step.29.diff.txt -- narrative retro for step.29 (U5.7: THE
                    MULTI-HOME DISCIPLINE + the A3 account).
                    Companion: step.29.gdiff.txt via
                    ../scripts/step_gdiff.

Executed: 2026-07-24, (p1.1.4) -- the fourth leg of the user's
(p1.1) arc. Commits: SKELETON 66f8d6b, WORK 4e92036, Phase A
b8c3797, CLOSE cabe538, ledger 2719fc6. b3u-side plan execution:
f740edb (no new b3u step -- the lifecycle plan is UB.5's LIVE doc).

## Plan vs actual

+---+--------------------------------------+--------------------------------------+
| # | Planned (brief)                      | Actual                               |
+---+--------------------------------------+--------------------------------------+
| 1 | ~/.b3ubot.1/.2 multi-home via        | Delivered as the PROFILE WRAPPER:    |
|   | $B3UBOT_HOME + per-account env       | creds live INSIDE the home           |
|   | profiles (the user's own naming      | (profile.env, 0600), wrapper takes   |
|   | from the (p1.1) plan)                | digits only -- mis-pairing has NO    |
|   |                                      | invocation surface, which turned     |
|   |                                      | TC-16 from "assert the hope" into    |
|   |                                      | "assert the wrapper".                |
| 2 | actor@example.com signup with the    | Real end-to-end: signup + gmail      |
|   | same 4242 card                       | verify + checkout run THROUGH the    |
|   |                                      | wrapper's own env; Stripe Link       |
|   |                                      | intervened (000000 test code) --     |
|   |                                      | and then HID the card fingerprint,   |
|   |                                      | demoting the same-card assert to     |
|   |                                      | operator-witnessed + A2 raw-card     |
|   |                                      | control (plan F-6).                  |
| 3 | TC-14..16 pre-named at UB.5          | All four flips (incl. TC-3) landed   |
|   |                                      | same-day with dated log entries --   |
|   |                                      | the pre-naming discipline paid: the  |
|   |                                      | step executed a plan that already    |
|   |                                      | knew its acceptance shape.           |
+---+--------------------------------------+--------------------------------------+

## Surprises / genuine findings

1. **The suite guards even the step files**: the corpus round-trip
   test refused this step's OWN skeleton (INTERNAL banner wrapped
   off the ledger emitter's canonical form) -- the ledger engine's
   byte-stability oracle now acts as a lint on incoming step files.
   Found at BUILD, fixed by re-wrapping one line.
2. **GNU env argument order**: `env NAME=VALUE -u OTHER cmd` execs
   "-u" as the command -- the -u flags must precede assignments.
   Caught by the gates before any real run.
3. **Q-28-E, third edition**: the chat paste channel injected a
   newline INSIDE a curl -H header string -- the wall answered
   non-JSON and the one-liner collapsed. The fix (a one-shot script
   file, ~/a3_checkout.sh, deleted after) is now the DEFAULT
   ceremony vehicle, not the fallback. Corollary finding: the
   helper's f-string \" escapes ran fine on the venv's 3.12 but
   broke the SYSTEM python3 -- ceremony helpers must target the
   oldest interpreter on the box ("%s" formatting, no f-string
   quoting tricks).
4. **Stripe census nuances, all three new**: (a) clock-backed
   customers are EXCLUDED from default Customer.list -- A2 is
   visible only via its test clock, so any future census must
   query per-clock; (b) newer API has no invoice.charge --
   Charge.list(customer=..) is the road to payment evidence;
   (c) Link-funded charges expose neither last4 nor fingerprint.
5. **An orphan test clock survived step.54's recorded deletion**
   (0-customer lifecycle-plan twin) -- the deletion evidently hit
   the wrong clock. Found by the census, deleted for real this
   time. Lesson: cleanup claims deserve a list-after check.

## Scope discipline

In: the wrapper + tests + gates, the ceremony, the census, the plan
flips, docs/ledger. Out and named: a checkout/subscribe helper as
product (that is UB.7's button); the census as a b3u script
(promotion candidate `account_census.sh`, named in Q-29-C, deferred
to the UB.6-era); TC-8/TC-5/TC-7/TC-11 wall-clock cases (stand
planned by design -- A3's soak checkpoint is ~2026-08-24). Zero
engine-code changes (C-29-C held: scripts + tests + docs only).

## Numbers

- Suite 644+28=672 -> 660+28=688 (+12 wrapper tests, +4 corpus
  pickups: b3u step.54 + own step.29); 40 test files, 501
  functions; measured after the last edit.
- Phase A 9/9 first run; ceremony legs 3/3; census 3 accounts /
  3 clients / 2+1 Stripe customers (clock-hidden A2), subs
  active/canceled/active exactly as the plan's log predicts.
- The plane now carries the full actor set: A1 alex (wall-clock),
  A2 clockco (synthetic, expired), A3 uafco (soak, active,
  period_end 2026-08-24).
- The (p1.1) arc: (p1.1.1) UB.4 / (p1.1.2) U5.6 / (p1.1.3) UB.5 /
  (p1.1.4) U5.7 -- four legs, two days. NEXT: (p1.1.5)
  downloadable b3ubot, then (p2) the xml project.

End of retro.