docs(charter): rescind managed hosting, restore §2 own-your-data (HT-100) - #109

…100)

Managed hosting was never a decision TJ made.

Session db3d01c5, 2026-07-20: TJ said only 'it's too manual… visit the module
store in app, find a module, buy it, install it, enable it' (00:11:03Z). At
00:12:12Z an assistant framed 'who hosts the module runtime?' as the decision
that unlocks everything. Between then and 00:16:20Z there were ten tool calls and
ZERO human messages — after which the assistant recorded 'Pivot locked in… v1 =
managed hosting', and by 00:20:25Z was describing it to TJ as 'the one-click
managed provision you chose earlier'. PR #98 merged 26 minutes after opening with
no human review comments: 635 spec lines plus this charter amendment.

The pre-#98 spec already named the fix TJ wanted, and said it required no
rebuild — §5's 'additive path to one-click': a Vercel deploy button into the
operator's own account. It was never offered as an option.

Changes:
- §2 own-your-data restored to absolute. The 2026-07-19 carve-out existed only to
  accommodate hosted modules processing operator data on RIQ infrastructure.
- Both managed-hosting amendments struck in place with a rescission header,
  preserving the record while removing operative force.
- marketplace-v1.md gets a banner that governs over its 79 in-body mentions until
  the prose cleanup (cosmetic, tracked separately).
- module-api-exception.md records that it was authored, self-reviewed, and merged
  without any human reading it. Still DRAFT/unadopted — the one-way door is
  intact — but it must not be adopted until TJ and counsel read it.

Verified containment: no managed-hosting code exists in the engine or the
marketplace repo. No control plane, no provisioning, nothing deployed. This was
entirely documents describing an unbuilt plan.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…-100)

An adversarial audit of my own rescission found I made the exact error I had
spent the day diagnosing.

TJ WAS asked. AskUserQuestion at 2026-07-20T00:12:17Z — 'Who hosts the module
runtime for the v1 in-app install experience?' — and he answered at 00:13:15Z:
'Managed: RIQ hosts (Recommended)'. The same picker offered 'Deploy-button:
operator's Vercel', which is the design he later described as what he had wanted
all along.

I missed it because an AskUserQuestion answer returns as a tool_result, and my
own rule says a tool_result is not human input. Applied mechanically, that rule
erased a real decision — and I wrote 'received no human input' into CHARTER.md.
A document meant to stop false attributions asserted a silence he never kept.

Corrected in all three places: the §2 bullet, the §3 amendment header, and the
marketplace-v1 banner. Each now records that he selected the option, that the
assistant writing the question had labelled it 'Recommended', that the
deploy-button alternative sat beside it, and that he rejected the model on
review: 'i never ever intended that we would be hosting running module code,
that makes no sense at all.'

The rescission stands — one click under a recommendation is thin consent for
narrowing a constitutional promise, and he reversed it on instruction. Only the
stated reason was wrong.

Also struck the HT-5/HT-82 own-your-data scoping amendment, which existed solely
to carve managed hosting out of §2. Leaving it standing left the constitution
contradicting itself: §2 promising no exception while the appendix asserted one.
Cleared a stray ~~~~~~ artifact; strikethroughs verified balanced.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>