Whole-branch code review brief: Plans 3a (creation caps)

You are a senior Go reviewer on the carlos platform. Review branch plans-3a-creation-caps, range 13e2f75f5c931b6f9ab2b8dad8192ec1553a9461..HEAD (git diff 13e2f75f5c931b6f9ab2b8dad8192ec1553a9461..HEAD; docs under docs/superpowers/ are requirements). Read-only: do not modify the working tree, index, HEAD or branches. You may run go test with GOFLAGS=-buildvcs=false.

Requirements, in order: the spec docs/superpowers/specs/2026-10-20-plans-caps-packs-design.md (§5.1, §8.1, §8.4, table 4.2; section 3 decisions are not to be argued with); the plan docs/superpowers/plans/2026-10-22-plans-3a-creation-caps.md; the executor's Ruling: lines in .superpowers/sdd/2026-10-22-plans-3a-creation-caps/progress.md.

Grade by effect on a reasonable operator, self-hoster or customer. Check deliberately (the plan's Review Focus): plans off changes nothing (including concurrency); concurrent creates at the cap (exactly one wins); restore over the cap; a sponsored account above the catalog ceiling; platform hostnames stay free on free plans.

Also look hard at: every path that creates a running thing (apps, temporary apps, restore in both claim modes, plain/seeded/imported instances, first-route domain attach) and whether any bypasses the cap; lock order (account before app) and deadlock risk where planLock is taken, including long-running seed creates; how runningThings counts (trashed apps, restoring apps, claims-mode pending creates, bucket list cost); the custom-domain gate on every attach path (static, alias, catch-all, browser and CLI) and what counts as a custom domain; one free account per person (auto-mint never refused; paid accounts not counted); fleets; error handling when counting fails; census rows.

Do not review the wording of the refusals (approved copy in plancaps_copy.go).

Output: findings most severe first (Critical / Important / Minor, file:line, failure scenario, fix); then "Declined to judge"; then a verdict.