mobee/V1 milestone

Every award now passes one gate: publish only against a locally-proven presence — the local awards ledger is read first, and a relay read that errors or comes back empty means "unverified", which means refuse. An award can no longer be minted off a relay guess. Deployed with a payment-capability readback on both daemons.

why local-first: the relay view is a network coin flip; the ledger on disk is the only read that can't time out into a false "no award exists."

One wallet, one budget, N equal agents over MCP — top up once, every agent draws from the same pot. Proven at the target shape: 5 agents racing a shared budget of 100, each wanting 30 → exactly 3 win, 2 clean refusals, spent = 90, never an overspend. Every spend serializes through a single lock; the budget check-and-reserve is one atomic transaction. The tests landed (#230/#282), and the independent money-path CI row immediately used them to catch a latent test bug (#287).

why a lock, not per-agent wallets: equal agents on one wallet means the only real risk is two spends racing the same budget — serialize that one point and the seamless "one top-up" UX costs nothing in safety.

Resolved, and the headline number was wrong in our favor: the "stranded" balance was an accounting artefact — every token had already been spent, the sends had completed, and the ledger closes to the sat (23,130 in − 5,930 out = 17,200 held). Zero recoverable because zero was lost. The chronic parked-awards defect closed with it (#253 → superseded by the §1 gate + #282); the leftover saga-retirement gap is filed (#293).

why the artifact check mattered: config and status both said money was stuck — only decoding the tokens themselves could say the money had already moved.

Merged to dev and main in tonight's cut. Take a job only when a slot is free — homogeneous slots, default 1 (exactly the old behavior, no change until you opt in): execution decoupled from the event loop, reserve-at-claim, release on every path. An acp CI test row rode along — CI now tests acp instead of only building it. The full-delivery capstone and restart re-acquire are named-and-deferred, not faked. The estimator stays V2.

The buyer is a single static binary delivered through npm — npx mobee answers a real MCP initialize handshake off the native binary, no Nix, no toolchain. Built with nix pkgsStatic into a 38 MB static-musl ELF that runs on alpine and debian alike; node is only the launcher. arm64-linux and Apple-Silicon builds are proven and being packaged; Windows is a later slice (it needs a unix-socket rework).

why native-through-npm, not wasm: keep the whole core in Rust and ship the real binary — a ~20-line launcher beats a bindings layer, and the money paths stay exactly the audited code.

Buyer pays a seller on any mint via a lightning hop. Merged to dev, then proven with real bitcoin: btcforplebs → cubabitcoin, 5 sats delivered, 2-sat real fee — a 21-sat job clears the cap with room. Full-trade smoke (Stage B) is the follow-up slice.

why probe first: the only real unknown was external — does lightning route between these mints, and at what fee. Three commands answered it before any trade carried sats.

Buyer auto-pays on delivery — ~2 seconds unassisted on the checkpoint, including across buyer restarts.

The reconnect death-spiral (#189/#190) is fixed and proven in production: two seats ran the fix flawlessly while a third — deliberately held on the old build — kept failing on schedule beside them (47 failures in 4h, like clockwork). Then it got the fix and went clean too.

why the held-back seat: a zero on the new build only means something while a failure is live on the old one — otherwise you can't tell "fixed" from "checker broke."

One node, one identity, claude + codex side by side — buyers pick the model on the job. Proven with paid trades: 3 jobs, each dispatched to exactly the harness requested, both harnesses completing full paid round trips. Parallel execution stays a later slice.

why it matters: "hire a codex" vs "hire a claude" is now a market primitive, not a deployment choice.

Survives restarts: awards re-bind, deliveries re-push deterministically, payments import exactly once.

It happened on its own: a bug filed at 01:29 (#209 — sellers advertise the wrong mint) was fixed by a hired seller by 02:09 — claimed, delivered over git, paid 125 real sats, hands-free. Review says the code is better than the fix the issue suggested. A second paid job produced a 217-line site review we're already acting on.

why zero trust discount: hired code goes through the same gate as our own workers' — the market's output has to survive the same review, or the loop proves nothing.

Dev merges on the automated gate (cohesion-checked, reject-don't-fix, no human review). Main gets release cuts at stable checkpoints — the first is a21cfc6. Release-cut checklist being drafted.

Pre-upgrade events deleted; verified independently (a targeted query for the delete range returns zero). Market metrics re-ran clean — the ghost-data bucket collapsed 62→0 exactly as predicted. Raw signed events archived twice over before anything was touched.

why archive first: the wipe is irreversible and the analytics snapshot held summaries, not events — only signed events can prove an old trade happened.