carlos / platform Public

Task 5 and the records at 06:10: per-line tax codes merged; the ENABLEMENT activation rule keyed to freeze and the every-month tightening; OUTSTANDING item 17 built but inactive; readiness and handoff

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

claude 3 weeks ago 8777d28e4a6714ea48582103895cb0f502bc1912 parent e2adf26

4 files changed, +32 −5

.claude/HANDOFF.md +2 −2
implementation/carloku-paid-launch/ENABLEMENT.md +27 −0
implementation/carloku-paid-launch/OUTSTANDING.md +1 −1
implementation/carloku-paid-launch/READINESS.md +2 −2

CI passed — run details

diff --git a/.claude/HANDOFF.md b/.claude/HANDOFF.md

index 176adbd33..3461259b2 100644

--- a/.claude/HANDOFF.md

+++ b/.claude/HANDOFF.md

@@ -7,7 +7,7 @@

Get Carloku's paid plans live with Stripe Tax and the complete metered model; have the pricing page and signup flow reviewable in the morning.

**STATUS:**

-Written 05:05 Dublin on 2026-10-03 (resumed 21:40 on 2026-10-02 after a provider limit; nothing was lost), during the second overnight run (brief: "continue overnight until we're ready to enable payments"; ready means reviewed, tested, integrated code and a scoped enablement plan, not payments switched on). Billing is OFF everywhere. No live Stripe write, no AWS change, no charge, no merge to main. **At 01:55 the currency branch (the price book and the retirement protocol) merged into this branch at `d64180a7`, after its twenty-sixth and twenty-seventh reviews ended with both reviewers accepting; the AWS principal report merged at `c4ee8807` after its seventh.** The merged tip `7399d9fe` passed its gate (exit 0, three cross builds) and CI. Every payment anyone can see is a labelled simulation.

+Written 06:10 Dublin on 2026-10-03 (resumed 21:40 on 2026-10-02 after a provider limit; nothing was lost), during the second overnight run (brief: "continue overnight until we're ready to enable payments"; ready means reviewed, tested, integrated code and a scoped enablement plan, not payments switched on). Billing is OFF everywhere. No live Stripe write, no AWS change, no charge, no merge to main. **At 01:55 the currency branch (the price book and the retirement protocol) merged into this branch at `d64180a7`, after its twenty-sixth and twenty-seventh reviews ended with both reviewers accepting; the AWS principal report merged at `c4ee8807` after its seventh; the operator CLI at `1cd5a0d8`; per-line tax codes (OUTSTANDING item 17, built behind its hold, decision 16 untouched) at `e2adf26f` after three code reviews.** The merged tip `7399d9fe` passed its gate (exit 0, three cross builds) and CI. Every payment anyone can see is a labelled simulation.

Review servers, all answering 200: pricing page `http://100.119.180.57:38009` (static, rebuilt from site `2fc6388`), signup and billing demo `http://100.119.180.57:41881` (**rebuilt at 02:10 from the integrated launch branch, `404e699f`, whose code is `7399d9fe`: the currency branch and the AWS principal report merged, gate and CI passed**; it runs until about 17:10 Dublin, restart recipe in `layout-review/STATE-demo.txt`; a labelled simulation, not Stripe proof: Keymail and Stripe simulated on the same listener; the `68f6ee23` build served until 02:06), console billing copy `http://100.119.180.57:45033` if still up.

@@ -45,6 +45,6 @@ Branches (all on the forge, none merged; the local gate is not CI):

- Then, each on its own branch: quantity reduction at renewal, the evidence door for a box's first minutes, the AWS principal inventory and the bucket ownership attestation door, Free-tier enforcement, dormancy and pool accounting.

**SESSION:**

-Running at 05:05: the gate and the first code review (Opus and Astra) of `design-per-line-tax-codes` at `61313bec` (per-line tax codes, OUTSTANDING item 17: built behind the hold, Tasks 0 to 4, 23 mutants; design revision 4 after three Astra design rounds). Done: the gate and CI on this branch's tip `29ea6676`, and on `7399d9fe` and `fc7daebd`. Then: answer the review, gate, merge with Task 5's records (the ENABLEMENT activation rule, OUTSTANDING item 17). Next: item 17's design (per-line tax codes; the mechanics that need no decision) on its own branch with an Astra design review; the rest of the build list. Done: the gates on `2b0abef1` (00:51Z), `0491ff76` (00:46Z), `9b872e38` (00:42Z), `4a1a92d9` (00:36Z). Then: the build list below, each on its own branch. Full package runs need `GOFLAGS=-buildvcs=false`, as the gate sets it. Detached `setsid` processes. A gate must be started with `logs/run-gate.sh`, which uses the default build cache; full runs take the gate's `-timeout 30m`.

+Running at 06:10: the gate on this branch's tip (the per-line tax codes merge `e2adf26f` plus this records commit), alone. Done tonight: the currency branch (`d64180a7`), the AWS principal report (`c4ee8807`), the operator CLI (`1cd5a0d8`) and per-line tax codes (`e2adf26f`) merged, each after its reviews, its gate alone and CI; `29ea6676` gate and CI passed. Next: the build list below; the approvals and decisions 1 to 16 are Paul's. Next: item 17's design (per-line tax codes; the mechanics that need no decision) on its own branch with an Astra design review; the rest of the build list. Done: the gates on `2b0abef1` (00:51Z), `0491ff76` (00:46Z), `9b872e38` (00:42Z), `4a1a92d9` (00:36Z). Then: the build list below, each on its own branch. Full package runs need `GOFLAGS=-buildvcs=false`, as the gate sets it. Detached `setsid` processes. A gate must be started with `logs/run-gate.sh`, which uses the default build cache; full runs take the gate's `-timeout 30m`.

Scratch on the box: `~/.cache/tmp/claude-1001/{currency-wt,replicator-wt,fencing-wt,evidence-wt,opcli-wt,inventory-wt,flush-wt,reduction-wt}` (git worktrees), the demo binaries, `/var/tmp/ck`, `~/.cache/carloku-gate`. The void gate logs are named `*VOID*`.

diff --git a/implementation/carloku-paid-launch/ENABLEMENT.md b/implementation/carloku-paid-launch/ENABLEMENT.md

index e2503bf4c..5852da452 100644

--- a/implementation/carloku-paid-launch/ENABLEMENT.md

+++ b/implementation/carloku-paid-launch/ENABLEMENT.md

@@ -112,6 +112,31 @@ before the build is held by it: nothing is known of what was attached, so

no outcome is offered until the decisions in `DECISIONS-FOR-PAUL.md`

(1 to 4) say how such a case is closed.

+### Per-line tax codes: the activation rule

+Merged at `e2adf26f` and inert: a month whose paid spans carry two tax codes

+still holds (`billing_invoice_tax_code_mixed`), and every one-code month

+is frozen byte for byte as before. Activation is decision 16 with 16a to

+16d (`DECISIONS-FOR-PAUL.md`), then a reviewed change of its own: `freeze`

+switched from the hold to the glue (`twoCodeCalculation`) with the decided

+body, tested through `freeze`. Before any build whose `freeze` can write a

+two-code calculation runs anywhere: every console that can run the invoice

+pass is on a build containing this merge, and any older one is stopped,

+because an older invoice worker that reads a two-code calculation files

+`billing_invoice_record_mismatch`, an account-wide hold it files again

+after an operator resolves it while it still runs; so older workers are

+stopped before their accidental reviews are resolved. No build below this

+merge is rolled back to after activation, and the rollback note in section

+7 ("an older binary runs against the migrated schema") does not apply past

+it. Months held before activation stay held until an operator resolves

+each review (`carlos billing resolve`), and the pass prices one only when

+no other review of the account is open, its backoff has passed and it is

+within the twelve-month lookback (16d). One behaviour changes for every

+month from this merge, activation or not: a finalize that was journaled

+and then lost is resumed only over a draft whose lines validate today; a

+draft that changed meanwhile holds (`billing_invoice_lines_mismatch`)

+instead of being finalized.

## 4. The runtime key's permissions

From plan step 6, derived from every `/v1/` path `internal/billingstripe`

@@ -204,6 +229,8 @@ rehearsal question; the console accepts any subset.

- A subscription created in error is cancelled in the Dashboard, by a

person, outside this plan.

- The schema migration is not rolled back; an older binary runs against it.

+ That stops being true at the activation of per-line tax codes (the rule

+ in section 3): after it, no older invoice worker runs again.

## 8. Approvals, each scoped

diff --git a/implementation/carloku-paid-launch/OUTSTANDING.md b/implementation/carloku-paid-launch/OUTSTANDING.md

index ccd1c8e36..2c912ba1f 100644

--- a/implementation/carloku-paid-launch/OUTSTANDING.md

+++ b/implementation/carloku-paid-launch/OUTSTANDING.md

@@ -58,7 +58,7 @@ Each is concrete. None is waived.

14. Quantity reduction at renewal. **Absent.** Team plans cannot be sold without it: a renewal bills the old quantity.

15. Free tier. **Absent**: no Free entitlement, no app cap, no storage refusal, no per-plan idle, no flush-only class. Scoped 2026-10-02: the entitlement record already carries what the spec's step 13 needs (`Runtime.IdleSeconds`, `MaxApps`, `MaxMembers`, `Replication` with `hibernate-flush`, `StatusFree`, `PlanFree`), and **nothing consumes any of it**: `deriveEntitlement` returns a hold for Free, and no code in the console, the activator or a box reads `MaxApps`, `IdleSeconds` or the replication class from an entitlement. The Free caps (3 apps, 2-minute idle) are in the approved spec and not in `plans.json` (which has Free's pooled resources only). Building it is four pieces, each on its own reviewed branch: (a) the caps in the terms (a new terms version, since a published version is not edited) and a Free record from `deriveEntitlement`; (b) the console's app-creation gate on `MaxApps`; (c) the box reading idle and the replication class from the published entitlement, with `hibernate-flush` added to the activator's classes (the unset value means stream there today, the opposite of Free's intent); (d) storage refusal at the cap. **One decision is Paul's before (a)**: who is Free on the day it is switched on. Proposed policy for review: every account with no paid subscription and no house marker is Free from an announced date; accounts over a Free cap on that date keep what they have and can add nothing until under it (no app is stopped or archived by the switch); house accounts are unaffected. Without that ruling (a) would apply caps to every existing unpaid account on the flagship.

16. Dormancy archive and warnings; recognised-revenue pool accounting; the books site. **Absent.**

-17. Per-line tax codes for a month spanning two tax codes (it holds with a review today, `billing_invoice_tax_code_mixed`). Scoped 2026-10-03: allowances are already time-weighted across the paid spans and overage rates are per currency, so a plan change inside a month changes only the tax code of the overage lines; which code, or whether to split each meter's line by span from daily usage, is decision 16 in `DECISIONS-FOR-PAUL.md`. Nothing is built; the build follows the answer.

+17. Per-line tax codes for a month spanning two tax codes (it holds with a review today, `billing_invoice_tax_code_mixed`). Scoped 2026-10-03: allowances are already time-weighted across the paid spans and overage rates are per currency, so a plan change inside a month changes only the tax code of the overage lines; which code, or whether to split each meter's line by span from daily usage, is decision 16 in `DECISIONS-FOR-PAUL.md`. The mechanics either answer needs are built and merged at `e2adf26f`, inactive (`design-per-line-tax-codes`, three code reviews, both accepting with fixes at the third and the fixes made: a line carries its own code, the allowance names its spans, eligible days are attributed to the plan in force and each axis's unchanged amount apportioned, the activation glue uncalled; one-code months byte-identical, pinned); the mixed-code hold and decision 16 stay outstanding; the activation rule is in `ENABLEMENT.md` section 3.

18. A `carlos` verb and documentation for the operator doors (**built and merged** at `1cd5a0d8` on 2026-10-03 from `feat/carloku-billing-operator-cli-20261002` `fc7daebd`; four reviews answered, the third and fourth both accept with fixes, P3s only; gate alone and CI passed on `fc7daebd`; **its public reference section in `docs/site/cli.md` is unreviewed copy**: nothing publishes the site's CLI page before Paul reads it); a statement rebuild door for a closed month; an operator verb to backfill bucket ownership.

### Process

diff --git a/implementation/carloku-paid-launch/READINESS.md b/implementation/carloku-paid-launch/READINESS.md

index 21681c217..dc8f92f2d 100644

--- a/implementation/carloku-paid-launch/READINESS.md

+++ b/implementation/carloku-paid-launch/READINESS.md

@@ -19,12 +19,12 @@ Log files are under `/home/paulca/.local/share/carloku-paid-launch-20260930/logs

| `feat/carloku-metered-replicator-20261001` | `e1280811` (review twenty answered with comments, a fixture and dispositions only; the code is the twentieth build `c9ec11eb`: a tree claim refuses a tenant's file in a platform directory too, the fixture's guard reachable, the no-recorder refusal quoted; after `53e3dcd8`, the nineteenth build: a tenant's file in a platform directory refused in both layouts, the long-target fixture within the pathname budget and under XFS's link limit, refusal messages quoted; after `6249af63`, the eighteenth; reviews eight to eighteen's reports in the tree) | passed on every code tip through `f306222c`, then **failed on `bffc76b5`** (`gate-replicator-bffc76b5.txt`, exit 2: the seventeenth build's long-target fixture held only under a temp root of about 34 bytes or more; the gate's `/var/tmp/ck` is shorter), passed on `6249af63` (09:04Z, `gate-replicator-6249af63.txt`, exit 0, three cross builds, clean tree); `53e3dcd8`: passed (09:38Z, `gate-replicator-53e3dcd8.txt`, exit 0, three cross builds); `c9ec11eb`: passed (09:52Z, `gate-replicator-c9ec11eb.txt`, exit 0, three cross builds); `e1280811`: passed (10:10Z, `gate-replicator-e1280811.txt`, exit 0, three cross builds). Void: `gate-replicator-e8211fc6-VOID-stopped-for-astra17-followup.txt` (stopped so Astra's report could be answered in the same build) | passed through `f306222c`; **failed on `bffc76b5`** (the same fixture); passed on `6249af63`, `53e3dcd8`, `c9ec11eb` and `e1280811` | 4 to 7: each Opus accept with fixes, Astra reject; 8: both reject on one P1 the eighth build made (fixed in the ninth); 9 to 15: Opus accept with fixes, Astra reject, each round finding the previous build's own addition wanting (15 at `03b19014`: the fifteenth build joined a relative link target and so cleaned a `..` the kernel resolves physically, a regression that let a link to a directory outside the tree pass in silence; fixed in the sixteenth build by concatenating uncleaned, with the fixture both asked for); 16 at `f306222c`: Opus accept with fixes, Astra reject; both found the fifteenth's regression closed and one bound Astra named (the concatenated spelling could outgrow PATH_MAX), fixed in the seventeenth build `bffc76b5` with `fstatat` against the link's directory. 17 at `bffc76b5`: Opus accept with fixes, Astra reject; both named the same two new defects in that fix: the directory was opened by path with Go's default flags (a FIFO a tenant swaps in blocks the watch and Close; a device would have its driver's open run) and the long-target fixture failed under any short temp root (which is what failed the gate and CI). The eighteenth build opens the directory with `O_DIRECTORY|O_NONBLOCK|O_NOCTTY|O_CLOEXEC` (anything but a directory refused by the open itself; three mutants killed: default flags, `O_DIRECTORY` alone dropped, the fixed fixture size under `/var/tmp/ck`), sizes the fixture from the temp root, compares `render` across sections, and corrects the comments and names Astra listed; the false "package tests pass under /tmp" claim of the seventeenth build is marked false in its dispositions. 18 at `6249af63`: Opus accept (three P3s: the fixture's 3 KB link target, which XFS refuses; a tenant's file in a platform directory accepted under the tenant's tree and refused under the platform's; wording), Astra reject on the deep items (and the fixture's fixed depth). The nineteenth build `53e3dcd8` answers them (two mutants killed). 19 at `53e3dcd8`: Opus accept (two P3s), Astra reject on the deep items; the twentieth build `c9ec11eb` makes the bounded changes (one mutant killed) and its dispositions list the deferred items separately, each as blocking wiring and needing a design or a decision. 20 at `c9ec11eb`: Opus accept with fixes, Astra reject on the deep items; `e1280811` changes no behaviour and is not sent for another round; the two refusals Opus named as decisions are in `DECISIONS-FOR-PAUL.md` (11, 12). Each build's dispositions section lists its killed mutants. The deep items stay open and are listed there: litestream's own opens by path (every reopen), protected endpoints under tenant-replaceable ancestry, a delayed admitted request past the margin, requests across a crash or restart, the header open through a swapped ancestor (a walk by directory descriptor, required before wiring), a tenant sharing the platform's uid, root-run units and a route naming another user's coherent tree (approval H), hibernating aliases and claims on skipped files, required coverage that can vanish without an entry, whether one tenant's unaccepted links refuse the whole box (a decision before wiring), one tenant's deletion holding every account's days once (a stated cost). None of these is minor: the branch cannot be wired until they are closed or decided | not merged; unwired side work gated on approval H |

-| `feat/carloku-paid-launch-20260916` (launch) | this commit: documents only on top of `1cd5a0d8`, the merge of the operator CLI (02:12); before it `d64180a7` (the currency branch) and `c4ee8807` (the AWS principal report); before those, documents on top of `3d47602b` and the merge of the observe-routes fix (`47c97fa6`) | `29ea6676` (the operator CLI merge `1cd5a0d8` plus records): **passed** (01:15Z, `gate-launch-29ea6676.txt`, exit 0, three cross builds, alone); CI passed on `29ea6676`. `7399d9fe` (the currency merge `d64180a7` plus records): **passed** (`gate-launch-7399d9fe.txt`, exit 0, three cross builds, alone); CI passed on `7399d9fe`. `0491ff76` (the inventory merge plus records): **passed** (00:46Z, `gate-launch-0491ff76.txt`, exit 0, three cross builds). passed 03:06Z on `b953fae4` (`gate-launch-b953fae4.txt`, exit 0, three cross builds); every commit since is documents | passed on `3d47602b` | 17 rounds, no whole-branch pass | **the currency branch and the AWS principal report are merged in; the operator CLI is merged in (its public section waits on Paul's reading before any publish); everything else is as listed below.** the integration target; first accepted side branch merged |

+| `feat/carloku-paid-launch-20260916` (launch) | this commit: documents only on top of `e2adf26f`, the merge of per-line tax codes (06:10); before it `1cd5a0d8` (the operator CLI), `d64180a7` (the currency branch) and `c4ee8807` (the AWS principal report) | the gate on this commit runs next, alone; `29ea6676`: **passed** (01:15Z, `gate-launch-29ea6676.txt`, exit 0, three cross builds); CI passed on `29ea6676`. `7399d9fe` (the currency merge `d64180a7` plus records): **passed** (`gate-launch-7399d9fe.txt`, exit 0, three cross builds, alone); CI passed on `7399d9fe`. `0491ff76` (the inventory merge plus records): **passed** (00:46Z, `gate-launch-0491ff76.txt`, exit 0, three cross builds). passed 03:06Z on `b953fae4` (`gate-launch-b953fae4.txt`, exit 0, three cross builds); every commit since is documents | passed on `3d47602b` | 17 rounds, no whole-branch pass | **the currency branch and the AWS principal report are merged in; the operator CLI is merged in (its public section waits on Paul's reading before any publish); everything else is as listed below.** the integration target; first accepted side branch merged |

| `feat/carloku-quantity-reduction-20261002` | `978ddc8a` (design only, off `68f6ee23`) | n/a (no code) | n/a | Astra's design review rejected revision 1 on four P1s (a request can cross the renewal and its confirmation proves nothing about the invoiced quantity; a future-dated assignment blocks every change before the renewal; a missed window postpones the reduction a year in silence; fence-only enablement leaves no path to restore returning seats). Revision 2 waits on three decisions that are Paul's (`2026-10-02-quantity-reduction-at-renewal-design.md`, last section) | OUTSTANDING 14 stays absent in code |

| `feat/carloku-flush-only-class-20261002` | `5f43a0e4` (off the launch branch at `65363554`; a unit-backed route's rung can be cleared; the test waits for the start-up snapshot; after `5c327226`): the `hibernate-flush` word in the registry's vocabulary and the activator's interval map, **withdrawn from the rungs on offer and set by nothing**; the CLI rail refuses any rung on a unit-backed route | `0e8ea227` **failed** (the CLI's word test; `gate-flush-0e8ea227-FAILED-cli-word-test-stopped.txt`); `5c327226` passed (12:54Z); `5f43a0e4` passed (13:35Z, `gate-flush-5f43a0e4.txt`, exit 0, three cross builds) | `0e8ea227` failed; `5c327226` and `5f43a0e4` passed | 1 at `0e8ea227`: Opus accept with fixes, Astra reject: the ten-year interval does not give "wake and sleep only" against the vendored litestream (daily snapshot while awake; the awake backlog waits for a 30-second flush at sleep; the local log untrimmed), so the class's contract is decision 10a and nothing of its options is built; the inherited defect Astra found (`Replicator.Close` can return nil having flushed nothing) is forge discussion 200. 2 at `5c327226`: both accept with fixes (the unit-backed refusal blocked clearing an existing rung; the test raced the start-up snapshot; listings print the raw word; three inaccurate statements), fixed in `5f43a0e4`, which has not been read by a reviewer. Stated open and unchanged: `Replicator.Close` can return nil having flushed nothing and a failed flush still ends in hibernation (inherited, every class, forge discussion 200); the unbounded awake backlog; no verified wake boundary; class-blind restore drill and lag thresholds | **does not implement the Free plan's durability**; not mergeable as a feature until 10a; the rest of OUTSTANDING 15 waits on who is Free |

| `feat/carloku-billing-operator-cli-20261002` | `fc7daebd` (a merge of the currency tip `2b0abef1`); before it `6d4c2912` (the fourth review's P3s answered: `account_deleted` always on the wire and printed; the console's own 5xx on a write; the moved console after the offer; the help's two facts); before it `4e9cac43` (`f9683fbe`: the third review's twelve P3s answered: a write names its console or is refused; refusals from in front of the console; the moved console through the interactive offer; the whole command tested through `runBillingWith`; then the currency tip `e152df30` merged in); before it `31731fdd` (Astra's second review answered in `f155e543`: ambiguous flag values refused, the keep wording, strict listing envelopes, write advice that fits the write, the console's note predicate, `billingRun` tested; then the currency tip `05ccec07` merged in); before it `51ef27ac` (the first review answered in `57f70c16`, then the currency tip `b260ac8e` merged in): `carlos billing reviews\|resolve\|rejected\|house`, a client for the four operator doors | `fc7daebd`: **passed** (01:04Z, `gate-opcli-fc7daebd.txt`, exit 0, three cross builds, alone). `40ea61b1`: **passed** (00:08Z, `gate-opcli-40ea61b1.txt`, exit 0, three cross builds, alone). `6d4c2912` was not gated on its own (superseded by the merge). `4e9cac43`: **passed** (23:09Z, `gate-opcli-4e9cac43.txt`, exit 0, three cross builds, alone). `51ef27ac`: **passed** (21:29Z, exit 0, three cross builds); `31731fdd`: **passed** (22:16Z, `gate-opcli-31731fdd.txt`, exit 0, three cross builds). `0f507bff` **failed** (exit 2, `gate-opcli-0f507bff.txt`): one test, the docs gate, which requires a `carlos billing` heading in the public CLI reference. `51ef27ac`: started 21:18Z, run alone (`gate-opcli-51ef27ac.txt`) | passed on `6d4c2912`, `40ea61b1` and `fc7daebd`; `0f507bff` failed (the docs gate) | 4 at `4e9cac43`: **both accept with fixes, all P3**, answered in `6d4c2912` (CI passed); no fifth review unless the client changes. 3 at `31731fdd`: **both accept with fixes** (six P3 each), answered in `f9683fbe`; a fourth reading not started. 2 at `51ef27ac`: Astra accept with fixes (three P2, six P3), answered in `f155e543`; Opus's second reading and Astra's third running on `31731fdd`. 1 at `0f507bff`: Opus accept with fixes (P1 the docs gate, four P2), Astra reject (five P2). Answered in `57f70c16`: arguments are one unambiguous request or refused before anything is sent; writes are reported only on the door's acknowledgement and name the console; one wire-contract file both sides' tests read. Second review not started | **merged into this branch at `1cd5a0d8` (02:12, a merge commit) after the gate and CI on `fc7daebd`; its `docs/site/cli.md` section is unreviewed public copy and must be read before anything publishes the site's CLI page (merging publishes nothing)**; before: not merged (it is built on the currency branch, which merges first). **Its `docs/site/cli.md` section is new public copy and is unreviewed**: it does not merge before Paul reads it

| `feat/carloku-principal-inventory-20261002` | `4a1a92d9` (the sixth review answered: an S3 action on an Object Lambda resource is a possible reach, the "possibly" label and the legend extended, the mutation paragraph as the logs have it); before it `36e5ff2d` (the fifth review answered: the possible reach decided by one text test on the pattern and its padded form, decision 14 names what the host role can mint through a store user, the legend's other spellings, a nil page an error); before it `403384c2` (the fourth review answered: a resource pattern read as text and, when it is an incomplete ARN, as padded fields too, a reach under either reported; nothing S3 names excluded, Storage Lens included; an empty condition, an operator with no key and an empty value list are errors; the `AssumableBy` legend and the "does not read" lists reworded for same-account trust, control of compute and IAM writes; counts tagged; the CUR plan and OUTSTANDING item 2 no longer name an inventory in the provisioner as the mechanism); before it `434cdf48` (the third review answered: every S3 resource that is not the bucket a possible reach; incomplete ARNs as IAM reads them; version ids unique; condition values checked; a group's possible reach carried to its members; the label renamed `named_by_deployment`; the attestation plan marked superseded in part); before it `0e1bc298` (the second review answered: a repeated JSON member is an error; a managed policy's default-version id must agree with the version marked default; every trust-policy statement read in full; a grant on an access point, a multi-region access point or an Object Lambda access point reported as a possible reach, marked; the two proposals stated with what they lack); before it `199a9736`: **a report for a person** (`PrincipalReport.BucketPrincipals`: who reaches a name, through which policies, and who each role's trust policy lets assume it), **not a `GranteeProber`** and a test says so; before it `d61f4f27`, which offered itself as the ledger's proof | `4a1a92d9`: **passed** (00:36Z, `gate-inventory-4a1a92d9.txt`, exit 0, three cross builds, alone). `36e5ff2d`: **passed** (00:26Z, alone). `403384c2`: **passed** (00:14Z, alone). `434cdf48`: **passed** (23:44Z, alone). Mutants in git-less tree copies with the killing tests logged from round five on: `inventory-mutants-round{1..6}.txt` | passed on `0e1bc298`, `434cdf48`, `403384c2`, `36e5ff2d` and `4a1a92d9` | **7 at `4a1a92d9`: both accept** (Opus: every sixth-round finding closed, two P3 bookkeeping items, neither required; Astra: accept, no new finding). 6 at `36e5ff2d`: Opus accept (three P3), Astra accept with fixes (one P2: Object Lambda's management actions in the s3 namespace on an Object Lambda resource), answered in `4a1a92d9`. 5 at `403384c2`: both accept with fixes (one P2 each: the possible-reach rule's text reading skipped for a complete pattern with a question mark across a colon; decision 14 understating the host role), answered in `36e5ff2d`. 5 at `403384c2`: running since 00:57 (Opus's third reading and Astra). 4 at `434cdf48`: Opus accept with fixes (two P2 required: an incomplete ARN read only as padded fields dropped grants the text reading reported; the legend wrong in the under-reporting direction), Astra reject (three P2: the Storage Lens exclusion dropped a write path; empty condition shapes read as a report; the legend), all answered in `403384c2`. 3 at `0e1bc298`: Opus accept with fixes (two P2 required: other S3 resource types dropped; the attestation plan still claiming an IAM read proves completeness), Astra reject (four P2, two P3). Answered; gate not yet run; never run against AWS. 1 at `d61f4f27`: Astra reject (three P1). Answered in `199a9736` by making it a report. 2 at `199a9736`: Astra reject (six P2: access-point grants under-reported; duplicate JSON members; default-version metadata not checked; trust-policy grammar; the two proposals overstated). Opus not yet read. Answered in `0e1bc298`; the third review (Astra) and Opus's first reading running on it | **merged into this branch at `c4ee8807` (01:40, a merge commit) after round seven's two acceptances, the gate and CI on `4a1a92d9`; the gate on the merged tip `c4ee8807` is queued behind the currency gate**; a report for a person, unwired; what a completeness claim needs is now decision 14 (an enforced rule; minted bucket names); the report can be run by an operator with their own credentials; never run against AWS

-| `design-per-line-tax-codes` | `61313bec` (per-line tax codes for a month in which the plan changed, OUTSTANDING item 17: the mechanics either answer to decision 16 needs, built behind the hold; design revision 4 after three Astra design rounds; Tasks 0 to 4 and 23 mutants) | `61313bec`: running, alone (`gate-taxcodes-61313bec.txt`); each task's commit had the full console, plans and billingstripe run | queued on `61313bec` | 1 at `61313bec`: running (Opus and Astra on the whole branch); design rounds: 1 Astra reject, 2 Astra accept with fixes, 3 Astra accept with fixes (confirming) | not merged; merges as a merge commit after both accept, the gate and CI, with Task 5's records (the ENABLEMENT activation rule); **a two-code month still holds; decision 16 and 16a to 16d are Paul's; every one-code month is byte-identical (pinned)** |

+| `design-per-line-tax-codes` | `12590e3a` (per-line tax codes for a month in which the plan changed, OUTSTANDING item 17: the mechanics either answer to decision 16 needs, built behind the hold; design revision 6 after three Astra design rounds; Tasks 0 to 4, the activation glue uncalled, three mutant batches) | `12590e3a`: **passed** (05:08Z, `gate-taxcodes-12590e3a.txt`, exit 0, three cross builds, alone); also `6488c198`, `8715e4cd`, `61313bec`, each alone; each commit had the full console, plans and billingstripe run | passed on `61313bec`, `8715e4cd`, `6488c198` and `12590e3a` | 1 at `61313bec`: both accept with fixes (Opus one P2, Astra three P2); 2 at `8715e4cd`: both accept with fixes (P3s only); 3 at `6488c198`, confirming: both accept with fixes (P3s only, no further round required), the fixes in `12590e3a` | **merged into this branch at `e2adf26f` (06:10, a merge commit) with Task 5's records; a two-code month still holds; decision 16 and 16a to 16d are Paul's; every one-code month is byte-identical (pinned); one behaviour changes for every month: a resumed finalize validates the draft it read** |

| site `feat/paid-pricing-20260916` (GitHub) | `01b62f7` (the money renderer a module the test calls); before it `4026231` (`build` and `check` render from the export before the draft check, so a stale page cannot be published past a newer export; a floor that is not whole cents is refused by the renderer rather than shown as `$1.20.5`; after `c12318d`: `bands.p3` replaced by the approved explanation, every priced slot, inclusion band and figure token pinned exactly) | `node --test test/*.test.mjs`: 21 pass (09:1xZ) | n/a | read-only by the currency reviews (section K); rounds four, five, ten, twelve to seventeen's site findings fixed | preview served at `http://100.119.180.57:38009` from the tree (rebuilt with the `bands.p3` change) |

## The flow, behaviour the tests establish (2026-10-02)