docs(charter): marketplace becomes a launch-day component of Phase 3 (HT-79) - #86

…sics (#91)

PR #83 landed already-stale: main moved by nine PRs while it was in review,
and it shipped one claim that contradicts the charter.

- HT-71 operator guide was listed as an open PR under Next. #81 merged at
  17:48, ~2h before #83 merged at 19:39, and docs/modules/ has been on main
  since. Moved to Done with its precision follow-up (#84).
- Marketplace was listed under 'Not yet / deferred'. CHARTER §3/§4/§5 were
  amended the same day (HT-79, #86) to make it a launch-day component of
  Phase 3 — built now, proven as the dogfood install path. Removed from
  deferred; marketplace v1 spec (#87, draft) now leads Next.
- Added inbox basics (HT-76/77/78, #90, migrations 24-25): saved replies &
  macros, snooze, send & close — shipped engine features with no STATUS line.
- Added catalog reclassification (HT-75, #82): KB and end-user portal are
  paid, 71-module gap audit closed, open-core line restated. Passkeys stay
  core, reconciled in #85.
- Added passkey login spec (HT-75, specs/auth/passkeys.md, draft.3) to Next.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

…harter (HT-79) (#92)

The HT-79 charter amendment merged as PR #86 (b528971), discharging the
spec's sequencing note, which asked for a citation re-check against the
merged text before acceptance.

All CHARTER.md citations re-verified against merged §3/§4/§5: the
launch-day Phase 3 claim, the marks-and-marketplace asset list, the
amendment's verbatim counsel-items sentence, and the Phase 3 launch
lineup all check out as written.

One mis-citation corrected: the plugin exception's counsel deadline was
attributed to "CHARTER.md §7," but CHARTER.md §7 is Governance — the
deadline is set in §3's module boundary, where "§7" names the AGPL-3.0
§7 additional permission. Its parenthetical pointing at "this spec's §3"
was dangling for the same reason. Replaced with a direct quote of the
merged amendment.

Docs-only; no substantive change. Status stays "draft for TJ review".

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

…e install path (HT-79) (#98)

* docs(modules): managed hosting becomes the mainline install path (HT-79)

TJ walked the v1 manual self-host install as customer #1 (HT-82 dogfood)
and rejected its friction: the designed loop is browse → buy → install →
enable, not five hand-assembled seams. This revises marketplace-v1 to v1.1
with managed hosting as the default, the tarball flow demoted to a
preserved self-host escape hatch.

- specs/modules/marketplace-v1.md → v1.1: new hosting control plane (§3d,
  the sole trust domain holding both a license key and a per-desk
  provisioning grant, entirely outside the AGPL core); the buy → install →
  enable managed handoff via a one-time claim token redeemed by the control
  plane, never the desk (§3e); rewritten §5 (managed install/update/
  uninstall mainline + self-host escape hatch §5.4); one-click in-place
  update for hosted instances, resolving the admin-ia "in-place update"
  conflict; hosted-instance lifecycle (lapsed/frozen keep running, refunded
  decommissions after a config-export grace, revoked immediately); §6/§7/§8/
  §9/§10 updated. Entities, commerce/download/update-check APIs, and the
  artifact pipeline are unchanged.
- CHARTER.md: amended by direct edit (§4 + §7 appendix, the PR #86
  mechanism) — restates the credential/no-runtime-check/lapse invariants for
  managed hosting; leaves the §2 data-residency reconciliation to TJ.
- specs/modules/catalog.md: §5 reconciling note (hosting machinery lives
  outside the core, so "no special machinery in the product" still holds).
- SPEC-CHANGES.md: chosen-defaults and OPEN-needs-TJ lists for the lead.

Invariants held verbatim: license = distribution credential only, zero
runtime license checks in any module, lapse never stops running software
(even when RIQ is the host), AGPL core never holds a marketplace credential
and never calls the marketplace. Self-host escape hatch preserved and not
weakened.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* docs(modules): collect module runtime config browser-direct to the control plane (lead review fix)

Lead-tier review finding on the managed-hosting revision: §5.1 promised
'no hand-entered env vars' but never said where operator-supplied module
settings — most prominently the operator's own model API key, which
charter §2 requires — come from in the managed flow. Added §3e 'Module
runtime configuration': an install-time in-app form submitted
browser-direct to the control plane (same never-transits-the-core rule
as the claim token), stored in the control-plane vault, re-injected on
update rolls; §5.1 reworded honestly; §10.13 extended — operator secrets
in the vault are the credential face of the same data-residency call.

Also drops SPEC-CHANGES.md from the branch: it is adjudication material
for the PR description, not a permanent repo artifact.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>