A pilot checklist, with nothing ticked.

What this page is

The unapproved plan says to finish the fictional local slice, price every required service, run the recovery and delivery spikes, then watch one authorized real source in private. This page turns those gates into a checklist a Broadwater pilot would have to pass. It does not decide that Broadwater is that source, and it does not name a shop.

The same gates are described on the implementation roadmap. The outage items below follow the recovery walkthrough.

Before any recurring fee

• M0 skeleton exists: ports, schemas, and a ledger. Status in the plan: not built.
• M1 runs the fictional Pantry & Pour feed, cap_pp_feed_1011, on local PostgreSQL with files stored by checksum and a fake model.
• No hosted account is created from this package. Local work is the proposal until Gate 2.

Gates the implementation chapter already names

• Gate 2: every required recurring service is priced, and the total fits the confirmed USD 50 ceiling. DJ-01 and DJ-07 are decided, not merely recommended.
• SPK-01, SPK-02, and SPK-05 have been run on the chosen runtime. The workbench simulations do not count.
• DJ-06 names one authorized real source. Permission and stable identifiers are recorded. The fictional fixture is not substituted for that source.
• M3 watches that source in private. There is no public release.
• M4 publishes only inside a publication policy Jonathan has approved. DJ-10 is still open, so this box cannot be earned yet.
• The three-delivery proposal and the five-attempt dead-letter proposal are reconciled, or explicitly left unresolved in the operating note. This guide does not pick one.

Milestone language is in Implementation roadmap. The open decision list is on that same chapter.

Outage walkthrough, as acceptance items

These items restate the recovery proposal. They are not evidence that a restore has been rehearsed. SPK-05 has not been run. DJ-04 has not set a loss or outage target.

• Jonathan has written the maximum tolerable loss of accepted data and the maximum service outage for the resolver and the evidence store.
• A snapshot is accepted only when its rows and cursor W describe the same history.
• The shadow projection catches up on its own cursor and lease. It does not move the live retention cursor.
• Cutover swaps the live pointer before the lease drops.
• Events from an older history epoch are ignored. They are not relabeled as current.
• SPK-05 has measured pruning during rebuild, gaps, restore fencing, and peak retention. The workbench recovery screen remains a simulation until then.

Read the mechanism beside Operations and improvement. Product projections can be rebuilt. Lost source evidence and decisions cannot be assumed recoverable.

Identity and storage stay open underneath

A pilot that bills needs a chosen topology and a chosen identity provider. Both are still proposals. Managed PostgreSQL, separate instances, D1, and self-hosted PostgreSQL are recorded alternatives, not a selection. Operator OIDC and collector client-credentials are the recorded shape. Managed OIDC and a small self-hosted token service are the open choice. The custom HMAC proposal is retired. Workbench cryptography is simulated.

The gathered alternatives are in the decision register annotation.