carlos / platform Public

store: a decline reason is for a person to read, not for an app to branch on

Review findings from an independent read of stages 4-6, and the ruling that
settles the one contradiction it found.

§4 said a decline reason must not be tenant-readable; §8 said member status
renders the reason. Both were written meaning something true, and the build
had to pick one — it picked §8, which handed every account member and every
Admin service credential the applicant's note, the reason, and the address of
the operator who decided.

Ruled 2026-09-08: a person reads the reason, a machine does not, and the
deciding operator's address reaches neither. Requiring a reason on decline is
pointless if the account never learns it — that is the four-day silence of §1
in a new hat — but an operator stays answerable to the deployment, not to the
account they just declined. storeEntitlementWire is that projection, and it
withholds Decision.By STRUCTURALLY: the type has no such field, so no future
edit can restore the leak by flipping a condition.

Two things the review had not reached, found while implementing it:

The apply door leaked identically. It answered with the record, so an owner
re-applying to an already-decided account was handed the deciding operator's
address straight back.

Projecting the decision door broke the operator's own confirmation. `carlos
store decline` prints the reason back as proof of what it recorded, and the
operator was about to get their own sentence returned empty. Tenant-facing
doors project; the operator's own doors answer with the record.

Also from the review:

printStoreCreate now uses the four-state printer. It told every non-approved
account to run `carlos store apply`, including one whose application was
already pending — and following that instruction rewrites Applied.At, which
the queue sorts on, so an applicant obediently sent themselves to the back of
the line they were already standing in.

The provision walk's deadline starts after the lock rather than before it.
This is the door that queues in ordinary use, and a request that waited out a
full-length walk ahead of it reached the lock holding a spent context and
failed its first Get for no reason.

printStoreApprovals no longer dereferences a nil Applied block.

Spec amended with the ruling as a table, and §7's route corrected to the
/api/cli family that actually shipped rather than the /a/{sqid} one it
described.

Reviewed by Claude Fable 5.1; the mechanisms it checked hardest — the
authority gate, the edge ACL, lock-then-reread, one-key-per-app, derived
state and CAS — it confirmed correct in source rather than from test names.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CfUNFHm89j2mj5q7vBHsfH