Printables studio charter: org, architecture, unit cost, name

Amended 2026-08-31 after publishing, on founder input the same evening: (1) the account model is CONFIRMED and adult-first, not a guess; (2) every pack's first page is a parent-facing overview; (3) the name shortlist is now two families with two founder-picked finalists, Little Press and Scribble Works - both .com domains are LISTED FOR SALE rather than in use, and an active NJ children's publisher already trades as The Little Press. These landed after the three-round gate and did not go through it.

Vault copy of the HQ decision page published 2026-08-31. Three decisions open with the founder: accept-or-amend the charter, pick a name, greenlight the nightly studio cron. A fourth item (child-profile design) is a clarifying question, not a decision.

Settled going in (founder rulings 2026-08-30 evening, not relitigated)

Step-1 scope approved. Kill criteria DORMANT until "launched" is declared - no clock during development. Multilingual is an ENGINE PROPERTY, not Spanish positioning. Target = tiers 1-4 of the trust ladder. Cloudflare is the platform. Generation stays local on the founder's Max subscription until volume forces the API. Pricing shape = cheap subscription plus customization credits, where credits are the cap on runaway generation. Org = role-scoped subagents, critic family as QA, Ray as operator, founder as board.

1. The standing objective

• Climb tiers 1-4. Tier 5 (turnkey service) is explicitly out of scope and gets its own decision later.
• Work self-arrives. Seasonal calendar, library taxonomy gaps, and the rung backlog are readable inputs; the nightly round dequeues from them. The founder is not a task queue.
• Done = critic-gated and deployed. Not drafted, not ready-for-review. What cannot pass its gate goes back to the queue, not to the founder.
• Founder touchpoint = decision pages. Between pages the studio is silent and productive.

The load-bearing claim is the third. It rests on the critic family having a real track record on this exact product - the bilingual pack went 4 review rounds and the critic caught a muñeca illustration reading as "girl" across two independent fresh-eyes reads. That gate works. It has never run unattended overnight, which is exactly what decision (c) asks permission to try.

2. Org design

Four role-scoped agents, dispatch-driven, extending the support-agent fleet pattern approved and implemented 2026-08-08 ([[2026-08-08-support-agent-fleet-proposal]]): named sessions, per-agent handoff files, crossSessionInbound: accept, and the standing rule that only Ray talks to the founder. No role agent has channel plugins bound.

Cadence. Nightly cron = one studio round (product dequeues, a role builds, the assigned critic gates, Ray files what passed). On-demand for founder-named work. Reporting is a one-line studio state in the morning brief; more than a line means something needed a judgment, which means a decision page.

QA gate map

No critic is a standing agent - fresh-eyes review requires zero context, so critics stay per-dispatch subagents. This follows the fleet proposal's deliberate exclusion.

Named gap: there is no gate on the queue - on whether product picked the right next thing. Critics score artifacts, not priorities. A studio that ships four critic-passing activities nobody searches for has passed every gate and still wasted a month. Growth's instrumentation is the only feedback closing that loop, which is why it is on the critical path. Stated, not solved; solving it needs live traffic that does not exist.

3. Cloudflare architecture, tiers 1-4

The queue is the seam. From rung 2 on, every generation request lands on a queue; what drains it can be a local machine tonight and an API call later without the rest of the system noticing. That is what makes "local until volume forces API" an architecture rather than a temporary state.

Honest consequence of local generation at tier 2: a web visitor cannot be served by a Max subscription. Keeping generation on the founder's machine means the "magic moment" is not an 8-second spinner - it is "check back in a few minutes" or an email. That is a product consequence of a cost decision. The queue seam means flipping later is a runner swap, not a redesign, but rung 2 is called the magic moment and asking someone to wait is a different moment.

Correction worth carrying: Cloudflare Email Routing cannot send the booklets. It routes inbound mail and sends only to verified destination addresses - not a transactional sender to arbitrary customers. Use it for inbound (hello@) and Resend for outbound, which is already the newsletter's sender.

Every pack opens with a page for the parent (founder addition, 2026-08-30 evening)

Page one of every pack is not for the child. It is a parent-facing overview: what the activities are, and what the child is meant to learn from each. The child's pages start on page two.

Cheap, because the generator already carries the skills tags for every page it produces - the overview renders information the engine holds and currently discards. Not cosmetic, because it does three things at once:

• It makes the curriculum legible. The account model frames this as "a curated education plan, packaged up as print-off games." A plan nobody can see is indistinguishable from a pile of worksheets. This page is where the plan becomes visible - the difference between "here are some sheets" and "here is what we are working on."
• It is the trust artifact. The [[2026-08-30-step1-memo|step-1 memo]] is blunt that free supply here is unbounded and a parent can get something good enough for nothing in thirty seconds. What free packs almost never carry is a straight answer to "why these pages, in this order." That answer is the thing being sold; page one is the cheapest place to show it.
• It is an honest constraint on the engine. A pack whose overview cannot be written without hand-waving is a pack whose pedagogical logic does not hold up. Requiring the page is a test the generator must pass every time, and it will fail on exactly the packs that deserve to fail.

Scope note: one more page per pack, one more template, one more thing the design critic gates. Not free work. The step-1 sizing already flagged that "we mostly have it" is how scope estimates go wrong. Budget it as a real template.

4. Unit cost

Phase 1 - generation local, hosting on Cloudflare

All rates read off developers.cloudflare.com on 2026-08-30 (research done the evening of 2026-08-30; the page carries the 2026-08-31 dateline it published under). The step-1 memo's unsourced "pennies per month" was wrong in the harmless direction.

Sources: R2 · Pages pricing · Pages limits · Workers. Pages bandwidth limits are not stated on the limits page and are therefore not claimed.

The cost this table does not price: rate-limit capacity. "$0.00 marginal" is true in dollars and misleading as a whole truth. A nightly round of four role agents plus per-artifact critic subagents draws on the same Max plan capacity phData work, the newsletter and the investing crons draw on. This page prices founder hours carefully and then treats founder compute as free and unbounded, which it has no evidence for. It is unmeasured - no instrumentation exists that would say what one studio round costs or what it displaces. That is the argument for the round budget in the cron ask rather than an unbounded nightly loop.

Where zero stops being zero: R2's 10 GB free tier holds ~38,000 activities at the observed 260 KB PDF size; the 10M Class B free tier covers ~5M downloads/month at an assumed 2 Class B operations per download. Neither binds before something else breaks. The first real bill is the flat $5/mo Workers Paid plan at rung 2.

Phase 2 - generation on the API

Modeled on a 7-page custom pack, the shape actually built 2026-08-30.

Measured vs derived. Page counts, file sizes and round counts are read off the library and the session transcript. The token split is derived, not observed: both packs were built inside the always-on channels session, so that window's transcript carries ~41.5M cache-read tokens of long-session context replay unrelated to printables. Using it as per-pack cost would overstate by more than an order of magnitude. What the transcript gives honestly is 131,938 output tokens across the whole window (two packs + narration + unrelated replies) - a usable ceiling on the two builds.

Sourcing caveat. Model rates read from the local claude-api skill's model table, which carries its own cache date of 2026-06-24. They were not fetched from a live pricing page today, unlike every Cloudflare rate above. The rate that matters most is the one with the weakest sourcing. Confirm against anthropic.com/pricing before any of this sets a price.

Read the second row. Modeling on Sonnet 5 is a 2.5x improvement that assumes Sonnet produces packs the critics pass at the same rate - untested, because never tried. That assumption does real work in every number below. Cheap test: run the next few library packs on Sonnet and watch the round count. If rounds go 4 → 7, the saving evaporates.

Sensitivity: the derived split could be half or double → $0.355-$1.420 per pack at Sonnet 5 (exactly half and exactly double the $0.710 basis), central $0.71. Prompt caching is an unpriced downside lever - ~20,000 of the 25,000 input tokens per build call are a stable prefix (design contract + template), exactly what caching is for, but no cache-read rate was verified, so no discount is claimed. Treat $0.71 as a ceiling engineering should beat.

Break-even

Credits are the cap on runaway generation, so every allotment is checked at full burn, not at an assumed average. Payment processing modeled at 2.9% + $0.30 - the commonly published US online-card rate, not fetched from a live processor pricing page, unverified.

Every figure below is computed from $0.710/pack and from the rounded values printed in its own row, so each cell is reproducible from what is on the page. Subscriber counts round up to whole people.

The $9 tier as drawn is the worst of the three, and that is the finding. At ten credits it earns less per subscriber at full burn ($1.34) than the $4 tier at three credits ($1.45), because the allotment grew faster than the price. Credits must scale sub-linearly with price, or the top tier becomes the loss-leader - and heavy users pick the top tier. Standing rule to keep: full-burn contribution must not fall as price rises. A $9/7-credit tier fixes it ($3.47).

Against infrastructure (the flat $5/mo floor, full-burn contribution): $4/3 → 4 customers · $7/6 → 3 · $9/10 → 4 · $9/7 (repaired) → 2. True and almost meaningless: it restates that Cloudflare is cheap, not that anyone will pay.

Against the scarce input. Kill criteria cap founder time at 2 hrs/week ≈ 8.7 hrs/month. Valued at $150/hr = $1,300/mo - a placeholder in the right neighborhood of a senior data-consulting rate, which the founder should replace; every number scales linearly with it.

The real number runs from about 240 to about 970 subscribers, depending on price, allotment and burn. For scale: the step-1 kill criterion asks for ten non-family downloads in ninety days. The distance between that bar and several hundred paying subscribers is the actual size of the bet.

No price is picked here, deliberately. The step-1 memo's standing recommendation is to ship free and instrumented and not to price until there is a non-zero number in the dashboard; nothing here supersedes that. What this section produces is a design rule for whenever pricing is decided: full-burn contribution must not fall as price rises. The $9/10 row violates it; $9/7 repairs it. These tables are a constraint on future allotments, not a shortlist.

5. Name shortlist: two finalists, two families

The founder named two instincts on 2026-08-30 evening. One warm/small-scale/paper-and-press, favorite Little Press. One playful-childish citing Humongous Entertainment (Putt-Putt, Freddi Fish, Pajama Sam), from which he picked Scribble Works. Fifteen candidates checked against live registries.

The finding that changes the question: both favorites are FOR SALE

• littlepress.com — registered through Atom (formerly Squadhelp), a premium brand-name marketplace. NS = ns1/ns2.atom.com; 302-redirects to atom.com/name/LittlePress, a listing page. Not a business — inventory.
• scribbleworks.com — NS = ns1/ns2.namefind.com (GoDaddy's domain-investment arm), serves a JS redirect to /lander. Standard parked-for-sale shape.

So the question is not "which is available" but "what are these worth." Neither price was obtained — the Atom listing sits behind a Cloudflare bot check, the GoDaddy lander renders price client-side. Two-minute browser job, not a decision.

The two finalists

The separator is existing use, not domains. The Little Press LLC is same country, same customer, adjacent product, and already in market — a materially worse problem than a taken domain, and the strongest single fact on the naming question. Not necessarily a legal bar (that's for someone qualified), but a parent searching either brand finds the other, which is the practical version regardless.

The asymmetry. Scribble Works can be adopted today at zero cost on the .co and upgraded to the .com later; Little Press needs a purchase or a modifier before it can be used at all. Not an argument that Scribble Works is the better name — an argument that it is the cheaper one to be wrong about.

Clearance caveat. The existing-use search ran through web aggregators (Justia, Crunchbase, trade press), not the USPTO database, and no state or international registries were checked. An active registration could exist unsurfaced. Absence of a hit is weak evidence, not clearance. Clearance precedes adoption.

Family one: warm / press — the rest

Family two: playful — the rest

The Humongous names put a character in the name: silly, concrete, sayable by a four-year-old, promising play rather than instruction. None contain "press," "learning," or "academy." Generated against that pattern.

Every .dev "unknown" is genuinely unknown, not a soft yes — the registry returned only a top-level referral with no registrar data for most names. The .dev results that ARE evidence: Pocket Press, PagePress, Doodlebug, all resolving to live hosts.

The pattern: fourteen of fifteen have a taken .com and usually a free .co. Not bad luck — that is what the two-word English compound namespace looks like in 2026. Unless the pick is Table Pages, this product ships on a .co or buys a .com, and both finalists happen to be buyable.

No recommendation, and no name decided by the studio. The step-1 memo's founder's-own-name direction is on neither list and has not been withdrawn.

6. The account model: adult-first, household-scoped — CONFIRMED

Founder-confirmed 2026-08-30 evening. The reading is the account model, and the shape is adult-first: the person who signs up is a parent, not a child.

The framing, in the founder's words: "a curated education plan or tutor, packaged up as print-off games." That sentence is worth more than the schema. It settles what the product is: not a worksheet catalog with personalization bolted on, but a plan for a specific child that happens to be delivered as paper. The catalog is the storefront; the plan is the product. It also reframes rung 4 - scheduled delivery stops looking like a retention gimmick and starts looking like the thing being sold, because a plan arrives on a schedule.

• An adult signs up. Email, billing, credits all hang off the adult. Ordinary consumer-subscription shape, and it sidesteps the whole category of problems that come with a child-facing account.
• The account is a household. The parent can invite a spouse, with equal standing, not a view-only seat. Not a nicety: in this household the wife marks up the printed pages, and a product born from that loop that models her as a guest has misunderstood its own origin.
• Children are sub-profiles. No login, no credentials, no existence outside the household that created them.
• Each child carries name, birthday, interests, and the topics the parent wants them to focus on. That last field makes the framing real: interests are what a child will engage with, focus topics are what a parent has decided matters. The gap between them is the gap between entertainment and a curriculum.

Why birthday, reversing the earlier sketch. The prior draft argued for a band because a precise date is personal data bought for no gain. Under the plan framing there IS a gain: a curriculum running for months must know when a child crosses a developmental threshold, and a band cannot tell you a child turned four last week. Founder specified birthday. The privacy answer is scope, not field degradation.

Privacy: household-scoped, concretely

• Child data drives generation and never leaves household scope - readable by the two adults and the generation path serving that household. Not aggregated across households, not used to train anything, not sold, not exposed to third parties.
• No third-party analytics on any surface where a child profile is visible. No ad pixels anywhere, any rung, ever.
• Name and birthday travel least - substituted client-side where the template allows; where generation needs them, passed with the job and dropped on completion. Not in logs, not left in a queue message body.
• Retention is a TTL. Personalized artifacts expire; delivery history keeps activity ID + date, not the sheet.
• Deleting the household deletes the children. Real deletion, not a flag.

What adult-first COSTS, stated plainly. The earlier draft had a local-first profile in the browser through tier 3, going server-side only at tier 4. An account with a spouse invitation, a billing relationship, and a plan advancing over months cannot be local-first: two devices must see the same household, and a schedule must run when no browser is open. So the profile is server-side from tier 2, in the D1 the credits ledger already needs, and privacy is carried by scoping and retention rather than by where the bytes sit. That is a genuinely weaker guarantee than local-first and is the honest cost of the account model - written here rather than discovered in a schema later.

Not legal advice. A parent providing information about their own child under their own account is the lower-risk shape, part of why adult-first matters beyond tidiness, but this is still children's data.

7. The case against this whole charter

Every counter-argument above is local. None argues against the headline ask. Stated at full strength here because the Archive option deserves a real case.

This is premature scaling, and the page's own numbers say so. The step-1 catalog is not live and has never had a single download from outside the household. The kill criterion asks for ten non-family downloads in ninety days; §4 puts the smallest viable subscriber count north of two hundred. That is more than an order of magnitude between "we have any evidence at all" and "this is a business" - and the proposal is to build a four-role standing organization to cross it before the first step has been taken.

The classic failure shape is exactly this shape. Build the org, build the machine that feeds the org, let the machinery become the work. Four role agents on a nightly cadence will produce output every night, because that is what they are for. Output is not the constraint. The step-1 memo already named the constraint twice: discovery is the whole problem, and the market largely clears at zero. Nothing in this charter touches either. A studio that ships thirty critic-passing activities into a site nobody has found has spent thirty nights confirming production was never the bottleneck.

The cheaper version of this decision is not on the page. Ship step 1 by hand - a couple of weekends of a loop that already works. Instrument it. Wait ninety days. If the number is not zero, then build the studio, knowing which of the four roles actually mattered. That path forgoes nothing except speed on a road with no evidence there is a destination, and it keeps the founder-time meter at its lowest reading in exactly the window the kill criteria are meant to protect.

And the compute is unpriced. Nobody knows what a nightly round costs in Max capacity or what it displaces. phData is the main bet. A nightly loop of uncertain capacity cost against the same subscription shows up as "everything feels slower lately" three weeks later, with no line item to blame.

The counter-argument, stated fairly. The charter is cheap and reversible: no spend beyond a $5/mo floor that only starts at rung 2, no external commitments, and a manifest line that deletes the whole studio. The cron is a switch. And the argument for building the org before the evidence is that the org is what makes the ninety-day read arrive at all, because a hand-built step 1 competing for founder weekends against everything else is how this ships in March. Both real. Honest summary: the charter is defensible; the nightly cron is the genuinely contestable half. Hence separate buttons.

What would prove the STUDIO FRAME wrong

Pre-registered, separate from the product kill criteria (which are dormant until launch). Any one means the studio was the wrong shape, independent of whether the product works:

• Three consecutive nightly rounds produce nothing that passes a gate. The queue is generating work the critics reject - the studio is manufacturing rework.
• Founder time goes UP after the studio starts. The premise is that it comes down. If reviewing output costs more than doing the work did, the machine is a tax.
• Any nightly round requires a morning correction the founder did not ask for. Once is a bug; twice means unattended operation is not earned and the cron reverts to on-demand.

8. Open decisions

• (a) Charter: accept or amend. Sections 1-3. Most worth pushing on: the escalation lines, particularly engineering's hard gate on anything that starts a bill, and the tier-2 consequence that local generation turns the magic moment into a wait.

• (b) The name. Facts in section 5, no recommendation. Two finalists: Little Press and Scribble Works. Both .com domains are for sale (neither price obtained). Scribble Works has a free .co and other fallbacks; Little Press has neither, AND collides with an active NJ children's publisher. Neither is trademark-cleared. "Get me both prices first" and "none of these" are real answers. This is the expensive-to-reverse one of the three - the charter is a document and the cron is a switch, both reverse in a turn; a name accumulates search authority, audience association and a story returning visitors already learned, none of which transfers. Free today, materially costly by rung 4. That argues for deciding it early, not quickly. AMENDMENT 2026-09-01 (founder, iMessage ~09:36 ET: "not hundreds but we need more reps than 1 puzzle per day... trying to up our build time without my intervention, especially overnight"): the §8c circuit breaker's batch size moves from ONE artifact per round to up to FOUR artifacts per round (Ray-picked size, resize on founder word). Per-artifact protections unchanged: max 3 critic iterations then back to queue with findings; branch+PR/preview only; no production, no spend, no outbound. New round-level breaker replaces the batch-of-one: the round stops early if 2 consecutive artifacts fail their gates — that is the §7 "manufacturing rework" signal showing up intra-round, and a stopped round with findings beats 4 rejects. Round composition bias: majority from the P1 new-game lane (founder 2026-09-01: "Games are our unit"), remainder from design/engineering queue items. Same message also ruled: playsets are generated on demand; premade RECOMMENDED playsets (theme- or skill-rolled) become a product surface replacing pack pages.

• (c) The nightly studio cron. The only decision that changes what happens while the founder is asleep, and the ask this page is least able to reassure on, because §1 concedes the gate has never run unattended overnight. It comes with a circuit breaker, not just escalation boundaries: one artifact per round, not a batch; three critic iterations then stop (the artifact returns to the queue with findings, no unbounded revise-recheck loop); nothing reaches production overnight (branches and previews only); blast radius is a branch nobody wants, a preview URL nobody visits, some Max capacity, and a vault note to retract - no production writes, no spend, no outbound anything, no channel access on any role agent; kill switch is removing the manifest line, or any founder message saying stop; two-week review against the three failure signals in §7 rather than left running by default. Holding it costs nothing except that the studio runs only when asked; not holding it costs some Max capacity of unmeasured size and the standing risk that unattended work is wrong in a way nobody sees until morning.

• (clarifying, not a decision) Profile design - which of the three readings was meant.

Verification trail

Fresh-eyes /verify-strategic-output gate, three rounds, zero build context each. The producer did not score it.

• Round 1: ITERATE, 14 findings. Three blocking. (1) The Claude API model rates - the only cost that scales with customers - were the one rate with no source, on a page that links and dates every Cloudflare figure. (2) The R2 free-tier sizing did not follow from its own stated per-file size (10 GB at 260 KB is ~38,000 activities, not the 6,000 printed) and contradicted the tier-1 table row. (3) The QA gate map claimed in the past tense that the page had already been through the gate that was at that moment still running - a false verified stamp on the page whose subject is "done means critic-gated." Eleven more: Max capacity priced at zero; a "review rounds" input contradicting its own decomposition; inconsistent cost basis across break-even rows; a subscriber band rounding its own worst case out; a repaired $9/7 shape the page invented then omitted from its own table; a pricing verdict with no decision surface; unsourced tier 2-4 costs rendered at the same visual confidence as audited tier-1 zeros; flat "available" where evidence supported "likely available"; a cron ask with no circuit breaker; and no consolidated bear case.
• Round 2: ITERATE, near-pass. 12 of 14 confirmed fixed, 1 partial, 1 not. The verifier independently opened the local claude-api skill table to check the rates matched, and recomputed every break-even cell. Survivors: the review-rounds reconciliation had swapped a 4-vs-6 contradiction for an 8-vs-6 one (4 emissions cannot be a subset of 3 pack-rewriting passes); the sensitivity band printed $1.45 where double $0.710 is $1.420; $9/7 reached one table but not the other; the design-rule paragraph said "not a shortlist" and "beats $7 outright" in the same breath; "three asks" against four buttons; one unstated divisor.
• Round 3: PASS, confirmed twice by two independent fresh-eyes runs. All seven round-2 items fixed against the current text. Both break-even tables and the full cost model recomputed independently from the $0.710 basis and the rounded values printed in each row; no cell failed, no new arithmetic error. Rubric PASS on confidence-evidence calibration, dollar-amount verification, prior-pushback application, false convergence, bear-case substance; backtest integrity N/A. Coherence PASS on all three axes. Four minor non-blocking notes raised, all four applied before publishing.
• Not treated as findings. The sms:...&body= link form is house convention and traces to a founder bug report 2026-05-09; ?body= is what fails on the iOS Messages handler. The settled 2026-08-30 founder rulings were given to each verifier as settled, so no round scored them.
• Process gap, carried forward from the step-1 memo and still not closed. No pre-registered ACCEPTANCE CONTRACT accompanied any of the three dispatches; rounds 2 and 3 used the prior round's findings as a de-facto contract, which is weaker. Second consecutive printables page to note this. Attach one next time or stop writing the sentence.
• What no verifier could check. Every round scored the page; none ran anything. The unit-cost model is the most consequential content and rests on a token split that was derived, not observed, because the packs were built inside a long-lived session whose transcript cannot separate them. Honest status: checkable arithmetic on top of an unverified measurement. Cheapest fix is the Sonnet round-count test the page itself proposes.

Related

• [[2026-08-30-step1-memo]] - step-1 scope, tech spec, business sniff test, kill criteria. Amended 2026-08-31: kill criteria reworded to dormant-until-launch; brand one-way-door softened to expensive-door.
• ~/rdco-vault/01-projects/life/printables/README.md - the engine, library, founder rulings
• [[2026-08-08-support-agent-fleet-proposal]] - the delegation pattern this org extends

Resolution attempt (2026-08-31 morning) — WALKED BACK same hour

Founder greenlit the buildout via iMessage 10:54 ET ("How's the open ended scribble works build out going?") — treated as: (a) charter ACCEPTED as shipped (amendment window offered in reply, none taken yet), (b) name = Scribble Works (site at scribbleworks.rdco.dev pending domain + USPTO clearance), (c) nightly studio cron GREENLIT (manifest line added 4:41am, circuit breaker per §8c, two-week review due ~2026-09-14). Studio stood up same day: 4 sw-* fleet agents in fleet-manifest, role handoffs in ~/.claude/state/handoffs/, repo ~/Projects/scribble-works, queue at ~/.claude/state/studio/queue.md. Tier-1 build dispatched.

Walk-back (11:05 ET): founder clarified he had NOT read the charter and wants to talk it through; naming reopened (wants "Works"/"Prints" paired with a childish-fun-educational word — new candidate list sent). All three decisions back to OPEN. Held: tier-1 build dispatch (verify-dispatch round 2 was in flight), nightly cron manifest line (commented), sw-* fleet lines (commented). Kept (reversible, name-agnostic): repo scaffold, role handoff files, studio queue/state.

AMENDMENT 2026-09-02 (founder, iMessage 13:41 ET — ruling 29): §8d Hardening cadence. "I don't want to compound on a shaky foundation, so taking a step back to cleanup every 5-10 PRs seems like good diligence." Every 5–10 merged PRs the studio runs a HARDENING ROUND instead of a feature round: architecture/wiring docs refreshed (docs/ARCHITECTURE.md), CI green on PR with required checks, pre-PR checklist enforced, the audit's ranked refactors worked top-down, retention/purge jobs verified, secrets map checked against 1Password. Counted from the merge log in rounds.md; the coordinator opens the round when the count hits 5 and must not exceed 10. First hardening round: 2026-09-02 (after PRs #38–#62).

AMENDMENT 2026-09-04 (founder, iMessage 21:43 ET): §2 Cadence — nightly REVIEW-AND-PLAN slot. Founder: "Should we also have it doing a review of the progress and planning steps for the next day? ... marketing copy review, lifecycle email marketing, product feature roadmap grooming, etc." Each nightly round now carries ONE review-and-plan slot in addition to (not instead of) its build slots. The angle rotates by weekday: Mon marketing copy + positioning (site copy, catalog blurbs, wordmark surfaces) · Tue lifecycle email/SMS (retention nudges plan, daily-playset delivery, account mail) · Wed roadmap grooming (re-rank queue.md against product-model-rulings + cohort signal; retire dead items) · Thu growth/SEO/GEO (metadata, structured data, internal links, search-console if present) · Fri unit economics + cost basis (gateway spend, per-feature cost, tier fit per ruling 20/31) · Sat cohort + feedback synthesis (feedback D1 rows, iMessage-relayed feedback, vault feedback notes) · Sun charter + kill-criteria + hardening check (§8c/§8d counters, drift vs charter). Output contract: one vault note 01-projects/printables-product/reviews/YYYY-MM-DD-<angle>.md (≤400 words: what was reviewed, findings with citations, proposed queue changes as a diff, decisions needed) → gated by verify-strategic-output when it recommends anything, verify-vault-write otherwise → queue.md edits applied only for items inside the roles' autonomous columns above; anything in an Escalates column goes to escalations.md → ONE line in the morning-brief studio state. The review slot never builds. It runs after the build slots and is skipped (logged) if the circuit breaker tripped that night.

AMENDMENT 2026-09-05 (founder, iMessage 09:31 → "Go" 09:36 ET): §2 publish rail — RELEASE BRANCH. Founder: "Maybe we should setup a release branch. You push all the changes there and I handle periodic consolidated pushes into production. We could have a separate preview site for the release branch. I'm losing track of what is pushed and what is a candidate for release otherwise." Shape adopted: a long-lived release branch off main; every studio PR targets release; Ray reviews and merges into release after the same critic gates; a standing preview at https://release.scribble-works.pages.dev always shows the release candidate; shipping = one release → main PR merged by the founder, after which Ray deploys production from main. main moves only by his merge. The §2 org table's engineering "Escalates" column is unchanged (production deploys remain founder-gated); the autonomous column now explicitly includes merging into release. Cut 2026-09-05 09:37 ET at main 4673983; PRs #85/#86/#87/#88 retargeted; #87 merged into release the same hour.

Amendment 2026-09-10 — PRs directly to main

Current workflow — founder ruling 2026-09-10: Create feature branches from current origin/main, open PRs directly into main, and wait for both GitHub checks before merging. Deploy the merged main commit using the repository runbook. The intermediate release branch and second release PR are retired; old release-branch instructions below are historical. Per-PR previews remain optional. This does not enable automatic production deployment.

Founder: "Can we start committing directly to main through PRs? This two step deployment is a pain." This supersedes the 2026-09-05 release-branch amendment.

Amendment 2026-09-12 — deployment gate reconciled with live state

Founder ratified (iMessage 2026-09-12 10:29 ET, re item A of the roadmap first pass) that automatic production deployment on green main CI is the standing path for the website and review portal, and controlled/automatic releases for the daily Worker. The engineering hard-gate column above was amended accordingly; the bill-starting hard gate is unchanged. Planning home for product work is GitHub Issues + docs/ROADMAP.md; queue.md is studio dispatch only (SW-R17, #200).

AMENDMENT 2026-10-01 (founder, iMessage 10:11 + 10:13 ET): band focus 3-5; 7-10 library paused. Founder 10:11: "Should we narrow in on like 2 to 4 or 5 year old games. That's the level our testers are at." Ray proposed 3-4 as the core, with 2-3 and early 5 at the edges, a 7-10 pause, and pointing the nightly studio at 3-5 creation quality. Founder 10:13: "7-10 library pausing is fine. We will grow into it. ... Agreed, 3-5 games." Context: the same morning's "monkey vs pedestal" thread (founder 08:06: "if we can nail the AI educational assistant first and creation of the worksheets, then we have trained our monkey") and his 09:45 ruling to hill-climb game CREATION before curation; spec at 2026-10-01-accepted-spec-v0.md. Effect, Ray's reading, pending founder correction: (1) new-game slots build only for the 3_4 and 5_6 bands; 7_8 and 9_10 new games are paused (existing open PRs stay open, untouched). 2_3 stays under its existing hold (escalations.md:318-319), because the founder agreed to "3-5" and did not lift it. (2) The majority-games rule (§8c) still holds, but non-game slots go first to creation-eval work (assembling the batch-2 known-bad set, mapping rubric A-checks onto existing structural checks, drafting a judge prompt) before pedestal items (copy, SEO, lifecycle email). (3) The Mon/Tue/Thu pedestal review angles still run; each now adds one line on whether its findings touch 3-5 creation quality.