amadan
Readiness and handoff at 10:20: round seventeen's P2 in the refusal's order fixed (the review before the expiry at both sites) and round eighteen running; the replicator's eighteenth build after its seventeenth failed the gate on its own fixture
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
4 files changed,
+19
−16
.claude/HANDOFF.md+8 −8implementation/carloku-paid-launch/ENABLEMENT.md+5 −2implementation/carloku-paid-launch/OUTSTANDING.md+1 −1implementation/carloku-paid-launch/READINESS.md+5 −5
CI passed — run details
diff --git a/.claude/HANDOFF.md b/.claude/HANDOFF.md| index 3c1b21eb3..905adbd8a 100644 |
| --- a/.claude/HANDOFF.md |
| +++ b/.claude/HANDOFF.md |
| @@ -7,39 +7,39 @@ |
| Get Carloku's paid plans live with Stripe Tax and the complete metered model; have the pricing page and signup flow reviewable in the morning. |
| **STATUS:** |
| -Written 09:15 Dublin on 2026-10-02 (the session hit a provider limit at about 08:00 Dublin and resumed at 08:40; nothing was lost: the uncommitted round-fifteen edits were intact and are now committed), during the second overnight run (brief: "continue overnight until we're ready to enable payments"; ready means reviewed, tested, integrated code and a scoped enablement plan, not payments switched on). Billing is OFF everywhere. No live Stripe write, no AWS change, no charge, no merge to main. Every payment anyone can see is a labelled simulation. |
| +Written 10:20 Dublin on 2026-10-02 (the session hit a provider limit at about 08:00 Dublin and resumed at 08:40; nothing was lost), during the second overnight run (brief: "continue overnight until we're ready to enable payments"; ready means reviewed, tested, integrated code and a scoped enablement plan, not payments switched on). Billing is OFF everywhere. No live Stripe write, no AWS change, no charge, no merge to main. Every payment anyone can see is a labelled simulation. |
| -Review servers, all answering 200: pricing page `http://100.119.180.57:38009` (static, rebuilt from site `2fc6388`), signup and billing demo `http://100.119.180.57:41881` (rebuilt 09:1x from the currency branch's tip `db130cfc`, price book configured, USD/EUR/GBP end to end; Keymail and Stripe simulated), console billing copy `http://100.119.180.57:45033` if still up. |
| +Review servers, all answering 200: pricing page `http://100.119.180.57:38009` (static, rebuilt from site `2fc6388`), signup and billing demo `http://100.119.180.57:41881` (rebuilt 10:10 from the currency branch's tip `68f6ee23`, price book configured, USD/EUR/GBP end to end; Keymail and Stripe simulated), console billing copy `http://100.119.180.57:45033` if still up. |
| The durable records are on this branch under `implementation/carloku-paid-launch/`: `READINESS.md` (every branch's tip, gate log, CI and review state, with the verified behaviour), `ENABLEMENT.md` (the scoped plan to enable payments: catalog of 36, cutovers, key permissions, webhook, portal, release order, rollback, approvals), `OVERAGE-RATES-PROPOSAL.md` (the USD/GBP rate table for approval), `stripe-live-readiness.json` (remaining list revised for 36 prices and the book), `OUTSTANDING.md` (the metered model's open items and approvals A to K). |
| Decisions received 2026-10-01 evening, applied: the annual bases (28/24/22, 6/5/4.50, 60/50/45 USD/EUR/GBP, team minimum ten) confirmed for implementation only; the currency rulings (USD default, EUR for EU member states, GBP for the UK, visible override, one stored currency for subscription and overages, bands by billing country only); the five currency strings and the regrouped pricing page copy, approved verbatim and applied. Still a draft: the book `2026-10-01-draft1` and the USD/GBP overage rates and floors. |
| Branches (all on the forge, none merged; the local gate is not CI): |
| -- `feat/carloku-multi-currency-20261001` `db130cfc`: the price book and one stored currency per purchase end to end, the billing page as one form with a server-signed quote, ownership on every path, the refusal review keyed by its intent with the session recorded, the cookies, the demo. Rounds ten to thirteen ended with both reviewers accepting with P3 fixes; **round fourteen did not: Astra found a P2** (a first purchase's record and its intent's retirement were two transactions under no common lock, so a reconciliation paused on the provider read while the operator resolved the review recorded the retired purchase). Fixed in `abd1b76e`: the record consumes the exact standing intent in its own transaction, and the same lifecycle holds on every path (an intent under an open review is never retired by an expiry; a retired intent's completion and subscription events are settled, not retried; a refusal whose session read came back as another session files nothing), with tests that fail without each fix and six killed mutants (dispositions "Review fourteen"). Round fifteen (both accept with fixes) found the last exception to that lifecycle, a purchase corrected at the provider recording under its open review; `3527a066` closes it by the ruling: nothing records on an intent under an open review, and the operator's resolution retires the intent (default) or keeps it (`outcome: keep`) for the corrected purchase to record; a retired intent's events settle whatever intent stands. Round sixteen (both accept with fixes) tightened the new `keep` outcome: it is accepted only for an intent whose bound session reads back complete with a subscription (anything else would later expire unrecorded), and the outcome is written, replay-compared and audited; `db130cfc` carries those fixes, the operator's rejected-events listing (`GET /api/billing/rejected`, named missing by both reviewers since round eleven) and the provisioning script's currency-option notes aligned with the code. Gate and CI passed through `3527a066`; gate on `db130cfc` running at 09:15, CI pending; the seventeenth review is reading it. These findings were not minor: each round since ten found a real gap in the lifecycle of an intent under review; the last three rounds converged on the operator's door rather than the money path. |
| -- `feat/carloku-metered-replicator-20261001` `f306222c`: sixteenth build. Reviews ten to fourteen (Opus accept with fixes, Astra reject) each found the previous build's own addition wanting; the fourteenth build made the link entry one to one and the fifteenth quotes every entry in the inventory's rendering (the drift key), classifies a link by the spelling its entry names, and makes the Accept test tell as-written from cleaned. Review fifteen (Opus accept with fixes, Astra reject on the deep items) found a regression the fifteenth build made: a relative link target was joined and so cleaned, which is not how the kernel resolves a `..` after a link, so a link to a directory outside the tree passed in silence; the sixteenth build concatenates uncleaned, with the fixture both asked for. Gate and CI passed on `03b19014`; gate and CI on `f306222c` running; the sixteenth review is reading it. The seventeenth build will carry Astra's fifteenth report, the render test over every category and the registry witness's wording. The deep items stay open and are listed in `READINESS.md`; none is minor, and the branch cannot be wired until they are closed or decided (the walk by directory descriptor, litestream's opens by path, durable transition state, the uid binding under approval H, the box-wide refusal decision). |
| +- `feat/carloku-multi-currency-20261001` `68f6ee23`: the price book and one stored currency per purchase end to end, the billing page as one form with a server-signed quote, ownership on every path, the refusal review keyed by its intent with the session recorded, the cookies, the demo. Rounds ten to thirteen ended with both reviewers accepting with P3 fixes; **round fourteen did not: Astra found a P2** (a first purchase's record and its intent's retirement were two transactions under no common lock, so a reconciliation paused on the provider read while the operator resolved the review recorded the retired purchase). Fixed in `abd1b76e`: the record consumes the exact standing intent in its own transaction, and the same lifecycle holds on every path (an intent under an open review is never retired by an expiry; a retired intent's completion and subscription events are settled, not retried; a refusal whose session read came back as another session files nothing), with tests that fail without each fix and six killed mutants (dispositions "Review fourteen"). Round fifteen (both accept with fixes) found the last exception to that lifecycle, a purchase corrected at the provider recording under its open review; `3527a066` closes it by the ruling: nothing records on an intent under an open review, and the operator's resolution retires the intent (default) or keeps it (`outcome: keep`) for the corrected purchase to record; a retired intent's events settle whatever intent stands. Round sixteen (both accept with fixes) tightened the new `keep` outcome: it is accepted only for an intent whose bound session reads back complete with a subscription (anything else would later expire unrecorded), and the outcome is written, replay-compared and audited; `db130cfc` carries those fixes, the operator's rejected-events listing (`GET /api/billing/rejected`, named missing by both reviewers since round eleven) and the provisioning script's currency-option notes aligned with the code. Round seventeen did not confirm either: Opus accepted with four P3s on the `keep` door and the rejected listing; **Astra found a P2 in the refusal's own order**: both sites that expire a bound session expired first and filed the review second, so a pass that read the expired session in between, or a crash between the two, retired the intent with no record. `68f6ee23` files the review first at both sites (a two-path race test runs the store's retirement inside the fake's expiry and wants the conflict; it fails with either order put back), closes the four P3s, adds two tests (an older resolutions table migrates with `retire`; the listing's 200-row bound, newest first, the account on each row) and corrects the comments and the design sentence both reviewers named. Gate and CI passed through `db130cfc`; gate and CI on `68f6ee23` running at 10:20; the eighteenth review is reading it. These findings were not minor: each round since ten found a real gap in the lifecycle of an intent under review; the last three rounds converged on the operator's door rather than the money path. |
| +- `feat/carloku-metered-replicator-20261001` `6249af63`: eighteenth build. Reviews ten to fourteen (Opus accept with fixes, Astra reject) each found the previous build's own addition wanting; the fourteenth build made the link entry one to one and the fifteenth quotes every entry in the inventory's rendering (the drift key), classifies a link by the spelling its entry names, and makes the Accept test tell as-written from cleaned. Review fifteen (Opus accept with fixes, Astra reject on the deep items) found a regression the fifteenth build made: a relative link target was joined and so cleaned, which is not how the kernel resolves a `..` after a link, so a link to a directory outside the tree passed in silence; the sixteenth build concatenates uncleaned, with the fixture both asked for. Review sixteen (both) found that fixed and one bound left (the concatenated spelling could outgrow PATH_MAX); the seventeenth build `bffc76b5` stat'ed the target by itself against the link's directory, and **failed the gate and CI on its own fixture** (sized for a long temp root only), which review seventeen (Opus accept with fixes, Astra reject) had worked out, together with a worse defect in the same fix: the directory was opened by path with Go's default flags, so a FIFO a tenant swaps in would block the watch and Close. The eighteenth build (`e8211fc6`, `6249af63`) opens the directory as a directory and nothing else, sizes the fixture from the temp root, compares the rendering across sections, and corrects the comments, the test name and the outstanding item Astra listed; three mutants killed. Gate (exit 0, three cross builds) and CI passed on `6249af63`; the eighteenth review is reading it. The deep items stay open and are listed in `READINESS.md`; none is minor, and the branch cannot be wired until they are closed or decided (the walk by directory descriptor, litestream's opens by path, durable transition state, the uid binding under approval H, the box-wide refusal decision). |
| - `feat/carloku-storage-sole-holder-20261001` `eaf6e63e`: round 9 both accept; CI passed; needs approval K and a cutover date. |
| - `fix/carloku-observe-routes-cleanup-20261001` `023e106c`: both accept; CI passed; merged into this branch at `47c97fa6`; the gate on the launch tip `b953fae4` passed (exit 0, three cross builds). |
| - `feat/carloku-billing-layout-20261001` `c1ae91a0`: merged into the currency branch; its two-form page was replaced by one form. |
| - `feat/carloku-late-request-fencing-20261001` `1b61de82`, `feat/carloku-bucket-hour-evidence-20261001` `0aa1fbec`: unchanged (rejected / needs approval J). |
| -- Site `feat/paid-pricing-20260916` (GitHub) `c12318d`: every amount from the platform's export; country band wiring; exact rates; honest link parameters, static links included; a draft book cannot be published by `check` or `build`; `bands.p3` carries the approved currency explanation; every priced slot, in every currency and band, and every banded inclusion equals its exported value; a figure is a whole number token on both sides (19 tests pass: `node --test test/*.test.mjs`). |
| +- Site `feat/paid-pricing-20260916` (GitHub) `4026231`: `build` and `check` render from the export before the draft check (a stale page cannot be published past a newer export); a floor that is not whole cents is refused rather than shown as `$1.20.5`; after `c12318d`: every amount from the platform's export; country band wiring; exact rates; honest link parameters, static links included; a draft book cannot be published by `check` or `build`; `bands.p3` carries the approved currency explanation; every priced slot, in every currency and band, and every banded inclusion equals its exported value; a figure is a whole number token on both sides (21 tests pass: `node --test test/*.test.mjs`). |
| **NEEDED:** |
| - Paul, commercial: approve the 36 amounts as an `approved` book version (approval L) together with the USD/GBP overage rates and floors in `OVERAGE-RATES-PROPOSAL.md`, or state other figures; the HALF code word; the proration policy (B); the partial-month rule (C). |
| - Paul, copy: the console billing page's 40 strings; the store-refusal copy (`OUTSTANDING.md` 19g). `bands.p3` is done: the approved currency explanation replaced the converted-euro sentence (site `e091e3f`, 07:0x); it now reads the same as the note under the currency selector. |
| - Paul, rulings: evidence for a held bucket-hour (J); storage on a bucket a store has left (K); the cutover note (M: purchases before the book stay legacy EUR; binary first, variables second). |
| - Scoped approvals, prepared as plans only: Stripe test mode (E) for the fence test and the rehearsal; Stripe live provisioning (F) after the approved book; the Cost and Usage Report export and the scratch-object write (G); Path B on a dev box (H). |
| -- Reviews to read when they land: the currency branch's seventeenth (`logs/opus-currency-review17.md`, `astra-currency-review17.md`) and the replicator's sixteenth (`opus-replicator-review16.md`, `astra-replicator-review16.md`). |
| +- Reviews to read when they land: the currency branch's eighteenth (`logs/opus-currency-review18.md`, `astra-currency-review18.md`) and the replicator's eighteenth (`opus-replicator-review18.md`, `astra-replicator-review18.md`). |
| **STILL TO BUILD (code, not approvals; no fake completes these):** quantity reduction at renewal (`OUTSTANDING.md` 14), the Free tier (15), dormancy and pool accounting (16), per-line tax codes across a change (17), the operator doors (18, plus the quantity-history gap door and a rejected-events listing), the meters' own code (replicator unwired with deep items open; store transfer has no source), the two key-memory defects (7, 9). `READINESS.md` has the list with what each means. The tests on the currency branch establish the subscription and currency path against fakes, nothing beyond it. |
| **RECOMMENDED:** |
| -- Read the seventeenth currency review. If both accept with nothing left to fix and CI is green on the tip, merge the currency branch into this branch: a merge commit pushed to this branch, as the observe-routes fix was at `47c97fa6` (`amadan branch merge` lands a branch on main and is not what this step is), then gate the merged tip. If it does not confirm, the next commit answers it the same way. Rule on K to let the storage branch follow. |
| +- Read the eighteenth currency review. If both accept with nothing left to fix and CI is green on the tip, merge the currency branch into this branch: a merge commit pushed to this branch, as the observe-routes fix was at `47c97fa6` (`amadan branch merge` lands a branch on main and is not what this step is), then gate the merged tip. If it does not confirm, the next commit answers it the same way. Rule on K to let the storage branch follow. |
| - Publish the approved book version as soon as L is given; it is a new entry in `internal/plans/pricebook.json`, the export regenerated and copied to the site, and the 36 lookup keys renamed. |
| - Test-mode rehearsal (E) before anything live: the list in both reviews and in `ENABLEMENT.md` section 6. |
| - Then, each on its own branch: quantity reduction at renewal, the evidence door for a box's first minutes, the AWS principal inventory and the bucket ownership attestation door, Free-tier enforcement, dormancy and pool accounting. |
| **SESSION:** |
| -Running at 09:15: the gates on the currency tip `db130cfc` and the replicator tip `f306222c`, the two seventeenth-round currency reviews, the two sixteenth replicator reviews (detached `setsid` processes; their output files are named in `READINESS.md`). The demo (pid in `layout-review/demo-redesigned.log`'s process, stop marker `layout-review/demo-redesigned.stop`) and the pricing preview (`python3 -m http.server 38009`) keep serving. |
| +Running at 10:20: the gate on the currency tip `68f6ee23` (`logs/gate-currency-68f6ee23.txt`), the two eighteenth-round currency reviews and the two eighteenth replicator reviews (detached `setsid` processes; output files named above). Two traps this hour, recorded in `logs/PENDING-after-currency.txt`: a review brief whose delta line was clobbered to `git diff X X` by a global sha replacement (two worker pairs stopped and restarted on the corrected brief), and `git commit -F $TMPDIR/...` failing outside the sandbox, which left a gate running on a staged tree (voided, `gate-currency-db130cfc-VOID-dirty-tree-second-run.txt`). The demo (pid in `layout-review/demo-redesigned.log`'s process, stop marker `layout-review/demo-redesigned.stop`) and the pricing preview (`python3 -m http.server 38009`) keep serving. |
| Scratch on the box: `~/.cache/tmp/claude-1001/{currency-wt,replicator-wt,fencing-wt,evidence-wt}` (git worktrees), the demo binaries, `/var/tmp/ck`, `~/.cache/carloku-gate`. The void gate logs are named `*VOID*`. |
diff --git a/implementation/carloku-paid-launch/ENABLEMENT.md b/implementation/carloku-paid-launch/ENABLEMENT.md| index 2a7e03f6f..95d5c4d21 100644 |
| --- a/implementation/carloku-paid-launch/ENABLEMENT.md |
| +++ b/implementation/carloku-paid-launch/ENABLEMENT.md |
| @@ -203,8 +203,11 @@ approvals granted. It does not mean payments switched on. |
| accepted it with fixes; the fourteenth found a P2 in the intent's |
| lifecycle (a resolution during a reconciliation), fixed in `abd1b76e`; |
| the last exception to that lifecycle is closed in `3527a066`, the |
| - operator's `keep` outcome tightened and recorded in `db130cfc`, and the |
| - seventeenth review is the one to read before any merge. Readiness is not |
| + operator's `keep` outcome tightened and recorded in `db130cfc`; the |
| + seventeenth review found the refusal's own order wrong (expiry before |
| + the review, so a pass in between retired the intent unrecorded), fixed |
| + in `68f6ee23`, and the eighteenth review is the one to read before any |
| + merge. Readiness is not |
| approval-only: the branch merges when a round ends with both reviewers |
| accepting and nothing left to fix, and the metered model needs the code |
| listed below built first. The readiness checklist (`READINESS.md`) names |
diff --git a/implementation/carloku-paid-launch/OUTSTANDING.md b/implementation/carloku-paid-launch/OUTSTANDING.md| index 23bf95d6b..278ced01b 100644 |
| --- a/implementation/carloku-paid-launch/OUTSTANDING.md |
| +++ b/implementation/carloku-paid-launch/OUTSTANDING.md |
| @@ -32,7 +32,7 @@ Each is concrete. None is waived. |
| ### Meters (the complete metered model cannot invoice until both are proven) |
| -1. **Replication writes (`durability_writes_1k`) cannot be proven on any box.** The external replicator writes outside the ledger. Path A (scoped attestation) was built, reviewed in round six, and cannot prove an exclusive writer; it is off this branch and parked on `feat/carloku-scoped-attestation-20261001`. Path B (the platform's own replicator as the only writer) is **partial, unwired, and rejected at both of its reviews**, on `feat/carloku-metered-replicator-20261001` (`9c08ce31`, on the forge; the full local gate passes on it): a litestream store whose every replica client is metered with no unmetered fallback, an owner for each database the box replicates, and a fleet store that refuses anything it cannot meter, each with tests. Its second review found that the ownership fence added after the first does not hold as built: a refused request is still sent (the request meter sends on a failed start), and the registry witness it relies on is moved by the replicator's own bookkeeping, so the store goes stale within minutes of opening. Both need changes outside that branch's packages (a request gate in `internal/lease`, a routes-only version in the registry) before a third review is worth running. `DISPOSITIONS-metered-replicator.md` on that branch has every finding. **Absent**: the agent wiring that binds those meters to the box's ledger, a restore path that does not shell out to the external binary, the unit change, moving the replica credentials so nothing else on the box holds them (the unit runs as the same user as the agent today), and any attestation. Until all of that exists and is approved for a box, this meter is incomplete every month and nothing is invoiced. |
| +1. **Replication writes (`durability_writes_1k`) cannot be proven on any box.** The external replicator writes outside the ledger. Path A (scoped attestation) was built, reviewed in round six, and cannot prove an exclusive writer; it is off this branch and parked on `feat/carloku-scoped-attestation-20261001`. Path B (the platform's own replicator as the only writer) is **partial, unwired, and has not had a whole-branch pass from both reviewers** (eighteen builds; Opus accepts each with fixes, Astra rejects each on the deep items), on `feat/carloku-metered-replicator-20261001` (the forge has the tip; `READINESS.md` names it with its gate and CI state). What is built there: a request gate in `internal/lease` that stops an attempt before it is sent; an ownership generation in the registry moved by the six route columns the replicator reads (not by its own bookkeeping writes); a fleet that holds every recorder's days in doubt and watches without a request; one strict inventory with file checks (one name, ordinary siblings, a link named with its target as written and classified by that spelling through a directory-only descriptor, no mount, the chain root's owner, under a platform directory) and a second look on a timer; and shadow state made private before litestream can make it. Still open there, each named in its dispositions as blocking wiring: litestream's own opens by path after a look (needs litestream to open beneath a pinned root), replaceable ancestry above a protected directory, an admitted request delayed past the margin, a process dying between a change and the rebuild (the doubt is in memory only), device effects through an ancestor swap, hibernating aliases and claims on skipped files, required coverage that disappears without an entry, that any tenant can stop a rebuild for the box, route identity unbound to filesystem authority, and the uid binding under approval H. `DISPOSITIONS-metered-replicator.md` on that branch has every finding and what each build did about it. What is there: a litestream store whose every replica client is metered with no unmetered fallback, an owner for each database the box replicates, and a fleet store that refuses anything it cannot meter, each with tests. **Absent**: the agent wiring that binds those meters to the box's ledger, a restore path that does not shell out to the external binary, the unit change, moving the replica credentials so nothing else on the box holds them (the unit runs as the same user as the agent today), and any attestation. Until all of that exists and is approved for a box, this meter is incomplete every month and nothing is invoiced. |
| 2. **Store transfer (`store_egress_gb`) has no source.** No Cost and Usage Report export exists on the account. It needs the scoped infrastructure approval, a first real delivery, an IAM principal inventory in the AWS provisioner (not built), and the bucket ownership attestation for stores that already exist (designed, not built). |
| 3. **A store's partial first hour** with a charged line holds the month, and nothing releases it. It holds by default and nobody is asked to waive it. What can release it is evidence: an operator door that records, for one bucket-hour, who is shown to have owned it and on what evidence, which the fold then honours. **Partial, unwired into this branch**, on `feat/carloku-bucket-hour-evidence-20261001` (`0aa1fbec`, rebased onto this branch): the record, the fold change and three operator API doors, with tests and mutation checks. It accepts only the hour a complete ledger began vouching in and only the owner that ledger names. The full local gate passes on it. First review: Astra rejected it, Opus accepted with fixes. Both confirmed that through the fold it releases nothing but that hour for that owner. Both also found that the evidence is free text that the same operator records and that stands at once, which in practice is a waiver: what counts as evidence, and whether a second person must approve it, needs Paul's ruling (approval J) before more is built. Nothing fixed yet (`DISPOSITIONS-bucket-hour-evidence.md` on that branch). No CI run, no CLI verb, and its operator-facing sentences are unreviewed. |
| 4. **A box's first minutes** before its ledger opened hold that day for everyone. Same as item 3: it holds by default, and the release is an operator evidence door, not a waiver. **Absent**. |
diff --git a/implementation/carloku-paid-launch/READINESS.md b/implementation/carloku-paid-launch/READINESS.md| index 8bd01b70c..06a78eb5a 100644 |
| --- a/implementation/carloku-paid-launch/READINESS.md |
| +++ b/implementation/carloku-paid-launch/READINESS.md |
| @@ -14,17 +14,17 @@ Log files are under `/home/paulca/.local/share/carloku-paid-launch-20260930/logs |
| | Branch | Tip | Gate | CI | Reviews | State | |
| | --- | --- | --- | --- | --- | --- | |
| -| `feat/carloku-multi-currency-20261001` | `db130cfc` (the sixteenth review's findings, the operator's rejected-events listing, the provisioning notes; reviews ten to sixteen's reports in the tree) | passed on every code tip through `3527a066` (07:54Z, `gate-currency-3527a066.txt`, exit 0, three cross builds, clean tree); `db130cfc`: started 08:08Z (`gate-currency-db130cfc.txt`); the console package passed in full on the same tree before the commit. Void or superseded logs, not evidence: `gate-currency-a9304f16.txt`, `gate-currency-f269365a-VOID-dirty-tree.txt`, `gate-currency-25487506-ended-on-28dc2629-reports-added-during-run.txt` | passed on every pushed tip through `3527a066`; `db130cfc` pending | Rounds 1 to 9: Opus accept with fixes, Astra reject. Rounds 10 to 13: both accept with fixes (P3s). Round 14: Astra reject on a P2 (a reconciliation paused on the provider read while the operator resolved the review recorded the retired purchase), fixed in `abd1b76e`. Rounds 15 and 16: both accept with fixes, each closing what the previous fix left open in the intent's lifecycle (15: nothing records under an open review, the resolution retires or keeps; 16: `keep` only for an intent whose bound session is complete with a subscription, the outcome written, replay-compared and audited). Each fix has a test that fails without it and a killed mutant (dispositions, one section per round). Round 17 at `db130cfc`: running. The findings since round ten were not minor: each was a real gap in the lifecycle of an intent under review, and the rounds have converged on the operator's door rather than the money path | integrated end to end; not merged; the merge waits on a round ending with both accepting and nothing left to fix, and CI on the tip | |
| +| `feat/carloku-multi-currency-20261001` | `68f6ee23` (the seventeenth review's findings: the review filed before the expiry on both paths, the `keep` door's replay, nil billing and purchase check, the rejected listing's account, order and bound, two new tests; reviews ten to seventeen's reports in the tree) | passed on every code tip through `db130cfc` (`gate-currency-db130cfc.txt`, exit 0, three cross builds, clean tree); `68f6ee23`: started 09:4xZ (`gate-currency-68f6ee23.txt`); the console, plans and billingstripe packages passed in full on the same tree before the commit (console 525 s). Void or superseded logs, not evidence: `gate-currency-a9304f16.txt`, `gate-currency-f269365a-VOID-dirty-tree.txt`, `gate-currency-25487506-ended-on-28dc2629-reports-added-during-run.txt`, `gate-currency-db130cfc-VOID-dirty-tree-second-run.txt` (started by mistake on staged, uncommitted changes and stopped) | passed on every pushed tip through `db130cfc`; `68f6ee23` running | Rounds 1 to 9: Opus accept with fixes, Astra reject. Rounds 10 to 13: both accept with fixes (P3s). Round 14: Astra reject on a P2 (a reconciliation paused on the provider read while the operator resolved the review recorded the retired purchase), fixed in `abd1b76e`. Rounds 15 and 16: both accept with fixes, each closing what the previous fix left open in the intent's lifecycle (15: nothing records under an open review, the resolution retires or keeps; 16: `keep` only for an intent whose bound session is complete with a subscription, the outcome written, replay-compared and audited). Each fix has a test that fails without it and a killed mutant (dispositions, one section per round). Round 17 at `db130cfc`: Opus accept with fixes (four P3s on the `keep` door and the rejected listing), Astra reject on a P2: both sites that expire a bound session expired first and filed the review second, so a pass reading the expired session in between, or a crash between the two, retired the intent with no record; fixed in `68f6ee23` by filing first (a two-path race test runs the store's retirement inside the fake's expiry and wants the conflict; it fails with either site's order put back), with the P3s, two new tests (an older resolutions table migrates with `retire`; the listing's 200-row bound, newest first, account on each row) and the comments and design sentence both named. The first form of the listing's account fix looked the account up under open rows and deadlocked the store's one connection in the test; rows are read to the end first. Round 18 at `68f6ee23`: running. The findings since round ten were not minor: each was a real gap in the lifecycle of an intent under review, and the rounds have converged on the operator's door rather than the money path | integrated end to end; not merged; the merge waits on a round ending with both accepting and nothing left to fix, and CI on the tip | |
| | `feat/carloku-billing-layout-20261001` | `c1ae91a0` | (templates only; gated inside the currency branch) | passed | none of its own | merged into the currency branch at `5047494b`; its two-form layout was replaced by one form in `8958392b` | |
| | `feat/carloku-storage-sole-holder-20261001` | `eaf6e63e` | passed on `3af02a65`; `eaf6e63e` is wording and reports | passed | 9 rounds; round 9 both accept (omitted-holder class closed) | needs approval K and a recorded cutover date; not merged | |
| -| `feat/carloku-metered-replicator-20261001` | `f306222c` (sixteenth build, with reviews eight to fifteen's reports, Astra's fifteenth to follow) | passed on every code tip through `03b19014` (07:56Z, `gate-replicator-03b19014.txt`, exit 0, three cross builds); `f306222c`: started 08:03Z (`gate-replicator-f306222c.txt`); the ops package passes under `/tmp`, `~/.cache`, `umask 077` and the race detector | passed on every pushed tip through `03b19014`; `f306222c` pending | 4 to 7: each Opus accept with fixes, Astra reject; 8: both reject on one P1 the eighth build made (fixed in the ninth); 9 to 15: Opus accept with fixes, Astra reject, each round finding the previous build's own addition wanting (15 at `03b19014`: the fifteenth build joined a relative link target and so cleaned a `..` the kernel resolves physically, a regression that let a link to a directory outside the tree pass in silence; fixed in the sixteenth build by concatenating uncleaned, with the fixture both asked for); 16 at `f306222c`: running. Each build's dispositions section lists its killed mutants. The deep items stay open and are listed there: litestream's own opens by path (every reopen), protected endpoints under tenant-replaceable ancestry, a delayed admitted request past the margin, requests across a crash or restart, the header open through a swapped ancestor (a walk by directory descriptor, required before wiring), a tenant sharing the platform's uid, root-run units and a route naming another user's coherent tree (approval H), hibernating aliases and claims on skipped files, required coverage that can vanish without an entry, whether one tenant's unaccepted links refuse the whole box (a decision before wiring), one tenant's deletion holding every account's days once (a stated cost). None of these is minor: the branch cannot be wired until they are closed or decided | not merged; unwired side work gated on approval H | |
| +| `feat/carloku-metered-replicator-20261001` | `6249af63` (eighteenth build, two commits: `e8211fc6` the directory-only open and the fixture sized from the temp root; `6249af63` Astra's seventeenth report answered; reviews eight to seventeen's reports in the tree) | passed on every code tip through `f306222c`, then **failed on `bffc76b5`** (`gate-replicator-bffc76b5.txt`, exit 2: the seventeenth build's long-target fixture held only under a temp root of about 34 bytes or more; the gate's `/var/tmp/ck` is shorter), passed on `6249af63` (09:04Z, `gate-replicator-6249af63.txt`, exit 0, three cross builds, clean tree). Void: `gate-replicator-e8211fc6-VOID-stopped-for-astra17-followup.txt` (stopped so Astra's report could be answered in the same build) | passed through `f306222c`; **failed on `bffc76b5`** (the same fixture); passed on `6249af63` | 4 to 7: each Opus accept with fixes, Astra reject; 8: both reject on one P1 the eighth build made (fixed in the ninth); 9 to 15: Opus accept with fixes, Astra reject, each round finding the previous build's own addition wanting (15 at `03b19014`: the fifteenth build joined a relative link target and so cleaned a `..` the kernel resolves physically, a regression that let a link to a directory outside the tree pass in silence; fixed in the sixteenth build by concatenating uncleaned, with the fixture both asked for); 16 at `f306222c`: Opus accept with fixes, Astra reject; both found the fifteenth's regression closed and one bound Astra named (the concatenated spelling could outgrow PATH_MAX), fixed in the seventeenth build `bffc76b5` with `fstatat` against the link's directory. 17 at `bffc76b5`: Opus accept with fixes, Astra reject; both named the same two new defects in that fix: the directory was opened by path with Go's default flags (a FIFO a tenant swaps in blocks the watch and Close; a device would have its driver's open run) and the long-target fixture failed under any short temp root (which is what failed the gate and CI). The eighteenth build opens the directory with `O_DIRECTORY|O_NONBLOCK|O_NOCTTY|O_CLOEXEC` (anything but a directory refused by the open itself; three mutants killed: default flags, `O_DIRECTORY` alone dropped, the fixed fixture size under `/var/tmp/ck`), sizes the fixture from the temp root, compares `render` across sections, and corrects the comments and names Astra listed; the false "package tests pass under /tmp" claim of the seventeenth build is marked false in its dispositions. 18 at `6249af63`: running. Each build's dispositions section lists its killed mutants. The deep items stay open and are listed there: litestream's own opens by path (every reopen), protected endpoints under tenant-replaceable ancestry, a delayed admitted request past the margin, requests across a crash or restart, the header open through a swapped ancestor (a walk by directory descriptor, required before wiring), a tenant sharing the platform's uid, root-run units and a route naming another user's coherent tree (approval H), hibernating aliases and claims on skipped files, required coverage that can vanish without an entry, whether one tenant's unaccepted links refuse the whole box (a decision before wiring), one tenant's deletion holding every account's days once (a stated cost). None of these is minor: the branch cannot be wired until they are closed or decided | not merged; unwired side work gated on approval H | |
| | `fix/carloku-observe-routes-cleanup-20261001` | `023e106c` | passed on `51587e00`; `023e106c` changes a test and two docs | passed | both accept at `51587e00` | merged into the launch branch at `47c97fa6` | |
| | `feat/carloku-paid-launch-20260916` (launch) | this commit: documents only on top of `3d47602b`; last code change the merge of the observe-routes fix (`47c97fa6`) | passed 03:06Z on `b953fae4` (`gate-launch-b953fae4.txt`, exit 0, three cross builds); every commit since is documents | passed on `3d47602b` | 17 rounds, no whole-branch pass | the integration target; first accepted side branch merged | |
| -| site `feat/paid-pricing-20260916` (GitHub) | `c12318d` (`bands.p3` replaced by the approved explanation at `e091e3f`; every priced slot, inclusion band and figure token pinned exactly after reviews twelve to sixteen; the token check in `hack/token.mjs`; the slot test's title says output equality, not provenance) | `node --test test/*.test.mjs`: 19 pass (08:0xZ) | n/a | read-only by the currency reviews (section K); rounds four, five, ten, twelve to sixteen's site findings fixed | preview served at `http://100.119.180.57:38009` from the tree (rebuilt with the `bands.p3` change) | |
| +| site `feat/paid-pricing-20260916` (GitHub) | `4026231` (`build` and `check` render from the export before the draft check, so a stale page cannot be published past a newer export; a floor that is not whole cents is refused by the renderer rather than shown as `$1.20.5`; after `c12318d`: `bands.p3` replaced by the approved explanation, every priced slot, inclusion band and figure token pinned exactly) | `node --test test/*.test.mjs`: 21 pass (09:1xZ) | n/a | read-only by the currency reviews (section K); rounds four, five, ten, twelve to seventeen's site findings fixed | preview served at `http://100.119.180.57:38009` from the tree (rebuilt with the `bands.p3` change) | |
| ## The flow, behaviour the tests establish (2026-10-02) |
| -These are what the automated tests assert on `db130cfc`, against fakes of Keymail and Stripe; none of it is proven against the real provider. Reviews ten to thirteen, fifteen and sixteen accepted the code with fixes; review fourteen found a P2 in the intent's lifecycle (fixed in `abd1b76e`); the operator's resolution and its `keep` outcome were tightened in `3527a066` and `db130cfc`, and the seventeenth review is reading them. The findings have not been minor: each round since ten has found a real gap in the lifecycle of an intent under review, and the branch is not ready to merge until a round ends with both reviewers accepting and nothing left to fix. Tests: (`internal/console`: `TestBillingFormPostsWhatItShows`, |
| +These are what the automated tests assert on `68f6ee23`, against fakes of Keymail and Stripe; none of it is proven against the real provider. Reviews ten to thirteen, fifteen and sixteen accepted the code with fixes; review fourteen found a P2 in the intent's lifecycle (fixed in `abd1b76e`); the operator's resolution and its `keep` outcome were tightened in `3527a066` and `db130cfc`, and the seventeenth review is reading them. The findings have not been minor: each round since ten has found a real gap in the lifecycle of an intent under review, and the branch is not ready to merge until a round ends with both reviewers accepting and nothing left to fix. Tests: (`internal/console`: `TestBillingFormPostsWhatItShows`, |
| `TestBillingPageCurrencyControls`, `TestPricingLinkSurvivesSignIn`, |
| `TestCurrencySuggestionCookie`, `TestCountrySuggestionCookie`, |
| `TestBillingInclusionsFollowTheQuotedBand`, |
| @@ -69,7 +69,7 @@ reconcile, calculation, invoice and recovery tests in |
| session expired first; an expiry's answer must name the account before |
| anything is retired; a retired intent's later events are settled, not |
| retried. They hold at `9574a798` by the tests named. |
| -- Demo at `http://100.119.180.57:41881`: rebuilt 09:1x from `db130cfc` |
| +- Demo at `http://100.119.180.57:41881`: rebuilt from `db130cfc` at 09:1x, being rebuilt from `68f6ee23` (the stop-marker procedure; `STATE-demo.txt` in the run's `layout-review` directory names the tip it serves) |
| (binary `billing-redesigned.test`, started by the stop-marker procedure; |
| the EUR-only binary is kept as `billing-redesigned-eur-only.test.bak`), |
| serving with the price book configured: the whole path from the pricing |