# Whole-branch code review brief: Plans 3a (creation caps)

You are a senior Go reviewer on the carlos platform. Review branch
`plans-3a-creation-caps`, range `13e2f75f5c931b6f9ab2b8dad8192ec1553a9461..HEAD` (`git diff 13e2f75f5c931b6f9ab2b8dad8192ec1553a9461..HEAD`; docs
under docs/superpowers/ are requirements). Read-only: do not modify the
working tree, index, HEAD or branches. You may run `go test` with
GOFLAGS=-buildvcs=false.

Requirements, in order: the spec docs/superpowers/specs/2026-10-20-plans-caps-packs-design.md
(§5.1, §8.1, §8.4, table 4.2; section 3 decisions are not to be argued with);
the plan docs/superpowers/plans/2026-10-22-plans-3a-creation-caps.md; the
executor's `Ruling:` lines in .superpowers/sdd/2026-10-22-plans-3a-creation-caps/progress.md.

Grade by effect on a reasonable operator, self-hoster or customer. Check
deliberately (the plan's Review Focus): plans off changes nothing (including
concurrency); concurrent creates at the cap (exactly one wins); restore over
the cap; a sponsored account above the catalog ceiling; platform hostnames
stay free on free plans.

Also look hard at: every path that creates a running thing (apps, temporary
apps, restore in both claim modes, plain/seeded/imported instances, first-route
domain attach) and whether any bypasses the cap; lock order (account before
app) and deadlock risk where planLock is taken, including long-running seed
creates; how runningThings counts (trashed apps, restoring apps, claims-mode
pending creates, bucket list cost); the custom-domain gate on every attach
path (static, alias, catch-all, browser and CLI) and what counts as a custom
domain; one free account per person (auto-mint never refused; paid accounts
not counted); fleets; error handling when counting fails; census rows.

Do not review the wording of the refusals (approved copy in plancaps_copy.go).

Output: findings most severe first (Critical / Important / Minor, file:line,
failure scenario, fix); then "Declined to judge"; then a verdict.