[deku2026]

Summary

This PR applies ArcForges-Design AD-0021 §13a: the owner's decision of 2026-10-28, in Design PR "hosted subscriptions and self-hosted mode", which merges first.

Task changes:

• AF-CTR-02: adds the explicit, fail-closed center mode (official-hosted or self-hosted). A missing or invalid mode refuses to start.
• AF-CTR-03: adds feature availability:
  • the entitlement resolver, snapshots and grants are ported to Go and PostgreSQL, with C# test-vector parity (moved here from AF-CTR-09);
  • catalogue configuration keeps development fixtures distinct from production settings;
  • operator grants are audited and require a HUMAN step-up;
  • official-hosted gates cover center-mediated connectivity, execution, monitoring and control, and MCP;
  • sign-in, account, billing, security and recovery are not gated;
  • self-hosted mode gets a built-in default with optional operator limits.
• AF-CTR-04: enrollment needs no subscription; node connectivity is gated by AF-CTR-05.
• AF-CTR-05 and AF-CTR-07: apply the gate after authentication and authorization, with acceptance tests per mode.
• AF-CTR-09, AF-CLD-03 and AF-COM-01: adjusted to match.

Records:

• Acceptance register: H-07 is partly decided. It stays open for prices, trials, node limits, traffic allowances, currencies and introductory offers. No sales are activated.
• Ledger: one plan record.

Serial delivery is unchanged. AF-CTR-01 stays the single active task.

Verification

• plan.py validate --design <companion Design branch>: 0 errors.
• Tool tests: 48 OK.
• Host statuses come from python eng/verify.py run-and-report; they are re-run after the Design PR merges.

---

Generated by Claude Code

[deku2026]

Independent review record

An independent reviewer who did not author the change reviewed this PR together with ArcForges-Design #40, checking it against the owner's reply of 2026-10-28.

Round 1 at 9d3432d: approved, with non-blocking findings N-5 and N-6.

• N-5: the test that essential operations stay available without a subscription belonged in the tasks that build those operations.
• N-6: operator grants could become a standing free allowance.

Round 2 at c9d5e6a: approved.

• AF-CTR-03 now requires each operator grant to name the account, features, reason and expiry, and refuses catalogue-wide grants in production. It names the feature keys.
• AF-CTR-03's acceptance is narrowed to the essential operations it delivers.
• AF-CTR-05 now closes a node's connection when its subscription lapses.
• AF-ID-02, AF-COM-01 and AF-CLD-04 gain acceptance criteria for working without a subscription and for gating monitoring, and they are now linked to R-CTR-017.

The reviewer also confirmed:

• No task was added or removed, and no state, dependency or title changed.
• The ledger is append-only.
• AF-CTR-01 is still the single active task.
• H-07 stays open for the actual values, and no sales are activated.

Checks the reviewer re-ran:

• plan.py validate --design: 0 errors.
• check_design.py --require-protoc --plan: 0 errors.

Host statuses at c9d5e6a, re-run after Design #40 merged (eec92af):

• arcforges/linux: passed.
• arcforges/windows: passed.

---

Generated by Claude Code