-path race test runs the store's retirement inside the fake's expiry and wants the conflict; it fails with either site's order put back), with the P3s, two new tests (an older resolutions table migrates with `retire`; the listing's 200-row bound, newest first, account on each row) and the comments and design sentence both named. The first form of the listing's account fix looked the account up under open rows and deadlocked the store's one connection in the test; rows are read to the end first. Round 18 at `68f6ee23`: Opus accept with fixes, Astra reject, on the same P2: with the review now filed before the expiry, an operator's `retire` can delete the intent while its bound session is still open and payable (the expiry failed; nothing retries it; the resume path still offers the URL). The supervisor ruled that this is not fixed by moving calls again but by a durable protocol (recorded refusal authoritative; the session's fate proven from provider evidence and recorded; atomic operator completion; a paid session settled by a separate disposition) with one bounded design review before another implementation cycle. Revision 1 of that design (`8c72e88b`) was rejected by Astra (four P2s), and revision 2 (`b4ff6b72`) too (five P2s: the hand-made subscription's own obligations at `retire`; the settlement predicate; observation times against cached answers; which evidence a dispute's resolution makes authoritative; the migration barrier). Revision 3 (`15041ca2`) was rejected a third time (four P2s, each with a conservative hold as its smallest change); revision 4 applies those holds and is built as **stage one** in `59666bab` (`billingretirement.go`): the operator's `retire` is accepted only for a session proven expired and unpaid by a provider read with nothing attached and nothing contradictory; `keep` only for a completed, paid session with no subscription attached but its own; a paid session that is not kept, any case a hand-made subscription touched, any contradicted case and every review from before the build are held; the door requests the expiry and answers 503 while it is unproven; the pass retries on a schedule; a click under review gets no URL; contradictions are disputes; a delete barrier stops an older binary. Eight tests, one per interleaving; eleven existing tests reworked; seventeen mutants killed. **Round nineteen did not accept it**: Opus accept with fixes (one P2, six P3s), Astra reject (three P2s): a subscription on the purchase's own terms was never attached, so `keep` could release the review beside it; the refusal and its subscription were two transactions; the keep gate's fresh read was not recorded as evidence; contradictions arriving after a retirement or a kept purchase's record, or read by an actor with a stale view, were dropped. These are being answered as one invariant (every provider observation classified and recorded in one store transaction against the purchase as it stands; nothing dropped), uncommitted at the time of this record. **Review eighteen's P2 stays open and blocks the merge.** The bounded findings of round eighteen are fixed there with tests and four killed mutants (attribution of a retired session's completion beside a replacement; a `keep` decided during the gate answered by the replay comparison; the nil-billing and tie-break tests). The findings since round ten were not minor: each was a real gap in the lifecycle of an intent under review, and the rounds have converged on the operator's door rather than the money path | integrated end to end; not merged; the merge waits on a round ending with both accepting and nothing left to fix, and CI on the tip | |
| +| `feat/carloku-multi-currency-20261001` | `43d326b5` (round nineteen answered as one evidence invariant; before it `59666bab`, stage one of the retirement protocol; before it `15041ca2`: round eighteen's bounded findings fixed; round eighteen's and the three design reviews' reports in the tree) (`68f6ee23`: the seventeenth review's findings: the review filed before the expiry on both paths, the `keep` door's replay, nil billing and purchase check, the rejected listing's account, order and bound, two new tests; reviews ten to seventeen's reports in the tree) | passed on every code tip through `db130cfc` (`gate-currency-db130cfc.txt`, exit 0, three cross builds, clean tree); `68f6ee23`: passed (09:17Z, `gate-currency-68f6ee23.txt`, exit 0, three cross builds, clean tree); the console, plans and billingstripe packages passed in full on the same tree before the commit (console 525 s). `15041ca2`: passed (10:06Z, `gate-currency-15041ca2.txt`, exit 0, three cross builds); `59666bab`: passed (13:20Z, `gate-currency-59666bab.txt`, exit 0, three cross builds); `43d326b5`: started 17:02 Dublin (`gate-currency-43d326b5.txt`); the console, plans and billingstripe packages passed in full on the same tree before the commit (console 596 s, `currency-stage1-run3.txt`). Void or superseded logs, not evidence: `gate-currency-a9304f16.txt`, `gate-currency-f269365a-VOID-dirty-tree.txt`, `gate-currency-25487506-ended-on-28dc2629-reports-added-during-run.txt`, `gate-currency-db130cfc-VOID-dirty-tree-second-run.txt` (started by mistake on staged, uncommitted changes and stopped) | passed on every pushed tip through `59666bab`; `43d326b5` pending | Rounds 1 to 9: Opus accept with fixes, Astra reject. Rounds 10 to 13: both accept with fixes (P3s). Round 14: Astra reject on a P2 (a reconciliation paused on the provider read while the operator resolved the review recorded the retired purchase), fixed in `abd1b76e`. Rounds 15 and 16: both accept with fixes, each closing what the previous fix left open in the intent's lifecycle (15: nothing records under an open review, the resolution retires or keeps; 16: `keep` only for an intent whose bound session is complete with a subscription, the outcome written, replay-compared and audited). Each fix has a test that fails without it and a killed mutant (dispositions, one section per round). Round 17 at `db130cfc`: Opus accept with fixes (four P3s on the `keep` door and the rejected listing), Astra reject on a P2: both sites that expire a bound session expired first and filed the review second, so a pass reading the expired session in between, or a crash between the two, retired the intent with no record; fixed in `68f6ee23` by filing first (a two-path race test runs the store's retirement inside the fake's expiry and wants the conflict; it fails with either site's order put back), with the P3s, two new tests (an older resolutions table migrates with `retire`; the listing's 200-row bound, newest first, account on each row) and the comments and design sentence both named. The first form of the listing's account fix looked the account up under open rows and deadlocked the store's one connection in the test; rows are read to the end first. Round 18 at `68f6ee23`: Opus accept with fixes, Astra reject, on the same P2: with the review now filed before the expiry, an operator's `retire` can delete the intent while its bound session is still open and payable (the expiry failed; nothing retries it; the resume path still offers the URL). The supervisor ruled that this is not fixed by moving calls again but by a durable protocol (recorded refusal authoritative; the session's fate proven from provider evidence and recorded; atomic operator completion; a paid session settled by a separate disposition) with one bounded design review before another implementation cycle. Revision 1 of that design (`8c72e88b`) was rejected by Astra (four P2s), and revision 2 (`b4ff6b72`) too (five P2s: the hand-made subscription's own obligations at `retire`; the settlement predicate; observation times against cached answers; which evidence a dispute's resolution makes authoritative; the migration barrier). Revision 3 (`15041ca2`) was rejected a third time (four P2s, each with a conservative hold as its smallest change); revision 4 applies those holds and is built as **stage one** in `59666bab` (`billingretirement.go`): the operator's `retire` is accepted only for a session proven expired and unpaid by a provider read with nothing attached and nothing contradictory; `keep` only for a completed, paid session with no subscription attached but its own; a paid session that is not kept, any case a hand-made subscription touched, any contradicted case and every review from before the build are held; the door requests the expiry and answers 503 while it is unproven; the pass retries on a schedule; a click under review gets no URL; contradictions are disputes; a delete barrier stops an older binary. Eight tests, one per interleaving; eleven existing tests reworked; seventeen mutants killed. **Round nineteen did not accept it**: Opus accept with fixes (one P2, six P3s), Astra reject (three P2s): a subscription on the purchase's own terms was never attached, so `keep` could release the review beside it; the refusal and its subscription were two transactions; the keep gate's fresh read was not recorded as evidence; contradictions arriving after a retirement or a kept purchase's record, or read by an actor with a stale view, were dropped. These are answered in `43d326b5` as one invariant (every provider observation about a refused purchase classified and recorded in one store transaction against the purchase as it stands, retired, or kept and consumed; a refusal and its subscription one transaction; a caller records before it answers; nothing dropped), with seven counterexample tests, four reworked, and twenty mutants killed. Round twenty (Opus and Astra) is reading it. **Review eighteen's P2 stays open and blocks the merge until a round accepts this code.** No test runs two console processes against one database; the interleavings are driven through the store and provider hooks, and the dispositions say so. The bounded findings of round eighteen are fixed there with tests and four killed mutants (attribution of a retired session's completion beside a replacement; a `keep` decided during the gate answered by the replay comparison; the nil-billing and tie-break tests). The findings since round ten were not minor: each was a real gap in the lifecycle of an intent under review, and the rounds have converged on the operator's door rather than the money path | integrated end to end; not merged; the merge waits on a round ending with both accepting and nothing left to fix, and CI on the tip | |
| | `feat/carloku-billing-layout-20261001` | `c1ae91a0` | (templates only; gated inside the currency branch) | passed | none of its own | merged into the currency branch at `5047494b`; its two-form layout was replaced by one form in `8958392b` | |
| | `feat/carloku-storage-sole-holder-20261001` | `eaf6e63e` | passed on `3af02a65`; `eaf6e63e` is wording and reports | passed | 9 rounds; round 9 both accept (omitted-holder class closed) | needs approval K and a recorded cutover date; not merged | |
| | `feat/carloku-metered-replicator-20261001` | `e1280811` (review twenty answered with comments, a fixture and dispositions only; the code is the twentieth build `c9ec11eb`: a tree claim refuses a tenant's file in a platform directory too, the fixture's guard reachable, the no-recorder refusal quoted; after `53e3dcd8`, the nineteenth build: a tenant's file in a platform directory refused in both layouts, the long-target fixture within the pathname budget and under XFS's link limit, refusal messages quoted; after `6249af63`, the eighteenth; reviews eight to eighteen's reports in the tree) | passed on every code tip through `f306222c`, then **failed on `bffc76b5`** (`gate-replicator-bffc76b5.txt`, exit 2: the seventeenth build's long-target fixture held only under a temp root of about 34 bytes or more; the gate's `/var/tmp/ck` is shorter), passed on `6249af63` (09:04Z, `gate-replicator-6249af63.txt`, exit 0, three cross builds, clean tree); `53e3dcd8`: passed (09:38Z, `gate-replicator-53e3dcd8.txt`, exit 0, three cross builds); `c9ec11eb`: passed (09:52Z, `gate-replicator-c9ec11eb.txt`, exit 0, three cross builds); `e1280811`: passed (10:10Z, `gate-replicator-e1280811.txt`, exit 0, three cross builds). Void: `gate-replicator-e8211fc6-VOID-stopped-for-astra17-followup.txt` (stopped so Astra's report could be answered in the same build) | passed through `f306222c`; **failed on `bffc76b5`** (the same fixture); passed on `6249af63`, `53e3dcd8`, `c9ec11eb` and `e1280811` | 4 to 7: each Opus accept with fixes, Astra reject; 8: both reject on one P1 the eighth build made (fixed in the ninth); 9 to 15: Opus accept with fixes, Astra reject, each round finding the previous build's own addition wanting (15 at `03b19014`: the fifteenth build joined a relative link target and so cleaned a `..` the kernel resolves physically, a regression that let a link to a directory outside the tree pass in silence; fixed in the sixteenth build by concatenating uncleaned, with the fixture both asked for); 16 at `f306222c`: Opus accept with fixes, Astra reject; both found the fifteenth's regression closed and one bound Astra named (the concatenated spelling could outgrow PATH_MAX), fixed in the seventeenth build `bffc76b5` with `fstatat` against the link's directory. 17 at `bffc76b5`: Opus accept with fixes, Astra reject; both named the same two new defects in that fix: the directory was opened by path with Go's default flags (a FIFO a tenant swaps in blocks the watch and Close; a device would have its driver's open run) and the long-target fixture failed under any short temp root (which is what failed the gate and CI). The eighteenth build opens the directory with `O_DIRECTORY|O_NONBLOCK|O_NOCTTY|O_CLOEXEC` (anything but a directory refused by the open itself; three mutants killed: default flags, `O_DIRECTORY` alone dropped, the fixed fixture size under `/var/tmp/ck`), sizes the fixture from the temp root, compares `render` across sections, and corrects the comments and names Astra listed; the false "package tests pass under /tmp" claim of the seventeenth build is marked false in its dispositions. 18 at `6249af63`: Opus accept (three P3s: the fixture's 3 KB link target, which XFS refuses; a tenant's file in a platform directory accepted under the tenant's tree and refused under the platform's; wording), Astra reject on the deep items (and the fixture's fixed depth). The nineteenth build `53e3dcd8` answers them (two mutants killed). 19 at `53e3dcd8`: Opus accept (two P3s), Astra reject on the deep items; the twentieth build `c9ec11eb` makes the bounded changes (one mutant killed) and its dispositions list the deferred items separately, each as blocking wiring and needing a design or a decision. 20 at `c9ec11eb`: Opus accept with fixes, Astra reject on the deep items; `e1280811` changes no behaviour and is not sent for another round; the two refusals Opus named as decisions are in `DECISIONS-FOR-PAUL.md` (11, 12). Each build's dispositions section lists its killed mutants. The deep items stay open and are listed there: litestream's own opens by path (every reopen), protected endpoints under tenant-replaceable ancestry, a delayed admitted request past the margin, requests across a crash or restart, the header open through a swapped ancestor (a walk by directory descriptor, required before wiring), a tenant sharing the platform's uid, root-run units and a route naming another user's coherent tree (approval H), hibernating aliases and claims on skipped files, required coverage that can vanish without an entry, whether one tenant's unaccepted links refuse the whole box (a decision before wiring), one tenant's deletion holding every account's days once (a stated cost). None of these is minor: the branch cannot be wired until they are closed or decided | not merged; unwired side work gated on approval H | |