| index 1b14a4910..87a067eb9 100644 |
| --- a/implementation/carloku-paid-launch/READINESS.md |
| +++ b/implementation/carloku-paid-launch/READINESS.md |
| @@ -14,12 +14,12 @@ Log files are under `/home/paulca/.local/share/carloku-paid-launch-20260930/logs |
| |
| | Branch | Tip | Gate | CI | Reviews | State | |
| | --- | --- | --- | --- | --- | --- | |
| -| `feat/carloku-multi-currency-20261001` | `2b0abef1` (review twenty-seven's one comment correction, made before the merge as Opus allowed, without another review; the review-27 dispositions and reports); before it `9b872e38` (round twenty-six's fixes: the two-console test's losing-writer ordering requires `SQLITE_BUSY_SNAPSHOT` and its first ordering asserts the evidence's withdrawal; three comments, two design sentences and two dispositions claims corrected; no production code changed apart from comments); before it `35356ad0` (round twenty-five answered: the commit column's migration one transaction, with a regression that aborts the marking and sees the column roll back; the unconditional release moved to a `_test.go` file so no handler can release a committed reservation; two consoles at the point of no return tested on two connections to one file; the no-bucket preflight's release asserted); before it `1f1368b0` (round twenty-four answered: the committed retirement durable against every handler cleanup, the handler's commit tested, old reservations committed; round twenty-five's Opus P3s are in the worktree, uncommitted); before it `e152df30`, round twenty-three answered: a point of no return for an account's retirement; before it `2618403f` (round twenty-two answered: the rule's edges; before it `05ccec07`, round twenty-one answered as one rule: a subscription that names an intent is recorded from the first read, and nothing deletes an intent past one; before it `b260ac8e` (round twenty answered by making the evidence invariant structural: every provider read of a session or subscription goes through three recording methods, a parser test forbids any other; before it `43d326b5` (round nineteen answered as one evidence invariant; before it `59666bab`, stage one of the retirement protocol; before it `15041ca2`: round eighteen's bounded findings fixed; round eighteen's and the three design reviews' reports in the tree) (`68f6ee23`: the seventeenth review's findings: the review filed before the expiry on both paths, the `keep` door's replay, nil billing and purchase check, the rejected listing's account, order and bound, two new tests; reviews ten to seventeen's reports in the tree) | `2b0abef1`: running, alone (`gate-currency-2b0abef1.txt`). `9b872e38`: **passed** (00:42Z, `gate-currency-9b872e38.txt`, exit 0, three cross builds, alone). `35356ad0`: **passed** (23:57Z, `gate-currency-35356ad0.txt`, exit 0, three cross builds, alone; the full package run before the commit passed, console 538 s). `1f1368b0`: **passed** (23:33Z, `gate-currency-1f1368b0.txt`, exit 0, three cross builds, alone). `2618403f`: **failed** (22:28Z, `gate-currency-2618403f.txt`: one existing test whose expectation round twenty-two's own fix made out of date; corrected in `ef8d9440`); `e152df30`: **passed** (22:54Z, `gate-currency-e152df30.txt`, exit 0, three cross builds, alone). `05ccec07`: **passed** (22:04Z, `gate-currency-05ccec07.txt`, exit 0, three cross builds, alone, default cache); `2618403f`: started 22:18Z (`gate-currency-2618403f.txt`). passed on every code tip through `db130cfc` (`gate-currency-db130cfc.txt`, exit 0, three cross builds, clean tree); `68f6ee23`: passed (09:17Z, `gate-currency-68f6ee23.txt`, exit 0, three cross builds, clean tree); the console, plans and billingstripe packages passed in full on the same tree before the commit (console 525 s). `15041ca2`: passed (10:06Z, `gate-currency-15041ca2.txt`, exit 0, three cross builds); `59666bab`: passed (13:20Z, `gate-currency-59666bab.txt`, exit 0, three cross builds); `43d326b5`: **failed** (exit 2, `gate-currency-43d326b5-FAILED-e2e-build-toolchain-error.txt`): three root-package tests that build the binary failed with "is not in std" and "open …/gocache/…: no such file". Cause established: that gate inherited a scratch build cache (`~/.cache/tmp/gocache`) from the shell that started it, and the directory was deleted and recreated while it ran (its birth time is 17:15:07, after the 17:06 failures). Not a defect of the tree; `run-gate.sh` now unsets `GOCACHE` and prints the cache it uses. Not rerun on that tip. `b260ac8e`: **passed** (21:13Z, `gate-currency-b260ac8e.txt`, exit 0, three cross builds, default cache, run alone); the console, plans and billingstripe packages passed in full on the same tree before the commit (console 596 s, `currency-stage1-run3.txt`). Void or superseded logs, not evidence: `gate-currency-a9304f16.txt`, `gate-currency-f269365a-VOID-dirty-tree.txt`, `gate-currency-25487506-ended-on-28dc2629-reports-added-during-run.txt`, `gate-currency-db130cfc-VOID-dirty-tree-second-run.txt` (started by mistake on staged, uncommitted changes and stopped) | passed on every pushed tip through `2b0abef1` | **Round 27 (on `9b872e38`): both accept.** Opus accept (no P1 or P2; every review-26 finding closed; both strengthened assertions fail without their code; review eighteen's P2 remains closed; one P3, a comment, correctable before the merge without another review); Astra accept (no new P1, P2 or P3; nothing to fix on the branch; accepts the tip for the merge commit). **This is the merge round.** **Round 26 (on `35356ad0`): the first round in which both reviewers accept.** Opus accept (no P1 or P2; "review eighteen's P2 is closed on this branch"; three P3s); Astra accept with fixes (no new P1 or P2; "review eighteen's P2 is closed on this branch" under the roll rule; one P3 and seven claims), all answered in `9b872e38`. Review eighteen's P2 is recorded closed at that round. Round 25 answered in `35356ad0` (both reviewers' additions: the two-connection test and the release out of production code; Astra's P2, the migration). **Round 25 (on `1f1368b0`): Opus accept with fixes (no P1 or P2; three P3s; "for this binary, review eighteen's P2 is closed", wanting a two-connection test and the unconditional release out of production code, both now in the worktree); Astra's report pending at 00:38.** **Rounds 23 (on `2618403f`) and 24 (on `e152df30`): Opus accept with fixes, Astra reject, each time. Not accepted.** Opus found no P1 or P2 in either and said twice it would count review eighteen's P2 closed; Astra found one P2 each time at the account-retirement boundary (23: a dispute committed between the reservation and the tombstone; 24: a losing request's cleanup removing another's committed reservation), each real, each answered (a point of no return in the database; a release that touches only a pending reservation; the handler tested with a hook on the bucket). The round-24 answer is uncommitted at 00:05 and goes to round 25. **Round 22 (on `05ccec07`): Opus accept with fixes, Astra reject. Not accepted.** Opus: the named-subscription rule holds, review eighteen's P2 is closed for deletion and consumption; one P2 on what the rule costs an honest buyer whose provider left a dead subscription (answered as a test-mode gate, `ENABLEMENT.md` section 6 step 2, and decision 15, not as code); four P3s. Astra: three P2s at the rule's edges (account retirement under an open checkout dispute; a session-only refusal filed after another console recorded the purchase; a click racing a filing), one P3; all answered in `2618403f` with tests and nine mutants. Round 23 running on `2618403f`. Round 21 (on `b260ac8e`): Opus accept with fixes, Astra reject; answered in `05ccec07` (27 mutants; one defect found there by neither reviewer, a later event of a recorded subscription consuming the standing intent its metadata named). **Round 21 (on `b260ac8e`): Opus accept with fixes (one P2, three P3), Astra reject (three P2, two P3). Not accepted.** Both closed every round-twenty finding and both found the same new P2, opened by round twenty's own fix: a refusal can now be filed on an intent that never had a session, the 25-hour cleanup of such an intent ignores the review, and `retire` then passes with a subscription attached. Astra also: a subscription seen before any refusal vanishes when an ordinary purchase consumes the intent; the held currency and customer are not rechecked in the transaction that creates an intent (two consoles); a listing's first page is dropped when a later page fails; refusal retries are not fair beyond the budget. Opus also: a bind can move an intent under review onto another session; a hand-made subscription naming an intent whose session is open is retried, never reviewed; the store keys on the answer's id. Reports `logs/opus-currency-review21.md`, `astra-currency-review21.md`. **Review eighteen's P2 stays open.** Round 20 (on `43d326b5`): Opus accept with fixes, Astra reject; answered in `b260ac8e` (43 mutants in a tree copy, four survived the first run and have tests now). Rounds 1 to 9: Opus accept with fixes, Astra reject. Rounds 10 to 13: both accept with fixes (P3s). Round 14: Astra reject on a P2 (a reconciliation paused on the provider read while the operator resolved the review recorded the retired purchase), fixed in `abd1b76e`. Rounds 15 and 16: both accept with fixes, each closing what the previous fix left open in the intent's lifecycle (15: nothing records under an open review, the resolution retires or keeps; 16: `keep` only for an intent whose bound session is complete with a subscription, the outcome written, replay-compared and audited). Each fix has a test that fails without it and a killed mutant (dispositions, one section per round). Round 17 at `db130cfc`: Opus accept with fixes (four P3s on the `keep` door and the rejected listing), Astra reject on a P2: both sites that expire a bound session expired first and filed the review second, so a pass reading the expired session in between, or a crash between the two, retired the intent with no record; fixed in `68f6ee23` by filing first (a two-path race test runs the store's retirement inside the fake's expiry and wants the conflict; it fails with either site's order put back), with the P3s, two new tests (an older resolutions table migrates with `retire`; the listing's 200-row bound, newest first, account on each row) and the comments and design sentence both named. The first form of the listing's account fix looked the account up under open rows and deadlocked the store's one connection in the test; rows are read to the end first. Round 18 at `68f6ee23`: Opus accept with fixes, Astra reject, on the same P2: with the review now filed before the expiry, an operator's `retire` can delete the intent while its bound session is still open and payable (the expiry failed; nothing retries it; the resume path still offers the URL). The supervisor ruled that this is not fixed by moving calls again but by a durable protocol (recorded refusal authoritative; the session's fate proven from provider evidence and recorded; atomic operator completion; a paid session settled by a separate disposition) with one bounded design review before another implementation cycle. Revision 1 of that design (`8c72e88b`) was rejected by Astra (four P2s), and revision 2 (`b4ff6b72`) too (five P2s: the hand-made subscription's own obligations at `retire`; the settlement predicate; observation times against cached answers; which evidence a dispute's resolution makes authoritative; the migration barrier). Revision 3 (`15041ca2`) was rejected a third time (four P2s, each with a conservative hold as its smallest change); revision 4 applies those holds and is built as **stage one** in `59666bab` (`billingretirement.go`): the operator's `retire` is accepted only for a session proven expired and unpaid by a provider read with nothing attached and nothing contradictory; `keep` only for a completed, paid session with no subscription attached but its own; a paid session that is not kept, any case a hand-made subscription touched, any contradicted case and every review from before the build are held; the door requests the expiry and answers 503 while it is unproven; the pass retries on a schedule; a click under review gets no URL; contradictions are disputes; a delete barrier stops an older binary. Eight tests, one per interleaving; eleven existing tests reworked; seventeen mutants killed. **Round nineteen did not accept it**: Opus accept with fixes (one P2, six P3s), Astra reject (three P2s): a subscription on the purchase's own terms was never attached, so `keep` could release the review beside it; the refusal and its subscription were two transactions; the keep gate's fresh read was not recorded as evidence; contradictions arriving after a retirement or a kept purchase's record, or read by an actor with a stale view, were dropped. These are answered in `43d326b5` as one invariant (every provider observation about a refused purchase classified and recorded in one store transaction against the purchase as it stands, retired, or kept and consumed; a refusal and its subscription one transaction; a caller records before it answers; nothing dropped), with seven counterexample tests, four reworked, and twenty mutants killed. Round twenty (Opus and Astra) is reading it. **Review eighteen's P2 stays open and blocks the merge until a round accepts this code.** No test runs two console processes against one database; the interleavings are driven through the store and provider hooks, and the dispositions say so. The bounded findings of round eighteen are fixed there with tests and four killed mutants (attribution of a retired session's completion beside a replacement; a `keep` decided during the gate answered by the replay comparison; the nil-billing and tie-break tests). The findings since round ten were not minor: each was a real gap in the lifecycle of an intent under review, and the rounds have converged on the operator's door rather than the money path | integrated end to end; **merges into this branch as a merge commit once the gate passes on `2b0abef1` (CI has passed on it)**; before: integrated end to end; not merged; the merge waits on a round ending with both accepting and nothing left to fix, and CI on the tip | |
| +| `feat/carloku-multi-currency-20261001` | `2b0abef1` (review twenty-seven's one comment correction, made before the merge as Opus allowed, without another review; the review-27 dispositions and reports); before it `9b872e38` (round twenty-six's fixes: the two-console test's losing-writer ordering requires `SQLITE_BUSY_SNAPSHOT` and its first ordering asserts the evidence's withdrawal; three comments, two design sentences and two dispositions claims corrected; no production code changed apart from comments); before it `35356ad0` (round twenty-five answered: the commit column's migration one transaction, with a regression that aborts the marking and sees the column roll back; the unconditional release moved to a `_test.go` file so no handler can release a committed reservation; two consoles at the point of no return tested on two connections to one file; the no-bucket preflight's release asserted); before it `1f1368b0` (round twenty-four answered: the committed retirement durable against every handler cleanup, the handler's commit tested, old reservations committed; round twenty-five's Opus P3s are in the worktree, uncommitted); before it `e152df30`, round twenty-three answered: a point of no return for an account's retirement; before it `2618403f` (round twenty-two answered: the rule's edges; before it `05ccec07`, round twenty-one answered as one rule: a subscription that names an intent is recorded from the first read, and nothing deletes an intent past one; before it `b260ac8e` (round twenty answered by making the evidence invariant structural: every provider read of a session or subscription goes through three recording methods, a parser test forbids any other; before it `43d326b5` (round nineteen answered as one evidence invariant; before it `59666bab`, stage one of the retirement protocol; before it `15041ca2`: round eighteen's bounded findings fixed; round eighteen's and the three design reviews' reports in the tree) (`68f6ee23`: the seventeenth review's findings: the review filed before the expiry on both paths, the `keep` door's replay, nil billing and purchase check, the rejected listing's account, order and bound, two new tests; reviews ten to seventeen's reports in the tree) | `2b0abef1`: **passed** (00:51Z, `gate-currency-2b0abef1.txt`, exit 0, three cross builds, alone). `9b872e38`: **passed** (00:42Z, `gate-currency-9b872e38.txt`, exit 0, three cross builds, alone). `35356ad0`: **passed** (23:57Z, `gate-currency-35356ad0.txt`, exit 0, three cross builds, alone; the full package run before the commit passed, console 538 s). `1f1368b0`: **passed** (23:33Z, `gate-currency-1f1368b0.txt`, exit 0, three cross builds, alone). `2618403f`: **failed** (22:28Z, `gate-currency-2618403f.txt`: one existing test whose expectation round twenty-two's own fix made out of date; corrected in `ef8d9440`); `e152df30`: **passed** (22:54Z, `gate-currency-e152df30.txt`, exit 0, three cross builds, alone). `05ccec07`: **passed** (22:04Z, `gate-currency-05ccec07.txt`, exit 0, three cross builds, alone, default cache); `2618403f`: started 22:18Z (`gate-currency-2618403f.txt`). passed on every code tip through `db130cfc` (`gate-currency-db130cfc.txt`, exit 0, three cross builds, clean tree); `68f6ee23`: passed (09:17Z, `gate-currency-68f6ee23.txt`, exit 0, three cross builds, clean tree); the console, plans and billingstripe packages passed in full on the same tree before the commit (console 525 s). `15041ca2`: passed (10:06Z, `gate-currency-15041ca2.txt`, exit 0, three cross builds); `59666bab`: passed (13:20Z, `gate-currency-59666bab.txt`, exit 0, three cross builds); `43d326b5`: **failed** (exit 2, `gate-currency-43d326b5-FAILED-e2e-build-toolchain-error.txt`): three root-package tests that build the binary failed with "is not in std" and "open …/gocache/…: no such file". Cause established: that gate inherited a scratch build cache (`~/.cache/tmp/gocache`) from the shell that started it, and the directory was deleted and recreated while it ran (its birth time is 17:15:07, after the 17:06 failures). Not a defect of the tree; `run-gate.sh` now unsets `GOCACHE` and prints the cache it uses. Not rerun on that tip. `b260ac8e`: **passed** (21:13Z, `gate-currency-b260ac8e.txt`, exit 0, three cross builds, default cache, run alone); the console, plans and billingstripe packages passed in full on the same tree before the commit (console 596 s, `currency-stage1-run3.txt`). Void or superseded logs, not evidence: `gate-currency-a9304f16.txt`, `gate-currency-f269365a-VOID-dirty-tree.txt`, `gate-currency-25487506-ended-on-28dc2629-reports-added-during-run.txt`, `gate-currency-db130cfc-VOID-dirty-tree-second-run.txt` (started by mistake on staged, uncommitted changes and stopped) | passed on every pushed tip through `2b0abef1` | **Round 27 (on `9b872e38`): both accept.** Opus accept (no P1 or P2; every review-26 finding closed; both strengthened assertions fail without their code; review eighteen's P2 remains closed; one P3, a comment, correctable before the merge without another review); Astra accept (no new P1, P2 or P3; nothing to fix on the branch; accepts the tip for the merge commit). **This is the merge round.** **Round 26 (on `35356ad0`): the first round in which both reviewers accept.** Opus accept (no P1 or P2; "review eighteen's P2 is closed on this branch"; three P3s); Astra accept with fixes (no new P1 or P2; "review eighteen's P2 is closed on this branch" under the roll rule; one P3 and seven claims), all answered in `9b872e38`. Review eighteen's P2 is recorded closed at that round. Round 25 answered in `35356ad0` (both reviewers' additions: the two-connection test and the release out of production code; Astra's P2, the migration). **Round 25 (on `1f1368b0`): Opus accept with fixes (no P1 or P2; three P3s; "for this binary, review eighteen's P2 is closed", wanting a two-connection test and the unconditional release out of production code, both now in the worktree); Astra's report pending at 00:38.** **Rounds 23 (on `2618403f`) and 24 (on `e152df30`): Opus accept with fixes, Astra reject, each time. Not accepted.** Opus found no P1 or P2 in either and said twice it would count review eighteen's P2 closed; Astra found one P2 each time at the account-retirement boundary (23: a dispute committed between the reservation and the tombstone; 24: a losing request's cleanup removing another's committed reservation), each real, each answered (a point of no return in the database; a release that touches only a pending reservation; the handler tested with a hook on the bucket). The round-24 answer is uncommitted at 00:05 and goes to round 25. **Round 22 (on `05ccec07`): Opus accept with fixes, Astra reject. Not accepted.** Opus: the named-subscription rule holds, review eighteen's P2 is closed for deletion and consumption; one P2 on what the rule costs an honest buyer whose provider left a dead subscription (answered as a test-mode gate, `ENABLEMENT.md` section 6 step 2, and decision 15, not as code); four P3s. Astra: three P2s at the rule's edges (account retirement under an open checkout dispute; a session-only refusal filed after another console recorded the purchase; a click racing a filing), one P3; all answered in `2618403f` with tests and nine mutants. Round 23 running on `2618403f`. Round 21 (on `b260ac8e`): Opus accept with fixes, Astra reject; answered in `05ccec07` (27 mutants; one defect found there by neither reviewer, a later event of a recorded subscription consuming the standing intent its metadata named). **Round 21 (on `b260ac8e`): Opus accept with fixes (one P2, three P3), Astra reject (three P2, two P3). Not accepted.** Both closed every round-twenty finding and both found the same new P2, opened by round twenty's own fix: a refusal can now be filed on an intent that never had a session, the 25-hour cleanup of such an intent ignores the review, and `retire` then passes with a subscription attached. Astra also: a subscription seen before any refusal vanishes when an ordinary purchase consumes the intent; the held currency and customer are not rechecked in the transaction that creates an intent (two consoles); a listing's first page is dropped when a later page fails; refusal retries are not fair beyond the budget. Opus also: a bind can move an intent under review onto another session; a hand-made subscription naming an intent whose session is open is retried, never reviewed; the store keys on the answer's id. Reports `logs/opus-currency-review21.md`, `astra-currency-review21.md`. **Review eighteen's P2 stays open.** Round 20 (on `43d326b5`): Opus accept with fixes, Astra reject; answered in `b260ac8e` (43 mutants in a tree copy, four survived the first run and have tests now). Rounds 1 to 9: Opus accept with fixes, Astra reject. Rounds 10 to 13: both accept with fixes (P3s). Round 14: Astra reject on a P2 (a reconciliation paused on the provider read while the operator resolved the review recorded the retired purchase), fixed in `abd1b76e`. Rounds 15 and 16: both accept with fixes, each closing what the previous fix left open in the intent's lifecycle (15: nothing records under an open review, the resolution retires or keeps; 16: `keep` only for an intent whose bound session is complete with a subscription, the outcome written, replay-compared and audited). Each fix has a test that fails without it and a killed mutant (dispositions, one section per round). Round 17 at `db130cfc`: Opus accept with fixes (four P3s on the `keep` door and the rejected listing), Astra reject on a P2: both sites that expire a bound session expired first and filed the review second, so a pass reading the expired session in between, or a crash between the two, retired the intent with no record; fixed in `68f6ee23` by filing first (a two-path race test runs the store's retirement inside the fake's expiry and wants the conflict; it fails with either site's order put back), with the P3s, two new tests (an older resolutions table migrates with `retire`; the listing's 200-row bound, newest first, account on each row) and the comments and design sentence both named. The first form of the listing's account fix looked the account up under open rows and deadlocked the store's one connection in the test; rows are read to the end first. Round 18 at `68f6ee23`: Opus accept with fixes, Astra reject, on the same P2: with the review now filed before the expiry, an operator's `retire` can delete the intent while its bound session is still open and payable (the expiry failed; nothing retries it; the resume path still offers the URL). The supervisor ruled that this is not fixed by moving calls again but by a durable protocol (recorded refusal authoritative; the session's fate proven from provider evidence and recorded; atomic operator completion; a paid session settled by a separate disposition) with one bounded design review before another implementation cycle. Revision 1 of that design (`8c72e88b`) was rejected by Astra (four P2s), and revision 2 (`b4ff6b72`) too (five P2s: the hand-made subscription's own obligations at `retire`; the settlement predicate; observation times against cached answers; which evidence a dispute's resolution makes authoritative; the migration barrier). Revision 3 (`15041ca2`) was rejected a third time (four P2s, each with a conservative hold as its smallest change); revision 4 applies those holds and is built as **stage one** in `59666bab` (`billingretirement.go`): the operator's `retire` is accepted only for a session proven expired and unpaid by a provider read with nothing attached and nothing contradictory; `keep` only for a completed, paid session with no subscription attached but its own; a paid session that is not kept, any case a hand-made subscription touched, any contradicted case and every review from before the build are held; the door requests the expiry and answers 503 while it is unproven; the pass retries on a schedule; a click under review gets no URL; contradictions are disputes; a delete barrier stops an older binary. Eight tests, one per interleaving; eleven existing tests reworked; seventeen mutants killed. **Round nineteen did not accept it**: Opus accept with fixes (one P2, six P3s), Astra reject (three P2s): a subscription on the purchase's own terms was never attached, so `keep` could release the review beside it; the refusal and its subscription were two transactions; the keep gate's fresh read was not recorded as evidence; contradictions arriving after a retirement or a kept purchase's record, or read by an actor with a stale view, were dropped. These are answered in `43d326b5` as one invariant (every provider observation about a refused purchase classified and recorded in one store transaction against the purchase as it stands, retired, or kept and consumed; a refusal and its subscription one transaction; a caller records before it answers; nothing dropped), with seven counterexample tests, four reworked, and twenty mutants killed. Round twenty (Opus and Astra) is reading it. **Review eighteen's P2 stays open and blocks the merge until a round accepts this code.** No test runs two console processes against one database; the interleavings are driven through the store and provider hooks, and the dispositions say so. The bounded findings of round eighteen are fixed there with tests and four killed mutants (attribution of a retired session's completion beside a replacement; a `keep` decided during the gate answered by the replay comparison; the nil-billing and tie-break tests). The findings since round ten were not minor: each was a real gap in the lifecycle of an intent under review, and the rounds have converged on the operator's door rather than the money path | **merged into this branch at `d64180a7` (01:55, a merge commit; the gate passed alone on `2b0abef1` at 00:51Z and CI passed; one conflict in `stripe-provisioning.md` resolved keeping both corrections)**; before: integrated end to end; not merged; the merge waits on a round ending with both accepting and nothing left to fix, and CI on the tip | |
| | `feat/carloku-billing-layout-20261001` | `c1ae91a0` | (templates only; gated inside the currency branch) | passed | none of its own | merged into the currency branch at `5047494b`; its two-form layout was replaced by one form in `8958392b` | |
| | `feat/carloku-storage-sole-holder-20261001` | `eaf6e63e` | passed on `3af02a65`; `eaf6e63e` is wording and reports | passed | 9 rounds; round 9 both accept (omitted-holder class closed) | needs approval K and a recorded cutover date; not merged | |
| | `feat/carloku-metered-replicator-20261001` | `e1280811` (review twenty answered with comments, a fixture and dispositions only; the code is the twentieth build `c9ec11eb`: a tree claim refuses a tenant's file in a platform directory too, the fixture's guard reachable, the no-recorder refusal quoted; after `53e3dcd8`, the nineteenth build: a tenant's file in a platform directory refused in both layouts, the long-target fixture within the pathname budget and under XFS's link limit, refusal messages quoted; after `6249af63`, the eighteenth; reviews eight to eighteen's reports in the tree) | passed on every code tip through `f306222c`, then **failed on `bffc76b5`** (`gate-replicator-bffc76b5.txt`, exit 2: the seventeenth build's long-target fixture held only under a temp root of about 34 bytes or more; the gate's `/var/tmp/ck` is shorter), passed on `6249af63` (09:04Z, `gate-replicator-6249af63.txt`, exit 0, three cross builds, clean tree); `53e3dcd8`: passed (09:38Z, `gate-replicator-53e3dcd8.txt`, exit 0, three cross builds); `c9ec11eb`: passed (09:52Z, `gate-replicator-c9ec11eb.txt`, exit 0, three cross builds); `e1280811`: passed (10:10Z, `gate-replicator-e1280811.txt`, exit 0, three cross builds). Void: `gate-replicator-e8211fc6-VOID-stopped-for-astra17-followup.txt` (stopped so Astra's report could be answered in the same build) | passed through `f306222c`; **failed on `bffc76b5`** (the same fixture); passed on `6249af63`, `53e3dcd8`, `c9ec11eb` and `e1280811` | 4 to 7: each Opus accept with fixes, Astra reject; 8: both reject on one P1 the eighth build made (fixed in the ninth); 9 to 15: Opus accept with fixes, Astra reject, each round finding the previous build's own addition wanting (15 at `03b19014`: the fifteenth build joined a relative link target and so cleaned a `..` the kernel resolves physically, a regression that let a link to a directory outside the tree pass in silence; fixed in the sixteenth build by concatenating uncleaned, with the fixture both asked for); 16 at `f306222c`: Opus accept with fixes, Astra reject; both found the fifteenth's regression closed and one bound Astra named (the concatenated spelling could outgrow PATH_MAX), fixed in the seventeenth build `bffc76b5` with `fstatat` against the link's directory. 17 at `bffc76b5`: Opus accept with fixes, Astra reject; both named the same two new defects in that fix: the directory was opened by path with Go's default flags (a FIFO a tenant swaps in blocks the watch and Close; a device would have its driver's open run) and the long-target fixture failed under any short temp root (which is what failed the gate and CI). The eighteenth build opens the directory with `O_DIRECTORY|O_NONBLOCK|O_NOCTTY|O_CLOEXEC` (anything but a directory refused by the open itself; three mutants killed: default flags, `O_DIRECTORY` alone dropped, the fixed fixture size under `/var/tmp/ck`), sizes the fixture from the temp root, compares `render` across sections, and corrects the comments and names Astra listed; the false "package tests pass under /tmp" claim of the seventeenth build is marked false in its dispositions. 18 at `6249af63`: Opus accept (three P3s: the fixture's 3 KB link target, which XFS refuses; a tenant's file in a platform directory accepted under the tenant's tree and refused under the platform's; wording), Astra reject on the deep items (and the fixture's fixed depth). The nineteenth build `53e3dcd8` answers them (two mutants killed). 19 at `53e3dcd8`: Opus accept (two P3s), Astra reject on the deep items; the twentieth build `c9ec11eb` makes the bounded changes (one mutant killed) and its dispositions list the deferred items separately, each as blocking wiring and needing a design or a decision. 20 at `c9ec11eb`: Opus accept with fixes, Astra reject on the deep items; `e1280811` changes no behaviour and is not sent for another round; the two refusals Opus named as decisions are in `DECISIONS-FOR-PAUL.md` (11, 12). Each build's dispositions section lists its killed mutants. The deep items stay open and are listed there: litestream's own opens by path (every reopen), protected endpoints under tenant-replaceable ancestry, a delayed admitted request past the margin, requests across a crash or restart, the header open through a swapped ancestor (a walk by directory descriptor, required before wiring), a tenant sharing the platform's uid, root-run units and a route naming another user's coherent tree (approval H), hibernating aliases and claims on skipped files, required coverage that can vanish without an entry, whether one tenant's unaccepted links refuse the whole box (a decision before wiring), one tenant's deletion holding every account's days once (a stated cost). None of these is minor: the branch cannot be wired until they are closed or decided | not merged; unwired side work gated on approval H | |
| | `fix/carloku-observe-routes-cleanup-20261001` | `023e106c` | passed on `51587e00`; `023e106c` changes a test and two docs | passed | both accept at `51587e00` | merged into the launch branch at `47c97fa6` | |
| -| `feat/carloku-paid-launch-20260916` (launch) | this commit: documents only on top of `3d47602b`; last code change the merge of the observe-routes fix (`47c97fa6`) | passed 03:06Z on `b953fae4` (`gate-launch-b953fae4.txt`, exit 0, three cross builds); every commit since is documents | passed on `3d47602b` | 17 rounds, no whole-branch pass | the integration target; first accepted side branch merged | |
| +| `feat/carloku-paid-launch-20260916` (launch) | this commit: documents only on top of `d64180a7`, the merge of the currency branch (2026-10-03 01:55); before it `c4ee8807`, the merge of the AWS principal report; before those, documents on top of `3d47602b` and the merge of the observe-routes fix (`47c97fa6`) | the gate on this commit (the first after the currency merge) runs next, alone; `0491ff76` (the inventory merge plus records): **passed** (00:46Z, `gate-launch-0491ff76.txt`, exit 0, three cross builds). passed 03:06Z on `b953fae4` (`gate-launch-b953fae4.txt`, exit 0, three cross builds); every commit since is documents | passed on `3d47602b` | 17 rounds, no whole-branch pass | **the currency branch and the AWS principal report are merged in; the operator CLI (`fc7daebd`, a merge of `2b0abef1`) waits on Paul's reading of its public section; everything else is as listed below.** the integration target; first accepted side branch merged | |
| | `feat/carloku-quantity-reduction-20261002` | `978ddc8a` (design only, off `68f6ee23`) | n/a (no code) | n/a | Astra's design review rejected revision 1 on four P1s (a request can cross the renewal and its confirmation proves nothing about the invoiced quantity; a future-dated assignment blocks every change before the renewal; a missed window postpones the reduction a year in silence; fence-only enablement leaves no path to restore returning seats). Revision 2 waits on three decisions that are Paul's (`2026-10-02-quantity-reduction-at-renewal-design.md`, last section) | OUTSTANDING 14 stays absent in code | |
| | `feat/carloku-flush-only-class-20261002` | `5f43a0e4` (off the launch branch at `65363554`; a unit-backed route's rung can be cleared; the test waits for the start-up snapshot; after `5c327226`): the `hibernate-flush` word in the registry's vocabulary and the activator's interval map, **withdrawn from the rungs on offer and set by nothing**; the CLI rail refuses any rung on a unit-backed route | `0e8ea227` **failed** (the CLI's word test; `gate-flush-0e8ea227-FAILED-cli-word-test-stopped.txt`); `5c327226` passed (12:54Z); `5f43a0e4` passed (13:35Z, `gate-flush-5f43a0e4.txt`, exit 0, three cross builds) | `0e8ea227` failed; `5c327226` and `5f43a0e4` passed | 1 at `0e8ea227`: Opus accept with fixes, Astra reject: the ten-year interval does not give "wake and sleep only" against the vendored litestream (daily snapshot while awake; the awake backlog waits for a 30-second flush at sleep; the local log untrimmed), so the class's contract is decision 10a and nothing of its options is built; the inherited defect Astra found (`Replicator.Close` can return nil having flushed nothing) is forge discussion 200. 2 at `5c327226`: both accept with fixes (the unit-backed refusal blocked clearing an existing rung; the test raced the start-up snapshot; listings print the raw word; three inaccurate statements), fixed in `5f43a0e4`, which has not been read by a reviewer. Stated open and unchanged: `Replicator.Close` can return nil having flushed nothing and a failed flush still ends in hibernation (inherited, every class, forge discussion 200); the unbounded awake backlog; no verified wake boundary; class-blind restore drill and lag thresholds | **does not implement the Free plan's durability**; not mergeable as a feature until 10a; the rest of OUTSTANDING 15 waits on who is Free | |
| | `feat/carloku-billing-operator-cli-20261002` | `40ea61b1` (a merge of the currency tip `35356ad0`); before it `6d4c2912` (the fourth review's P3s answered: `account_deleted` always on the wire and printed; the console's own 5xx on a write; the moved console after the offer; the help's two facts); before it `4e9cac43` (`f9683fbe`: the third review's twelve P3s answered: a write names its console or is refused; refusals from in front of the console; the moved console through the interactive offer; the whole command tested through `runBillingWith`; then the currency tip `e152df30` merged in); before it `31731fdd` (Astra's second review answered in `f155e543`: ambiguous flag values refused, the keep wording, strict listing envelopes, write advice that fits the write, the console's note predicate, `billingRun` tested; then the currency tip `05ccec07` merged in); before it `51ef27ac` (the first review answered in `57f70c16`, then the currency tip `b260ac8e` merged in): `carlos billing reviews\|resolve\|rejected\|house`, a client for the four operator doors | `40ea61b1`: **passed** (00:08Z, `gate-opcli-40ea61b1.txt`, exit 0, three cross builds, alone). `6d4c2912` was not gated on its own (superseded by the merge). `4e9cac43`: **passed** (23:09Z, `gate-opcli-4e9cac43.txt`, exit 0, three cross builds, alone). `51ef27ac`: **passed** (21:29Z, exit 0, three cross builds); `31731fdd`: **passed** (22:16Z, `gate-opcli-31731fdd.txt`, exit 0, three cross builds). `0f507bff` **failed** (exit 2, `gate-opcli-0f507bff.txt`): one test, the docs gate, which requires a `carlos billing` heading in the public CLI reference. `51ef27ac`: started 21:18Z, run alone (`gate-opcli-51ef27ac.txt`) | passed on `6d4c2912` and `40ea61b1`; `0f507bff` failed (the docs gate) | 4 at `4e9cac43`: **both accept with fixes, all P3**, answered in `6d4c2912` (CI passed); no fifth review unless the client changes. 3 at `31731fdd`: **both accept with fixes** (six P3 each), answered in `f9683fbe`; a fourth reading not started. 2 at `51ef27ac`: Astra accept with fixes (three P2, six P3), answered in `f155e543`; Opus's second reading and Astra's third running on `31731fdd`. 1 at `0f507bff`: Opus accept with fixes (P1 the docs gate, four P2), Astra reject (five P2). Answered in `57f70c16`: arguments are one unambiguous request or refused before anything is sent; writes are reported only on the door's acknowledgement and name the console; one wire-contract file both sides' tests read. Second review not started | not merged (it is built on the currency branch, which merges first). **Its `docs/site/cli.md` section is new public copy and is unreviewed**: it does not merge before Paul reads it |
amadan