The printables studio: charter, org, architecture, and unit cost

1. The standing objective

The load-bearing claim in that objective is the third one, and it is worth being honest about it: "done = critic-gated deploys" is only as good as the critics. The existing critic family has a real track record on this exact product — the bilingual pack went four review rounds and the critic caught a muñeca illustration that read as "girl" rather than "doll" across two independent fresh-eyes reads. That is a working gate. It is also a gate that has never run unattended overnight without the founder seeing the output the next morning, which is precisely what decision (c) below asks permission to try.

2. Org design

Four role-scoped agents, dispatch-driven, following the pattern already approved and implemented for the support-agent fleet on 2026-08-08: named sessions, per-agent handoff files, crossSessionInbound: accept, and the standing traffic rule that only Ray talks to the founder. The studio roles are additions to that manifest, not a new mechanism.

Ray is the operator: dispatches the roles, runs the gates, writes the decision pages, and is the only session that speaks to the founder. The founder is the board: names, prices, rung transitions, spend. No role agent has channel plugins bound, so none of them can message anyone even by mistake.

Cadence

• Nightly cron — the studio round. One round per night: product dequeues, the relevant role builds, the assigned critic gates, and Ray files what passed. A round that produces nothing shippable produces a queue entry and a line in the handoff, not a message.
• On-demand. The founder can name a thing and the studio does it that session, bypassing the queue. This is expected to be the rarer path once the queue is generating its own work.
• Reporting. Silence between decision pages is the design. The morning brief carries a one-line studio state; anything more than a line means something needed a judgment, and that means a page.

The QA gate map

Which critic gates which artifact class. Every one of these already exists; nothing here is a new critic. Following the fleet proposal's deliberate exclusion, no critic is a standing agent — fresh-eyes review requires zero context, so every critic stays a per-dispatch subagent that never accumulates the build's framing.

3. Cloudflare architecture, tiers 1 to 4

One platform, four rungs, no rewrite between them. The through-line is that the queue is the seam: from rung 2 onward every generation request lands on a queue, and what drains that queue is an implementation detail that can be a local machine tonight and an API call later without the rest of the system noticing. That is what makes "generation stays local until volume forces the API" an architecture rather than a temporary state.

Every pack opens with a page for the parent

founder addition, 2026-08-30 evening Page one of every pack is not for the child. It is a parent-facing overview: what the activities in this pack are, and what the child is meant to learn from each one. The child's pages start on page two.

This is cheap and it is not cosmetic. Cheap, because the generator already carries the skills tags for every page it produces, so the overview renders information the engine holds and currently discards. Not cosmetic, because it does three things at once:

• It makes the curriculum legible. The account model in section 6 frames this product as "a curated education plan, packaged up as print-off games." A plan nobody can see is indistinguishable from a pile of worksheets. The overview page is where the plan becomes visible, and it is the difference between a parent thinking "here are some sheets" and "here is what we are working on."
• It is the trust artifact. The step-1 memo is blunt that free supply in this category is effectively unbounded and a parent can get something good enough for nothing in thirty seconds. What free packs almost never carry is a straight answer to "why these pages, in this order." That answer is the thing actually being sold, and page one is the cheapest place to demonstrate there is a reason behind the artifact.
• It is an honest constraint on the engine. A pack whose overview cannot be written without hand-waving is a pack whose pedagogical logic does not hold up. Requiring the page is a test the generator has to pass every time, and it will fail on exactly the packs that deserve to fail.

Scope note. This is one more page per pack, one more template, and one more thing the design critic gates. It is not free work, and the step-1 sizing already flagged that "we mostly have it" is how scope estimates go wrong. Budget it as a real template, not as a header.

correction Email Routing cannot send the booklets. Cloudflare Email Routing routes inbound mail and its sends go only to verified destination addresses — it is not a transactional sender to arbitrary customers. Use it for the inbound side (a hello@ that lands in the founder's mailbox) and use Resend for outbound delivery, which is already the newsletter's sender. Cited because it is the kind of thing that looks fine in an architecture diagram and fails on the first real send.

4. What it actually costs

Phase one: generation local, hosting on Cloudflare

Every rate below was read off Cloudflare's own published pricing pages on 2026-08-30. The step-1 memo estimated "pennies per month" with no source; the estimate was wrong in the harmless direction.

All Cloudflare rates and allotments on this page, including the tier 2 to 4 figures above, come from developers.cloudflare.com: R2 pricing, Pages pricing, Pages limits, Workers, Queues, D1, Durable Objects, Workflows, Email Routing. All fetched 2026-08-30. Pages bandwidth limits are not stated on the limits page and are therefore not claimed here.

Where zero stops being zero. R2's 10 GB free tier holds roughly 38,000 activities at the observed PDF size of ~260 KB. The 10-million-Class-B free tier covers roughly 5 million downloads a month, at an assumed 2 Class B operations per download (assumption; the divisor is printed because nothing else on this page divides by an unstated number). Neither is a constraint this product will meet before something else breaks first. The first real bill is the $5/month Workers Paid plan at rung 2, and it is a flat floor, not a variable cost.

Phase two: generation on the API

This is the number that decides whether a subscription can exist, because it is the only cost that scales with customers. Modeled on a 7-page custom pack: the same shape as the bilingual pack actually built on 2026-08-30.

What is measured, and what is not. The page counts, file sizes and round counts below are read off the library and the session transcript. The token split is derived from those measurements, not observed directly, and the reason is worth stating: both packs were built inside the always-on channels session, so the transcript's token totals for that window include roughly 41.5 million cache-read tokens of long-session context replay that have nothing to do with printables. Using that figure as a per-pack cost would overstate it by more than an order of magnitude. What the transcript does give honestly is 131,938 output tokens across the whole window — two packs plus narration plus unrelated replies — which is a usable ceiling on the two builds' generation output.

sourcing Model rates read from the local claude-api skill's model table, which carries its own cache date of 2026-06-24. They were not fetched from a live pricing page, unlike every Cloudflare rate above, which was. On a page that makes a point of sourcing, the rate that matters most is the one with the weakest sourcing, and that is worth knowing before leaning on the break-even numbers. Confirm against anthropic.com/pricing before any of this sets a price. (The research behind this page was done on the evening of 2026-08-30; the page carries the 2026-08-31 dateline it was published under.)

Read that comparison, not just the first row. The packs built on 2026-08-30 ran on Opus. Modelling the business on Sonnet 5 is a 2.5× cost improvement that assumes Sonnet produces packs the critics pass at the same rate — which has not been tested, because it has never been tried. That assumption is doing real work in every number below it. The cheap version of testing it is to run the next few library packs on Sonnet and watch the round count; if rounds go from four to seven, the saving evaporates and Opus was cheaper all along.

Sensitivity. The derived token split could plausibly be half or double. At Sonnet 5 that is a band of $0.355 to $1.420 per pack, which is exactly half and exactly double the $0.710 basis, central estimate $0.71. Prompt caching is an unpriced downside lever — roughly 20,000 of the 25,000 input tokens per build call are a stable prefix (design contract plus template) and are exactly what caching is for, but no cache-read rate was verified for this page, so no discount is claimed. Treat $0.71 as a ceiling that engineering should be able to beat.

Break-even at three candidate prices

The founder's pricing shape is a cheap subscription plus customization credits, where credits are the cap on runaway generation. That makes the design question not "what price" but "how many credits at that price," because the credits allotment is the only thing standing between a subscriber and unbounded cost. Every allotment below is therefore checked at full burn, the worst case, not at an assumed average.

Every figure in the two tables below is computed from $0.710 per pack and from the rounded values printed in its own row, so each cell is reproducible from what is on the page rather than from an unrounded intermediate. Subscriber counts round up to whole people. assumption Payment processing modeled at 2.9% + $0.30 per transaction, the commonly published US online-card rate. This was not fetched from a live processor pricing page and is unverified. It moves contribution by cents, not by conclusions, but it is not a sourced number.

Break-even against infrastructure

The only fixed cost is the $5.00/month Workers Paid floor. Using full-burn contribution, the conservative case:

• $4/mo, 3 credits → 4 customers
• $7/mo, 6 credits → 3 customers
• $9/mo, 10 credits → 4 customers
• $9/mo, 7 credits (repaired) → 2 customers

These numbers are true and almost meaningless. Three or four customers covers the hosting. Nobody should feel encouraged by that; it is a restatement of the fact that Cloudflare is cheap, not evidence that anyone will pay.

Break-even against the thing that is actually scarce

The step-1 memo already identified founder attention as the only genuinely scarce input, and the kill criteria cap it at 2 hours a week — about 8.7 hours a month. Pricing that time is the only way to get a break-even number that means anything.

assumption Founder time valued at $150/hour, giving $1,300/month. This is a placeholder chosen to be in the right neighborhood of a senior data-consulting rate; the founder should replace it. Every number below scales linearly with it — halve the rate, halve the subscriber count.

So the real number runs from about 240 to about 970 subscribers, depending on price, allotment, and how hard people actually burn credits. For scale: the step-1 kill criterion asks for ten non-family downloads in ninety days. The distance between that bar and several hundred paying subscribers is the actual size of the bet, and it is worth looking at directly rather than past. Nothing in this section argues the bet is winnable; it argues what winning would have to look like.

5. Name shortlist: two finalists, two families

The founder named two instincts across the evening of 2026-08-30. One is warm, small-scale, paper-and-press, with Little Press his stated favorite. The other is playful and childish, citing Humongous Entertainment (Putt-Putt, Freddi Fish, Pajama Sam) as the formative influence, and from that family he picked out Scribble Works. Fifteen candidates were checked against live registries. Both favorites turned out to be interesting for the same unexpected reason.

The two finalists

The asymmetry worth noticing. Scribble Works has a free .co and Little Press does not. Scribble Works can be adopted today at zero cost and upgraded to the .com later if the price is right; Little Press has to be resolved by a purchase or a modifier before it can be used at all. Beyond the domains, thescribbleworks.com and scribbleworks.kids also came back likely available, so that name has fallbacks and Little Press does not. None of this argues Scribble Works is the better name. It argues it is the cheaper one to be wrong about — and the existing-use findings below argue something stronger.

Existing-use check: this is where the two finalists separate

A registry check tells you who holds a domain. It does not tell you whether a company is already trading under the name. That search was run, and it found something on both.

Scribble Works has two softer collisions. Neither looks disqualifying, and both should be seen:

• Scribble Works Publishing House, Accra, Ghana. An edtech company founded 2017 building assessment-analytics and math-learning tools for African classrooms; backed through the MEST Mastercard Foundation fellowship and a UNICEF accelerator, and listed as active on Crunchbase. Same broad sector, different continent, different product, and they operate on .tech. A real collision, but not the same market.
• USPTO serial 75750242, "SCRIBBLEWORKS", filed 1999 in Class 16 for "printed paper containing stories for children to color." Abandoned in 2002 for failure to file a statement of use. Dead, and therefore not a bar, but worth knowing that the exact name was once claimed in almost exactly this category and then let go.

Family one: warm / press — the rest

Family two: playful — the rest

What the Humongous names actually do is put a character in the name: silly, concrete, sayable by a four-year-old, promising play rather than instruction. None of them contain a word like "press," "learning," or "academy." These were generated against that pattern.

read this before reading the tables Every "unknown" in the .dev column is genuinely unknown, not a soft yes. The .dev registry returned only a top-level referral record with no registrar data for most names, and those lookups produced no signal either way. The .dev results that are evidence are Pocket Press, PagePress and Doodlebug, all of which resolve to live hosts. Do not read the blanks as available.

The pattern across both families. Fourteen of fifteen names have a taken .com and, in most cases, a free .co. That is not bad luck; it is what the two-word English compound namespace looks like in 2026. Unless the pick is Table Pages, this product ships on a .co or buys a .com, and both finalists happen to be buyable.

No recommendation is offered and no name is being decided by the studio. The step-1 memo's third brand direction, the founder's own name, is on neither list and has not been withdrawn. What this section adds is that the naming conversation now has facts under it instead of sketches — including the useful surprise that both favorites are purchasable, and the uncomfortable one that Little Press is already the name of an active American children's publisher.

6. The account model: adult-first, household-scoped

confirmed by the founder 2026-08-30 evening This section is no longer a guess. The reading is the account model, and the shape is adult-first: the person who signs up is a parent, not a child.

The shape

• An adult signs up. The account holder is a parent. Email, billing, credits: all of it hangs off the adult, which is the ordinary shape for a consumer subscription and sidesteps the entire category of problems that come with a child-facing account.
• The account is a household. The parent can invite a spouse, who gets equal standing rather than a view-only seat. Not a nicety: in this household the wife is the one marking up printed pages, and a product built out of that loop that then models her as a guest has misunderstood its own origin story.
• Children are sub-profiles under the household. Not accounts. No login, no credentials, no independent existence outside the household that created them.
• Each child carries a name, a birthday, interests, and the topics the parent wants them to focus on. That last field is what makes the framing real. Interests are what a child will engage with; focus topics are what a parent has decided matters. A plan needs both, and the gap between them is the gap between entertainment and a curriculum.

Why birthday and not an age band, reversing the earlier sketch. The previous draft argued for a band on the grounds that a precise date is personal data bought for no gain. Under the plan framing there is a gain: a curriculum that runs for months has to know when a child crosses a developmental threshold, and a band cannot tell you that a child turned four last week. The founder specified birthday. The privacy answer is not to degrade the field, it is to keep it inside household scope.

Privacy: household-scoped, concretely

• Child data drives generation and never leaves household scope. Readable by the two adults on the account and by the generation path serving that household. Not aggregated across households, not used to train anything, not sold, not exposed to any third party.
• No third-party analytics on any surface where a child profile is visible. No advertising pixels anywhere in this product, at any rung, ever. Growth's charter escalates analytics placement rather than owning it, and this is why.
• Name and birthday are the sharpest fields and travel least. Substituted client-side into the artifact where the template allows; where generation genuinely needs them, passed with the job and dropped on completion. Not written to logs, not left in a queue message body after the job clears.
• Retention is a time-to-live. Generated personalized artifacts expire. Delivery history keeps the activity ID and the date, not the rendered sheet.
• Deleting the household deletes the children. One action, real deletion rather than a flag. A sub-profile with no independent existence should have no independent survival.

Not legal advice and not a compliance review. A parent providing information about their own child under their own account is the lower-risk shape, which is part of why adult-first matters beyond product tidiness, but this is still children's data and a real product should have someone qualified look at it before it takes a payment.

7. The case against this whole page

Everything above argues locally against itself and never once argues against the headline ask. That is a gap, and the Archive button at the bottom deserves a section that actually makes its case. Here it is at full strength.

The counter-argument, stated fairly. The charter is cheap and reversible: no spend beyond a $5/month floor that only starts at rung 2, no external commitments, and a manifest line that deletes the whole studio. The nightly cron is a switch that can be turned off tomorrow. And the argument for building the org before the evidence is that the org is what makes the ninety-day read arrive at all, because a hand-built step 1 competing for founder weekends against everything else is exactly how this ends up shipping in March. Both of those are real. The honest summary is that the charter is defensible and the nightly cron is the genuinely contestable half, which is why they are separate buttons.

What would prove the studio frame wrong

Pre-registered here so it is not reinterpreted later, and separate from the product kill criteria, which are dormant until launch. Any one of these means the studio was the wrong shape, independent of whether the product works:

• Three consecutive nightly rounds produce nothing that passes a gate. The queue is generating work the critics reject, which means the studio is manufacturing rework.
• Founder time goes up after the studio starts. The whole premise is that it comes down. If reviewing the studio's output costs more than doing the work did, the machine is a tax.
• Any nightly round requires a morning correction the founder did not ask for. Once is a bug. Twice means unattended operation is not earned yet, and the cron goes back to on-demand.

8. What I need from you

(a) The charter: accept or amend

Sections 1 through 3: the standing objective, the four roles with their autonomy and escalation boundaries, the cadence, the QA gate map, and the tier-1-to-4 architecture. The specific things most worth pushing back on are the escalation lines — particularly engineering's hard gate on anything that starts a bill — and the tier-2 consequence that keeping generation local turns the magic moment into a wait.

(b) The name

Facts are in section 5, no recommendation. Two finalists, one from each family you named: Little Press and Scribble Works. The useful surprise is that both .com domains are listed for sale rather than in use, so this is a price question, not an availability question — and neither price has been looked up yet, which is a two-minute browser job. The asymmetry that matters: scribbleworks.co is free, so that name works today at zero cost and can upgrade to the .com later; littlepress.co is taken, so Little Press needs the purchase or a modifier before it can be used at all. The uncomfortable finding: The Little Press, LLC is an active New Jersey children's book publisher with 2025 trade-press coverage, which is a direct collision in exactly this market. Scribble Works has two softer ones, a Ghanaian edtech firm on .tech and a 1999 USPTO filing abandoned in 2002. Neither name is cleared, and clearance comes before adoption. "Get me both prices first" is a real answer, and so is "the founder's own name," which is still live from the step-1 memo.

the expensive one Of the three decisions on this page, this is the one that gets costly to undo. The charter is a document and the cron is a switch; both reverse in a turn. A name accumulates search authority, an audience association, and a story that returning visitors have already learned, and none of that transfers. It is reversible today at essentially zero cost and materially expensive by rung 4, which is the same framing the step-1 memo now uses for the founder's-own-name option. Picking one tonight is cheap; picking one after the catalog has ranked is not. That argues for deciding it early, not for deciding it quickly.

(c) The nightly studio cron

Greenlight or hold the nightly round: product dequeues, a role builds, a critic gates, Ray files what passed. This is the one decision on the page that changes what happens while the founder is asleep, and it is the ask this page is least able to reassure you about, because section 1 concedes the gate has never run unattended overnight.

So it comes with a circuit breaker, not just escalation boundaries. If the cron is greenlit, these are part of the greenlight:

• One artifact per round. Not a batch. A bad night costs one artifact, not a queue's worth.
• Three critic iterations, then stop. If an artifact has not passed by the third round, it goes back to the queue with the findings attached and the round ends. No unbounded revise-recheck loop, which is the shape that quietly consumes a whole night of capacity.
• Nothing reaches production overnight. Engineering's hard gate already covers this, and the cron does not soften it: branches and previews only, and a human-visible deploy in the morning.
• Blast radius, stated. Worst realistic case is a branch nobody wants, a preview URL nobody visits, some Max capacity spent, and a vault note to retract. No production writes, no spend, no outbound anything, no channel access on any role agent.
• Kill switch. Removing the manifest line stops the whole studio. Any message from the founder saying stop stops it that turn.
• Two-week review. The cron gets re-decided against the three pre-registered failure signals in section 7, not left running by default.

Holding it costs nothing except that the studio runs only when asked. Not holding it costs some Max capacity of unmeasured size and the standing risk that unattended work is wrong in a way nobody sees until morning.

Already answered, not asked

The account model in section 6 and the parent-overview page in section 3 came from the founder on the evening of 2026-08-30 and are recorded as settled. They are noted here so it is obvious they were not decided by the studio. Both have consequences worth pushing back on if the founder disagrees with how they were read: the account model forces the child profile server-side from tier 2 and gives up the local-first guarantee the earlier draft claimed, and the overview page adds a template and a critic gate to every pack in step-1 scope.

Lock in

Verification trail

Fresh-eyes /verify-strategic-output gate, three rounds, zero build context each. The producer of this page did not score it.

• Round 1: ITERATE, 14 findings. Three were blocking. The Claude API model rates — the only cost on the page that scales with customers — were the one rate with no source, on a page that links and dates every Cloudflare figure. The R2 free-tier sizing did not follow from its own stated per-file size (10 GB at 260 KB is roughly 38,000 activities, not the 6,000 printed) and contradicted the tier-1 table row. And the QA gate map claimed in the past tense that this page had already been through the gate that was at that moment still running, which is a false verified stamp on the page whose subject is "done means critic-gated." The other eleven: Max-subscription capacity priced at zero, a "review rounds" input contradicting its own decomposition, an inconsistent cost basis across break-even rows, a subscriber band that rounded its own worst case out, a repaired $9/7 credit shape the page invented and then omitted from its own table, a pricing verdict with no decision surface, unsourced tier 2-4 costs rendered at the same visual confidence as the audited tier-1 zeros, flat "available" where the evidence supported "likely available," a nightly-cron ask with no circuit breaker, and no consolidated bear case against the headline ask.
• Round 2: ITERATE, near-pass. Twelve of the fourteen confirmed fixed, one partial, one not. The verifier independently opened the local claude-api skill table to check the model rates matched, and recomputed every cell of both break-even tables. What survived: the review-rounds reconciliation had replaced a 4-vs-6 contradiction with an 8-vs-6 one, four emissions not being a possible subset of three pack-rewriting passes; the sensitivity band printed $1.45 where double $0.710 is $1.420; the repaired $9/7 option reached one table but not the other; the design-rule paragraph said "not a shortlist" and "beats $7 outright" in the same breath; the page said "three asks" while carrying four buttons; and one divisor was doing unstated work.
• Round 3: PASS. All seven round-2 items confirmed fixed against the current text. Both break-even tables and the full cost model recomputed independently from the $0.710 basis and the rounded values printed in each row; no cell failed and no new arithmetic error was found. Rubric PASS on confidence-evidence calibration, dollar-amount verification, prior-pushback application, false convergence, and bear-case substance; backtest integrity not applicable. Coherence PASS on all three axes. Four minor non-blocking notes were raised and all four were applied before publishing: an "orders of magnitude" overclaim in the tier-2 cost note, a 2% round-up on the output-token total, an ambiguous percentage phrasing, and a missing prose block for the profile clarification.
• Not treated as findings. The sms:...&body= link form is house convention across the decisions corpus and traces to a founder bug report dated 2026-05-09; ?body= is the form that fails on the iOS Messages handler. The settled founder rulings of 2026-08-30 evening were given to each verifier as settled, so no round scored them.
• Process gap, carried forward from the step-1 memo and still not closed. No pre-registered ACCEPTANCE CONTRACT accompanied any of the three dispatches. Rounds 2 and 3 used the prior round's findings as a de-facto contract, which is better than nothing and weaker than a contract written before the artifact. This is the second consecutive printables page to note it. Attach one next time or stop writing that sentence.
• Amendment after the gate, 2026-08-31. The founder sent three additions the same evening the page published: the account model confirmed as adult-first and household-scoped, a parent-facing overview page on the front of every pack, and two rounds of naming direction ending in two finalists, Little Press and Scribble Works. These were applied after the round-3 PASS and therefore did not go through the three-round gate, which is the honest status. Two of them carry consequences worth checking rather than accepting: the account model forces the child profile server-side from tier 2 and gives up the local-first guarantee the reviewed draft claimed, and the overview page adds a template plus a critic gate to every pack inside step-1 scope. The Little Press domain facts came from a live registry check run for this amendment.
• One thing the verifiers could not check. Every round scored the page. None of them ran anything. The unit-cost model is the page's most consequential content and it rests on a token split that was derived, not observed, because the packs it describes were built inside a long-lived session whose transcript cannot separate them. The honest status is that the model is checkable arithmetic on top of an unverified measurement, and the cheapest way to fix that is the Sonnet round-count test the page itself proposes.