# Claims review — 0.2.31

- base: v0.2.30
- head: 6435b56
- surface: sha256:a07a8a6e91f86dc4c34a343a4d76cb9213ccb509b9b4db578e6abf5890e97291
- verdict: pass
- reviewer: Claude, reading on the maintainer's instruction — an assistant read, not an independent human one

Four claim surfaces changed across the three merges in this release: `README.md`,
`LIMITATIONS.md`, `LIMITATIONS.tr.md` and `docs/BENCHMARK.md`. A fifth,
`docs/PRICING.md`, arrived unlisted and was added to the surface list during this
review; the finding below came out of reading it.

The performance numbers were checked against their own artefacts rather than
against the previous text. `docs/BENCHMARK.md` names the environment it measured
in (win32 10.0.26200, Node v24.5.0, Postgres 16.15) where the previous revision
named a different one (WSL2, Node v18.19.1, Postgres 16.14), and it carries both
raw JSON files — before at `09b2100`, after at `46acd75` — from the same machine,
so the improvement it reports is attributed to the code change rather than to the
platform change that happened alongside it. The archived Linux run is kept and
labelled "do not quote next to these cells". `LIMITATIONS.md` and its Turkish
counterpart carry the new figures with the new environment named in the same
sentence. Raising the warning threshold from 100 to 500 is a behaviour change and
`test/threshold_source.mjs` now reads it from
`docs/benchmarks/masking-cost-threshold.json` instead of a second hand-written
copy, so the document and the doctor cannot drift apart. Nothing there says more
than the runs establish.

## Findings

### 1. README.md:331 and docs/PRICING.md:10,14,35 — the package sold something that cannot be bought

- Claim: "VAT added where applicable. Buy at [conarium.dev/buy](https://conarium.dev/buy)."
  (`README.md`), the Button column entry "Get started → `/buy?plan=pro&period=monthly|yearly`"
  under the heading "Pricing (same words as the site)", the section title "Pro (sold)",
  and "The waitlist form (`#cta`) ... is not Pro checkout ... Pro never uses it."
  (`docs/PRICING.md`)
- Mechanism: the `/buy` route on conarium.dev, the Pro card buttons, and the
  `CONARIUM_CHECKOUT_LIVE` gate that fronts `/api/checkout/init`
- Why it falls short: measured on the live site while writing this record — `/buy`,
  `/buy?plan=pro&period=monthly` and `/buy?plan=pro&period=yearly` each answer `302`
  to `https://conarium.dev/#cta`; both Pro buttons carry `href="#cta"`; and
  `/api/checkout/live` returns `{"live":false}`. Every purchase path leads to the
  waitlist form, which is the one destination `PRICING.md` states Pro never uses.
  A reader who installs the package and follows the instruction reaches a mailing
  list signup. "Same words as the site" is also not met: the site's button target
  is `#cta`, the file's is `/buy?plan=pro`.
- Disposition: reworded in `6435b56`. The price stands as published terms; the
  purchase instruction is replaced by what `/buy` does today, and each edit names
  the condition that reverses it, so opening the payment path is an edit to a
  stated clause rather than a search through prose.

### 2. test/denetci.mjs — a promise surface with no assigned reader

- Claim: not a sentence — the absence of one. `docs/PRICING.md` states a price, a
  refund window, a fair-use limit and what each tier delivers, and it ships in the
  tarball under the `docs` entry of `package.json` `files`.
- Mechanism: the `SURFACES` list in `test/denetci.mjs`, which decides what a
  release reviewer is shown
- Why it falls short: the file was not on that list, so its claims would have
  reached npm unread. The gate itself reported this — `denetci.mjs input` printed
  "unlisted: docs/PRICING.md — changed here, not read as a claim surface" — which
  is the drift guard on the hand-written list working as intended, and the first
  reading of the file produced finding 1.
- Disposition: accepted; listed in `6435b56` with the reason recorded at the entry.

Both findings are the same failure the earlier records describe: a guard locks
phrasings already caught and cannot see a new one. `claim_discipline.mjs` passes
on this tree (11 surfaces, 13 previously-published overclaims, no drift) and was
passing on the text that told the reader to buy.

A note repeated from 0.2.29 and 0.2.30, because it applies here too: the gate this
file satisfies calls itself "the one check a human has to answer". A human did not
read these diffs; an assistant did, at the maintainer's instruction. The gate
verifies that a record exists and that the claim surfaces have not moved since it
was written. It does not verify who wrote it.