amadan
Readiness and handoff at 11:20: round eighteen's reverse window answered by a retirement protocol design under review; the replicator's nineteenth build; the reduction design rejected with Paul's decisions listed
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
4 files changed,
+16
−11
.claude/HANDOFF.md+7 −6implementation/carloku-paid-launch/ENABLEMENT.md+5 −2implementation/carloku-paid-launch/OUTSTANDING.md+1 −1implementation/carloku-paid-launch/READINESS.md+3 −2
CI passed — run details
diff --git a/.claude/HANDOFF.md b/.claude/HANDOFF.md| index 905adbd8a..c34f24f16 100644 |
| --- a/.claude/HANDOFF.md |
| +++ b/.claude/HANDOFF.md |
| @@ -7,7 +7,7 @@ |
| Get Carloku's paid plans live with Stripe Tax and the complete metered model; have the pricing page and signup flow reviewable in the morning. |
| **STATUS:** |
| -Written 10:20 Dublin on 2026-10-02 (the session hit a provider limit at about 08:00 Dublin and resumed at 08:40; nothing was lost), during the second overnight run (brief: "continue overnight until we're ready to enable payments"; ready means reviewed, tested, integrated code and a scoped enablement plan, not payments switched on). Billing is OFF everywhere. No live Stripe write, no AWS change, no charge, no merge to main. Every payment anyone can see is a labelled simulation. |
| +Written 11:20 Dublin on 2026-10-02 (the session hit a provider limit at about 08:00 Dublin and resumed at 08:40; nothing was lost), during the second overnight run (brief: "continue overnight until we're ready to enable payments"; ready means reviewed, tested, integrated code and a scoped enablement plan, not payments switched on). Billing is OFF everywhere. No live Stripe write, no AWS change, no charge, no merge to main. Every payment anyone can see is a labelled simulation. |
| Review servers, all answering 200: pricing page `http://100.119.180.57:38009` (static, rebuilt from site `2fc6388`), signup and billing demo `http://100.119.180.57:41881` (rebuilt 10:10 from the currency branch's tip `68f6ee23`, price book configured, USD/EUR/GBP end to end; Keymail and Stripe simulated), console billing copy `http://100.119.180.57:45033` if still up. |
| @@ -16,8 +16,8 @@ The durable records are on this branch under `implementation/carloku-paid-launch |
| Decisions received 2026-10-01 evening, applied: the annual bases (28/24/22, 6/5/4.50, 60/50/45 USD/EUR/GBP, team minimum ten) confirmed for implementation only; the currency rulings (USD default, EUR for EU member states, GBP for the UK, visible override, one stored currency for subscription and overages, bands by billing country only); the five currency strings and the regrouped pricing page copy, approved verbatim and applied. Still a draft: the book `2026-10-01-draft1` and the USD/GBP overage rates and floors. |
| Branches (all on the forge, none merged; the local gate is not CI): |
| -- `feat/carloku-multi-currency-20261001` `68f6ee23`: the price book and one stored currency per purchase end to end, the billing page as one form with a server-signed quote, ownership on every path, the refusal review keyed by its intent with the session recorded, the cookies, the demo. Rounds ten to thirteen ended with both reviewers accepting with P3 fixes; **round fourteen did not: Astra found a P2** (a first purchase's record and its intent's retirement were two transactions under no common lock, so a reconciliation paused on the provider read while the operator resolved the review recorded the retired purchase). Fixed in `abd1b76e`: the record consumes the exact standing intent in its own transaction, and the same lifecycle holds on every path (an intent under an open review is never retired by an expiry; a retired intent's completion and subscription events are settled, not retried; a refusal whose session read came back as another session files nothing), with tests that fail without each fix and six killed mutants (dispositions "Review fourteen"). Round fifteen (both accept with fixes) found the last exception to that lifecycle, a purchase corrected at the provider recording under its open review; `3527a066` closes it by the ruling: nothing records on an intent under an open review, and the operator's resolution retires the intent (default) or keeps it (`outcome: keep`) for the corrected purchase to record; a retired intent's events settle whatever intent stands. Round sixteen (both accept with fixes) tightened the new `keep` outcome: it is accepted only for an intent whose bound session reads back complete with a subscription (anything else would later expire unrecorded), and the outcome is written, replay-compared and audited; `db130cfc` carries those fixes, the operator's rejected-events listing (`GET /api/billing/rejected`, named missing by both reviewers since round eleven) and the provisioning script's currency-option notes aligned with the code. Round seventeen did not confirm either: Opus accepted with four P3s on the `keep` door and the rejected listing; **Astra found a P2 in the refusal's own order**: both sites that expire a bound session expired first and filed the review second, so a pass that read the expired session in between, or a crash between the two, retired the intent with no record. `68f6ee23` files the review first at both sites (a two-path race test runs the store's retirement inside the fake's expiry and wants the conflict; it fails with either order put back), closes the four P3s, adds two tests (an older resolutions table migrates with `retire`; the listing's 200-row bound, newest first, the account on each row) and corrects the comments and the design sentence both reviewers named. Gate and CI passed through `db130cfc`; gate and CI on `68f6ee23` running at 10:20; the eighteenth review is reading it. These findings were not minor: each round since ten found a real gap in the lifecycle of an intent under review; the last three rounds converged on the operator's door rather than the money path. |
| -- `feat/carloku-metered-replicator-20261001` `6249af63`: eighteenth build. Reviews ten to fourteen (Opus accept with fixes, Astra reject) each found the previous build's own addition wanting; the fourteenth build made the link entry one to one and the fifteenth quotes every entry in the inventory's rendering (the drift key), classifies a link by the spelling its entry names, and makes the Accept test tell as-written from cleaned. Review fifteen (Opus accept with fixes, Astra reject on the deep items) found a regression the fifteenth build made: a relative link target was joined and so cleaned, which is not how the kernel resolves a `..` after a link, so a link to a directory outside the tree passed in silence; the sixteenth build concatenates uncleaned, with the fixture both asked for. Review sixteen (both) found that fixed and one bound left (the concatenated spelling could outgrow PATH_MAX); the seventeenth build `bffc76b5` stat'ed the target by itself against the link's directory, and **failed the gate and CI on its own fixture** (sized for a long temp root only), which review seventeen (Opus accept with fixes, Astra reject) had worked out, together with a worse defect in the same fix: the directory was opened by path with Go's default flags, so a FIFO a tenant swaps in would block the watch and Close. The eighteenth build (`e8211fc6`, `6249af63`) opens the directory as a directory and nothing else, sizes the fixture from the temp root, compares the rendering across sections, and corrects the comments, the test name and the outstanding item Astra listed; three mutants killed. Gate (exit 0, three cross builds) and CI passed on `6249af63`; the eighteenth review is reading it. The deep items stay open and are listed in `READINESS.md`; none is minor, and the branch cannot be wired until they are closed or decided (the walk by directory descriptor, litestream's opens by path, durable transition state, the uid binding under approval H, the box-wide refusal decision). |
| +- `feat/carloku-multi-currency-20261001` `68f6ee23`: the price book and one stored currency per purchase end to end, the billing page as one form with a server-signed quote, ownership on every path, the refusal review keyed by its intent with the session recorded, the cookies, the demo. Rounds ten to thirteen ended with both reviewers accepting with P3 fixes; **round fourteen did not: Astra found a P2** (a first purchase's record and its intent's retirement were two transactions under no common lock, so a reconciliation paused on the provider read while the operator resolved the review recorded the retired purchase). Fixed in `abd1b76e`: the record consumes the exact standing intent in its own transaction, and the same lifecycle holds on every path (an intent under an open review is never retired by an expiry; a retired intent's completion and subscription events are settled, not retried; a refusal whose session read came back as another session files nothing), with tests that fail without each fix and six killed mutants (dispositions "Review fourteen"). Round fifteen (both accept with fixes) found the last exception to that lifecycle, a purchase corrected at the provider recording under its open review; `3527a066` closes it by the ruling: nothing records on an intent under an open review, and the operator's resolution retires the intent (default) or keeps it (`outcome: keep`) for the corrected purchase to record; a retired intent's events settle whatever intent stands. Round sixteen (both accept with fixes) tightened the new `keep` outcome: it is accepted only for an intent whose bound session reads back complete with a subscription (anything else would later expire unrecorded), and the outcome is written, replay-compared and audited; `db130cfc` carries those fixes, the operator's rejected-events listing (`GET /api/billing/rejected`, named missing by both reviewers since round eleven) and the provisioning script's currency-option notes aligned with the code. Round seventeen did not confirm either: Opus accepted with four P3s on the `keep` door and the rejected listing; **Astra found a P2 in the refusal's own order**: both sites that expire a bound session expired first and filed the review second, so a pass that read the expired session in between, or a crash between the two, retired the intent with no record. `68f6ee23` files the review first at both sites (a two-path race test runs the store's retirement inside the fake's expiry and wants the conflict; it fails with either order put back), closes the four P3s, adds two tests (an older resolutions table migrates with `retire`; the listing's 200-row bound, newest first, the account on each row) and corrects the comments and the design sentence both reviewers named. Gate and CI passed on `68f6ee23`. **Round eighteen did not confirm**: both reviewers found that with the review filed first, an operator's `retire` can delete the intent while its bound session is still open and payable (the expiry failed; nothing retries it; the resume path still offers the URL). Per the 10:20 supervision this is not fixed by moving calls again: a durable retirement protocol is designed instead (`docs/superpowers/specs/2026-10-02-intent-retirement-protocol-design.md`: the refusal recorded and authoritative; the session's fate proven from provider evidence and recorded on the intent, with a dispute state; the expiry requested under one fixed key by reader, pass and operator; the operator's completion atomic, `retire` only on a proven expiry, a paid session `settled` by a separate disposition or `keep`; the click offers no URL). Revision 1 was rejected by Astra (four P2s); revision 2 (`b4ff6b72`) is under its second bounded review; implementation follows an accepted design. These findings were not minor: each round since ten found a real gap in the lifecycle of an intent under review; the last three rounds converged on the operator's door rather than the money path. |
| +- `feat/carloku-metered-replicator-20261001` `6249af63`: eighteenth build. Reviews ten to fourteen (Opus accept with fixes, Astra reject) each found the previous build's own addition wanting; the fourteenth build made the link entry one to one and the fifteenth quotes every entry in the inventory's rendering (the drift key), classifies a link by the spelling its entry names, and makes the Accept test tell as-written from cleaned. Review fifteen (Opus accept with fixes, Astra reject on the deep items) found a regression the fifteenth build made: a relative link target was joined and so cleaned, which is not how the kernel resolves a `..` after a link, so a link to a directory outside the tree passed in silence; the sixteenth build concatenates uncleaned, with the fixture both asked for. Review sixteen (both) found that fixed and one bound left (the concatenated spelling could outgrow PATH_MAX); the seventeenth build `bffc76b5` stat'ed the target by itself against the link's directory, and **failed the gate and CI on its own fixture** (sized for a long temp root only), which review seventeen (Opus accept with fixes, Astra reject) had worked out, together with a worse defect in the same fix: the directory was opened by path with Go's default flags, so a FIFO a tenant swaps in would block the watch and Close. The eighteenth build (`e8211fc6`, `6249af63`) opens the directory as a directory and nothing else, sizes the fixture from the temp root, compares the rendering across sections, and corrects the comments, the test name and the outstanding item Astra listed; three mutants killed. Gate (exit 0, three cross builds) and CI passed on `6249af63`. Review eighteen: Opus accept with three P3s, Astra reject on the deep items. The nineteenth build `53e3dcd8` answers them (a tenant's file in a platform directory refused in both layouts; the fixture within the pathname budget and under XFS's link limit; quoted refusal messages; two mutants killed); its gate and round nineteen are running. The deep items stay open and are listed in `READINESS.md`; none is minor, and the branch cannot be wired until they are closed or decided (the walk by directory descriptor, litestream's opens by path, durable transition state, the uid binding under approval H, the box-wide refusal decision). |
| - `feat/carloku-storage-sole-holder-20261001` `eaf6e63e`: round 9 both accept; CI passed; needs approval K and a cutover date. |
| - `fix/carloku-observe-routes-cleanup-20261001` `023e106c`: both accept; CI passed; merged into this branch at `47c97fa6`; the gate on the launch tip `b953fae4` passed (exit 0, three cross builds). |
| - `feat/carloku-billing-layout-20261001` `c1ae91a0`: merged into the currency branch; its two-form page was replaced by one form. |
| @@ -29,17 +29,18 @@ Branches (all on the forge, none merged; the local gate is not CI): |
| - Paul, copy: the console billing page's 40 strings; the store-refusal copy (`OUTSTANDING.md` 19g). `bands.p3` is done: the approved currency explanation replaced the converted-euro sentence (site `e091e3f`, 07:0x); it now reads the same as the note under the currency selector. |
| - Paul, rulings: evidence for a held bucket-hour (J); storage on a bucket a store has left (K); the cutover note (M: purchases before the book stay legacy EUR; binary first, variables second). |
| - Scoped approvals, prepared as plans only: Stripe test mode (E) for the fence test and the rehearsal; Stripe live provisioning (F) after the approved book; the Cost and Usage Report export and the scratch-object write (G); Path B on a dev box (H). |
| -- Reviews to read when they land: the currency branch's eighteenth (`logs/opus-currency-review18.md`, `astra-currency-review18.md`) and the replicator's eighteenth (`opus-replicator-review18.md`, `astra-replicator-review18.md`). |
| +- Reviews to read when they land: Astra's second review of the retirement design (`logs/astra-retirement-design-review2.md`); the replicator's nineteenth (`opus-replicator-review19.md`, `astra-replicator-review19.md`). |
| +- Paul, rulings for the retirement design (its last section): may money ever be accepted without the purchase recording (the design says no); the route for a session whose identity the provider keeps contradicting (the design holds it). Rulings for quantity reduction at renewal (`feat/carloku-quantity-reduction-20261002`, design rejected by Astra on four P1s; its last section): a member replaced before the renewal (window, schedule or immediate); a missed reduction's remedy; reductions behind both switches. |
| **STILL TO BUILD (code, not approvals; no fake completes these):** quantity reduction at renewal (`OUTSTANDING.md` 14), the Free tier (15), dormancy and pool accounting (16), per-line tax codes across a change (17), the operator doors (18, plus the quantity-history gap door and a rejected-events listing), the meters' own code (replicator unwired with deep items open; store transfer has no source), the two key-memory defects (7, 9). `READINESS.md` has the list with what each means. The tests on the currency branch establish the subscription and currency path against fakes, nothing beyond it. |
| **RECOMMENDED:** |
| -- Read the eighteenth currency review. If both accept with nothing left to fix and CI is green on the tip, merge the currency branch into this branch: a merge commit pushed to this branch, as the observe-routes fix was at `47c97fa6` (`amadan branch merge` lands a branch on main and is not what this step is), then gate the merged tip. If it does not confirm, the next commit answers it the same way. Rule on K to let the storage branch follow. |
| +- Read Astra's second review of the retirement design; if accepted, plan and build it on the currency branch (tests per interleaving, mutants), then round nineteen. The merge of the currency branch waits for that. If a later round ends with both accepting with nothing left to fix and CI is green on the tip, merge the currency branch into this branch: a merge commit pushed to this branch, as the observe-routes fix was at `47c97fa6` (`amadan branch merge` lands a branch on main and is not what this step is), then gate the merged tip. If it does not confirm, the next commit answers it the same way. Rule on K to let the storage branch follow. |
| - Publish the approved book version as soon as L is given; it is a new entry in `internal/plans/pricebook.json`, the export regenerated and copied to the site, and the 36 lookup keys renamed. |
| - Test-mode rehearsal (E) before anything live: the list in both reviews and in `ENABLEMENT.md` section 6. |
| - Then, each on its own branch: quantity reduction at renewal, the evidence door for a box's first minutes, the AWS principal inventory and the bucket ownership attestation door, Free-tier enforcement, dormancy and pool accounting. |
| **SESSION:** |
| -Running at 10:20: the gate on the currency tip `68f6ee23` (`logs/gate-currency-68f6ee23.txt`), the two eighteenth-round currency reviews and the two eighteenth replicator reviews (detached `setsid` processes; output files named above). Two traps this hour, recorded in `logs/PENDING-after-currency.txt`: a review brief whose delta line was clobbered to `git diff X X` by a global sha replacement (two worker pairs stopped and restarted on the corrected brief), and `git commit -F $TMPDIR/...` failing outside the sandbox, which left a gate running on a staged tree (voided, `gate-currency-db130cfc-VOID-dirty-tree-second-run.txt`). The demo (pid in `layout-review/demo-redesigned.log`'s process, stop marker `layout-review/demo-redesigned.stop`) and the pricing preview (`python3 -m http.server 38009`) keep serving. |
| +Running at 11:20: the gate on the replicator tip `53e3dcd8`, the two nineteenth replicator reviews, Astra's second review of the retirement design (detached `setsid` processes; output files named above). Two traps this hour, recorded in `logs/PENDING-after-currency.txt`: a review brief whose delta line was clobbered to `git diff X X` by a global sha replacement (two worker pairs stopped and restarted on the corrected brief), and `git commit -F $TMPDIR/...` failing outside the sandbox, which left a gate running on a staged tree (voided, `gate-currency-db130cfc-VOID-dirty-tree-second-run.txt`). The demo (pid in `layout-review/demo-redesigned.log`'s process, stop marker `layout-review/demo-redesigned.stop`) and the pricing preview (`python3 -m http.server 38009`) keep serving. |
| Scratch on the box: `~/.cache/tmp/claude-1001/{currency-wt,replicator-wt,fencing-wt,evidence-wt}` (git worktrees), the demo binaries, `/var/tmp/ck`, `~/.cache/carloku-gate`. The void gate logs are named `*VOID*`. |
diff --git a/implementation/carloku-paid-launch/ENABLEMENT.md b/implementation/carloku-paid-launch/ENABLEMENT.md| index 95d5c4d21..91d6492ca 100644 |
| --- a/implementation/carloku-paid-launch/ENABLEMENT.md |
| +++ b/implementation/carloku-paid-launch/ENABLEMENT.md |
| @@ -206,8 +206,11 @@ approvals granted. It does not mean payments switched on. |
| operator's `keep` outcome tightened and recorded in `db130cfc`; the |
| seventeenth review found the refusal's own order wrong (expiry before |
| the review, so a pass in between retired the intent unrecorded), fixed |
| - in `68f6ee23`, and the eighteenth review is the one to read before any |
| - merge. Readiness is not |
| + in `68f6ee23`; the eighteenth review found the reverse window (an |
| + operator's `retire` while the bound session is still payable), and the |
| + fix is a durable retirement protocol under design review before the |
| + next implementation cycle (`2026-10-02-intent-retirement-protocol-design.md`). |
| + Readiness is not |
| approval-only: the branch merges when a round ends with both reviewers |
| accepting and nothing left to fix, and the metered model needs the code |
| listed below built first. The readiness checklist (`READINESS.md`) names |
diff --git a/implementation/carloku-paid-launch/OUTSTANDING.md b/implementation/carloku-paid-launch/OUTSTANDING.md| index 278ced01b..214abe564 100644 |
| --- a/implementation/carloku-paid-launch/OUTSTANDING.md |
| +++ b/implementation/carloku-paid-launch/OUTSTANDING.md |
| @@ -32,7 +32,7 @@ Each is concrete. None is waived. |
| ### Meters (the complete metered model cannot invoice until both are proven) |
| -1. **Replication writes (`durability_writes_1k`) cannot be proven on any box.** The external replicator writes outside the ledger. Path A (scoped attestation) was built, reviewed in round six, and cannot prove an exclusive writer; it is off this branch and parked on `feat/carloku-scoped-attestation-20261001`. Path B (the platform's own replicator as the only writer) is **partial, unwired, and has not had a whole-branch pass from both reviewers** (eighteen builds; Opus accepts each with fixes, Astra rejects each on the deep items), on `feat/carloku-metered-replicator-20261001` (the forge has the tip; `READINESS.md` names it with its gate and CI state). What is built there: a request gate in `internal/lease` that stops an attempt before it is sent; an ownership generation in the registry moved by the six route columns the replicator reads (not by its own bookkeeping writes); a fleet that holds every recorder's days in doubt and watches without a request; one strict inventory with file checks (one name, ordinary siblings, a link named with its target as written and classified by that spelling through a directory-only descriptor, no mount, the chain root's owner, under a platform directory) and a second look on a timer; and shadow state made private before litestream can make it. Still open there, each named in its dispositions as blocking wiring: litestream's own opens by path after a look (needs litestream to open beneath a pinned root), replaceable ancestry above a protected directory, an admitted request delayed past the margin, a process dying between a change and the rebuild (the doubt is in memory only), device effects through an ancestor swap, hibernating aliases and claims on skipped files, required coverage that disappears without an entry, that any tenant can stop a rebuild for the box, route identity unbound to filesystem authority, and the uid binding under approval H. `DISPOSITIONS-metered-replicator.md` on that branch has every finding and what each build did about it. What is there: a litestream store whose every replica client is metered with no unmetered fallback, an owner for each database the box replicates, and a fleet store that refuses anything it cannot meter, each with tests. **Absent**: the agent wiring that binds those meters to the box's ledger, a restore path that does not shell out to the external binary, the unit change, moving the replica credentials so nothing else on the box holds them (the unit runs as the same user as the agent today), and any attestation. Until all of that exists and is approved for a box, this meter is incomplete every month and nothing is invoiced. |
| +1. **Replication writes (`durability_writes_1k`) cannot be proven on any box.** The external replicator writes outside the ledger. Path A (scoped attestation) was built, reviewed in round six, and cannot prove an exclusive writer; it is off this branch and parked on `feat/carloku-scoped-attestation-20261001`. Path B (the platform's own replicator as the only writer) is **partial, unwired, and has not had a whole-branch pass from both reviewers** (nineteen builds; Opus rejected the first, second and eighth and accepts the rest with fixes, Astra rejects each on the deep items), on `feat/carloku-metered-replicator-20261001` (the forge has the tip; `READINESS.md` names it with its gate and CI state). What is built there: a request gate in `internal/lease` that stops an attempt before it is sent; an ownership generation in the registry moved by the six route columns the replicator reads (not by its own bookkeeping writes); a fleet that holds every recorder's days in doubt and watches without a request; one strict inventory with file checks (one name, ordinary siblings, a link named with its target as written and classified by that spelling through a directory-only descriptor, no crossing onto another filesystem (a same-filesystem bind alias is not detected), the chain root's owner, under a platform directory) and a second look on a timer; and shadow state made private before litestream can make it. Still open there, each named in its dispositions as blocking wiring: litestream's own opens by path after a look (needs litestream to open beneath a pinned root), replaceable ancestry above a protected directory, an admitted request delayed past the margin, a process dying between a change and the rebuild (the doubt is in memory only), device effects through an ancestor swap, hibernating aliases and claims on skipped files, required coverage that disappears without an entry, that any tenant can stop a rebuild for the box, route identity unbound to filesystem authority, and the uid binding under approval H. `DISPOSITIONS-metered-replicator.md` on that branch has every finding and what each build did about it. What is there: a litestream store whose every replica client is metered with no unmetered fallback, an owner for each database the box replicates, and a fleet store that refuses anything it cannot meter, each with tests. **Absent**: the agent wiring that binds those meters to the box's ledger, a restore path that does not shell out to the external binary, the unit change, moving the replica credentials so nothing else on the box holds them (the unit runs as the same user as the agent today), and any attestation. Until all of that exists and is approved for a box, this meter is incomplete every month and nothing is invoiced. |
| 2. **Store transfer (`store_egress_gb`) has no source.** No Cost and Usage Report export exists on the account. It needs the scoped infrastructure approval, a first real delivery, an IAM principal inventory in the AWS provisioner (not built), and the bucket ownership attestation for stores that already exist (designed, not built). |
| 3. **A store's partial first hour** with a charged line holds the month, and nothing releases it. It holds by default and nobody is asked to waive it. What can release it is evidence: an operator door that records, for one bucket-hour, who is shown to have owned it and on what evidence, which the fold then honours. **Partial, unwired into this branch**, on `feat/carloku-bucket-hour-evidence-20261001` (`0aa1fbec`, rebased onto this branch): the record, the fold change and three operator API doors, with tests and mutation checks. It accepts only the hour a complete ledger began vouching in and only the owner that ledger names. The full local gate passes on it. First review: Astra rejected it, Opus accepted with fixes. Both confirmed that through the fold it releases nothing but that hour for that owner. Both also found that the evidence is free text that the same operator records and that stands at once, which in practice is a waiver: what counts as evidence, and whether a second person must approve it, needs Paul's ruling (approval J) before more is built. Nothing fixed yet (`DISPOSITIONS-bucket-hour-evidence.md` on that branch). No CI run, no CLI verb, and its operator-facing sentences are unreviewed. |
| 4. **A box's first minutes** before its ledger opened hold that day for everyone. Same as item 3: it holds by default, and the release is an operator evidence door, not a waiver. **Absent**. |
diff --git a/implementation/carloku-paid-launch/READINESS.md b/implementation/carloku-paid-launch/READINESS.md| index 06a78eb5a..b51e50a65 100644 |
| --- a/implementation/carloku-paid-launch/READINESS.md |
| +++ b/implementation/carloku-paid-launch/READINESS.md |
| @@ -14,12 +14,13 @@ Log files are under `/home/paulca/.local/share/carloku-paid-launch-20260930/logs |
| | Branch | Tip | Gate | CI | Reviews | State | |
| | --- | --- | --- | --- | --- | --- | |
| -| `feat/carloku-multi-currency-20261001` | `68f6ee23` (the seventeenth review's findings: the review filed before the expiry on both paths, the `keep` door's replay, nil billing and purchase check, the rejected listing's account, order and bound, two new tests; reviews ten to seventeen's reports in the tree) | passed on every code tip through `db130cfc` (`gate-currency-db130cfc.txt`, exit 0, three cross builds, clean tree); `68f6ee23`: started 09:4xZ (`gate-currency-68f6ee23.txt`); the console, plans and billingstripe packages passed in full on the same tree before the commit (console 525 s). Void or superseded logs, not evidence: `gate-currency-a9304f16.txt`, `gate-currency-f269365a-VOID-dirty-tree.txt`, `gate-currency-25487506-ended-on-28dc2629-reports-added-during-run.txt`, `gate-currency-db130cfc-VOID-dirty-tree-second-run.txt` (started by mistake on staged, uncommitted changes and stopped) | passed on every pushed tip through `db130cfc`; `68f6ee23` running | Rounds 1 to 9: Opus accept with fixes, Astra reject. Rounds 10 to 13: both accept with fixes (P3s). Round 14: Astra reject on a P2 (a reconciliation paused on the provider read while the operator resolved the review recorded the retired purchase), fixed in `abd1b76e`. Rounds 15 and 16: both accept with fixes, each closing what the previous fix left open in the intent's lifecycle (15: nothing records under an open review, the resolution retires or keeps; 16: `keep` only for an intent whose bound session is complete with a subscription, the outcome written, replay-compared and audited). Each fix has a test that fails without it and a killed mutant (dispositions, one section per round). Round 17 at `db130cfc`: Opus accept with fixes (four P3s on the `keep` door and the rejected listing), Astra reject on a P2: both sites that expire a bound session expired first and filed the review second, so a pass reading the expired session in between, or a crash between the two, retired the intent with no record; fixed in `68f6ee23` by filing first (a two-path race test runs the store's retirement inside the fake's expiry and wants the conflict; it fails with either site's order put back), with the P3s, two new tests (an older resolutions table migrates with `retire`; the listing's 200-row bound, newest first, account on each row) and the comments and design sentence both named. The first form of the listing's account fix looked the account up under open rows and deadlocked the store's one connection in the test; rows are read to the end first. Round 18 at `68f6ee23`: running. The findings since round ten were not minor: each was a real gap in the lifecycle of an intent under review, and the rounds have converged on the operator's door rather than the money path | integrated end to end; not merged; the merge waits on a round ending with both accepting and nothing left to fix, and CI on the tip | |
| +| `feat/carloku-multi-currency-20261001` | code `68f6ee23`; tip `b4ff6b72` adds two design documents only (the retirement protocol, revisions 1 and 2, and Astra's first review of it) (`68f6ee23`: the seventeenth review's findings: the review filed before the expiry on both paths, the `keep` door's replay, nil billing and purchase check, the rejected listing's account, order and bound, two new tests; reviews ten to seventeen's reports in the tree) | passed on every code tip through `db130cfc` (`gate-currency-db130cfc.txt`, exit 0, three cross builds, clean tree); `68f6ee23`: passed (09:17Z, `gate-currency-68f6ee23.txt`, exit 0, three cross builds, clean tree); the console, plans and billingstripe packages passed in full on the same tree before the commit (console 525 s). `b4ff6b72` changes no code and is not gated separately. Void or superseded logs, not evidence: `gate-currency-a9304f16.txt`, `gate-currency-f269365a-VOID-dirty-tree.txt`, `gate-currency-25487506-ended-on-28dc2629-reports-added-during-run.txt`, `gate-currency-db130cfc-VOID-dirty-tree-second-run.txt` (started by mistake on staged, uncommitted changes and stopped) | passed on every pushed tip through `68f6ee23` | Rounds 1 to 9: Opus accept with fixes, Astra reject. Rounds 10 to 13: both accept with fixes (P3s). Round 14: Astra reject on a P2 (a reconciliation paused on the provider read while the operator resolved the review recorded the retired purchase), fixed in `abd1b76e`. Rounds 15 and 16: both accept with fixes, each closing what the previous fix left open in the intent's lifecycle (15: nothing records under an open review, the resolution retires or keeps; 16: `keep` only for an intent whose bound session is complete with a subscription, the outcome written, replay-compared and audited). Each fix has a test that fails without it and a killed mutant (dispositions, one section per round). Round 17 at `db130cfc`: Opus accept with fixes (four P3s on the `keep` door and the rejected listing), Astra reject on a P2: both sites that expire a bound session expired first and filed the review second, so a pass reading the expired session in between, or a crash between the two, retired the intent with no record; fixed in `68f6ee23` by filing first (a two-path race test runs the store's retirement inside the fake's expiry and wants the conflict; it fails with either site's order put back), with the P3s, two new tests (an older resolutions table migrates with `retire`; the listing's 200-row bound, newest first, account on each row) and the comments and design sentence both named. The first form of the listing's account fix looked the account up under open rows and deadlocked the store's one connection in the test; rows are read to the end first. Round 18 at `68f6ee23`: Opus accept with fixes, Astra reject, on the same P2: with the review now filed before the expiry, an operator's `retire` can delete the intent while its bound session is still open and payable (the expiry failed; nothing retries it; the resume path still offers the URL). The supervisor ruled that this is not fixed by moving calls again but by a durable protocol (recorded refusal authoritative; the session's fate proven from provider evidence and recorded; atomic operator completion; a paid session settled by a separate disposition) with one bounded design review before another implementation cycle. Revision 1 of that design (`8c72e88b`) was rejected by Astra (four P2s: the unbound case, immutable fates without a dispute state, complete told from paid, a session read back as nobody's with no route); revision 2 (`b4ff6b72`) answers each and is under its second review. Opus 18's two P3s (the nil-billing case untested; the newest-first check vacuous) and Astra 18's two P3s (concurrent identical `keep`; attribution of a retired session's completion beside a replacement) go into the implementation that follows the design. The findings since round ten were not minor: each was a real gap in the lifecycle of an intent under review, and the rounds have converged on the operator's door rather than the money path | integrated end to end; not merged; the merge waits on a round ending with both accepting and nothing left to fix, and CI on the tip | |
| | `feat/carloku-billing-layout-20261001` | `c1ae91a0` | (templates only; gated inside the currency branch) | passed | none of its own | merged into the currency branch at `5047494b`; its two-form layout was replaced by one form in `8958392b` | |
| | `feat/carloku-storage-sole-holder-20261001` | `eaf6e63e` | passed on `3af02a65`; `eaf6e63e` is wording and reports | passed | 9 rounds; round 9 both accept (omitted-holder class closed) | needs approval K and a recorded cutover date; not merged | |
| -| `feat/carloku-metered-replicator-20261001` | `6249af63` (eighteenth build, two commits: `e8211fc6` the directory-only open and the fixture sized from the temp root; `6249af63` Astra's seventeenth report answered; reviews eight to seventeen's reports in the tree) | passed on every code tip through `f306222c`, then **failed on `bffc76b5`** (`gate-replicator-bffc76b5.txt`, exit 2: the seventeenth build's long-target fixture held only under a temp root of about 34 bytes or more; the gate's `/var/tmp/ck` is shorter), passed on `6249af63` (09:04Z, `gate-replicator-6249af63.txt`, exit 0, three cross builds, clean tree). Void: `gate-replicator-e8211fc6-VOID-stopped-for-astra17-followup.txt` (stopped so Astra's report could be answered in the same build) | passed through `f306222c`; **failed on `bffc76b5`** (the same fixture); passed on `6249af63` | 4 to 7: each Opus accept with fixes, Astra reject; 8: both reject on one P1 the eighth build made (fixed in the ninth); 9 to 15: Opus accept with fixes, Astra reject, each round finding the previous build's own addition wanting (15 at `03b19014`: the fifteenth build joined a relative link target and so cleaned a `..` the kernel resolves physically, a regression that let a link to a directory outside the tree pass in silence; fixed in the sixteenth build by concatenating uncleaned, with the fixture both asked for); 16 at `f306222c`: Opus accept with fixes, Astra reject; both found the fifteenth's regression closed and one bound Astra named (the concatenated spelling could outgrow PATH_MAX), fixed in the seventeenth build `bffc76b5` with `fstatat` against the link's directory. 17 at `bffc76b5`: Opus accept with fixes, Astra reject; both named the same two new defects in that fix: the directory was opened by path with Go's default flags (a FIFO a tenant swaps in blocks the watch and Close; a device would have its driver's open run) and the long-target fixture failed under any short temp root (which is what failed the gate and CI). The eighteenth build opens the directory with `O_DIRECTORY|O_NONBLOCK|O_NOCTTY|O_CLOEXEC` (anything but a directory refused by the open itself; three mutants killed: default flags, `O_DIRECTORY` alone dropped, the fixed fixture size under `/var/tmp/ck`), sizes the fixture from the temp root, compares `render` across sections, and corrects the comments and names Astra listed; the false "package tests pass under /tmp" claim of the seventeenth build is marked false in its dispositions. 18 at `6249af63`: running. Each build's dispositions section lists its killed mutants. The deep items stay open and are listed there: litestream's own opens by path (every reopen), protected endpoints under tenant-replaceable ancestry, a delayed admitted request past the margin, requests across a crash or restart, the header open through a swapped ancestor (a walk by directory descriptor, required before wiring), a tenant sharing the platform's uid, root-run units and a route naming another user's coherent tree (approval H), hibernating aliases and claims on skipped files, required coverage that can vanish without an entry, whether one tenant's unaccepted links refuse the whole box (a decision before wiring), one tenant's deletion holding every account's days once (a stated cost). None of these is minor: the branch cannot be wired until they are closed or decided | not merged; unwired side work gated on approval H | |
| +| `feat/carloku-metered-replicator-20261001` | `53e3dcd8` (nineteenth build: a tenant's file in a platform directory refused in both layouts, the long-target fixture within the pathname budget and under XFS's link limit, refusal messages quoted; after `6249af63`, the eighteenth; reviews eight to eighteen's reports in the tree) | passed on every code tip through `f306222c`, then **failed on `bffc76b5`** (`gate-replicator-bffc76b5.txt`, exit 2: the seventeenth build's long-target fixture held only under a temp root of about 34 bytes or more; the gate's `/var/tmp/ck` is shorter), passed on `6249af63` (09:04Z, `gate-replicator-6249af63.txt`, exit 0, three cross builds, clean tree); `53e3dcd8`: started 10:5xZ (`gate-replicator-53e3dcd8.txt`); ops and registry pass under `/var/tmp/ck` and `~/.cache/tmp` before the commit. Void: `gate-replicator-e8211fc6-VOID-stopped-for-astra17-followup.txt` (stopped so Astra's report could be answered in the same build) | passed through `f306222c`; **failed on `bffc76b5`** (the same fixture); passed on `6249af63`; `53e3dcd8` pending | 4 to 7: each Opus accept with fixes, Astra reject; 8: both reject on one P1 the eighth build made (fixed in the ninth); 9 to 15: Opus accept with fixes, Astra reject, each round finding the previous build's own addition wanting (15 at `03b19014`: the fifteenth build joined a relative link target and so cleaned a `..` the kernel resolves physically, a regression that let a link to a directory outside the tree pass in silence; fixed in the sixteenth build by concatenating uncleaned, with the fixture both asked for); 16 at `f306222c`: Opus accept with fixes, Astra reject; both found the fifteenth's regression closed and one bound Astra named (the concatenated spelling could outgrow PATH_MAX), fixed in the seventeenth build `bffc76b5` with `fstatat` against the link's directory. 17 at `bffc76b5`: Opus accept with fixes, Astra reject; both named the same two new defects in that fix: the directory was opened by path with Go's default flags (a FIFO a tenant swaps in blocks the watch and Close; a device would have its driver's open run) and the long-target fixture failed under any short temp root (which is what failed the gate and CI). The eighteenth build opens the directory with `O_DIRECTORY|O_NONBLOCK|O_NOCTTY|O_CLOEXEC` (anything but a directory refused by the open itself; three mutants killed: default flags, `O_DIRECTORY` alone dropped, the fixed fixture size under `/var/tmp/ck`), sizes the fixture from the temp root, compares `render` across sections, and corrects the comments and names Astra listed; the false "package tests pass under /tmp" claim of the seventeenth build is marked false in its dispositions. 18 at `6249af63`: Opus accept (three P3s: the fixture's 3 KB link target, which XFS refuses; a tenant's file in a platform directory accepted under the tenant's tree and refused under the platform's; wording), Astra reject on the deep items (and the fixture's fixed depth). The nineteenth build `53e3dcd8` answers them (two mutants killed); 19 running. Each build's dispositions section lists its killed mutants. The deep items stay open and are listed there: litestream's own opens by path (every reopen), protected endpoints under tenant-replaceable ancestry, a delayed admitted request past the margin, requests across a crash or restart, the header open through a swapped ancestor (a walk by directory descriptor, required before wiring), a tenant sharing the platform's uid, root-run units and a route naming another user's coherent tree (approval H), hibernating aliases and claims on skipped files, required coverage that can vanish without an entry, whether one tenant's unaccepted links refuse the whole box (a decision before wiring), one tenant's deletion holding every account's days once (a stated cost). None of these is minor: the branch cannot be wired until they are closed or decided | not merged; unwired side work gated on approval H | |
| | `fix/carloku-observe-routes-cleanup-20261001` | `023e106c` | passed on `51587e00`; `023e106c` changes a test and two docs | passed | both accept at `51587e00` | merged into the launch branch at `47c97fa6` | |
| | `feat/carloku-paid-launch-20260916` (launch) | this commit: documents only on top of `3d47602b`; last code change the merge of the observe-routes fix (`47c97fa6`) | passed 03:06Z on `b953fae4` (`gate-launch-b953fae4.txt`, exit 0, three cross builds); every commit since is documents | passed on `3d47602b` | 17 rounds, no whole-branch pass | the integration target; first accepted side branch merged | |
| +| `feat/carloku-quantity-reduction-20261002` | `978ddc8a` (design only, off `68f6ee23`) | n/a (no code) | n/a | Astra's design review rejected revision 1 on four P1s (a request can cross the renewal and its confirmation proves nothing about the invoiced quantity; a future-dated assignment blocks every change before the renewal; a missed window postpones the reduction a year in silence; fence-only enablement leaves no path to restore returning seats). Revision 2 waits on three decisions that are Paul's (`2026-10-02-quantity-reduction-at-renewal-design.md`, last section) | OUTSTANDING 14 stays absent in code | |
| | site `feat/paid-pricing-20260916` (GitHub) | `4026231` (`build` and `check` render from the export before the draft check, so a stale page cannot be published past a newer export; a floor that is not whole cents is refused by the renderer rather than shown as `$1.20.5`; after `c12318d`: `bands.p3` replaced by the approved explanation, every priced slot, inclusion band and figure token pinned exactly) | `node --test test/*.test.mjs`: 21 pass (09:1xZ) | n/a | read-only by the currency reviews (section K); rounds four, five, ten, twelve to seventeen's site findings fixed | preview served at `http://100.119.180.57:38009` from the tree (rebuilt with the `bands.p3` change) | |
| ## The flow, behaviour the tests establish (2026-10-02) |