The first minute, instrumented, and the way back.

Days are engineering days for one engineer with an agent, verification included. Every item has a done-when an agent can check.

The review gate: a phone check of every deploy, and the three dashboard moves (4 h)

Why. Nothing goes live unreviewed on a phone. Confirm email is a project setting only the founder can flip and it costs a step in Create account; the reserved-handle list is the founder's to write; internal-actor marking has no UI until /stats ships, and a tour that votes poisons card_rank.

Done when. Each of the six planned deploys (and Deploy 7 if it happens) has a one-line phone verdict in docs/RETENTION.md within the hour of publishing (rollback is Netlify's previous deploy); on Day 1 update public.actor set is_internal = true where handle = 'rand' is run and the founder signs in as @rand on every phone and browser used for tours (same auth user, same actor) — from Day 8 the /stats button covers anonymous tour browsers; the reserved-handle list (blitz, blitzlabs, admin, rand variants, and whatever else the founder wants held) is given to the agent by Day 6; on Day 7, after 0019 is applied, Authentication -> Providers -> Email -> Confirm email is OFF (mailer_autoconfirm true) and Create account -> handle -> + is confirmed as one screen on a phone.

1. Day 1Wed 9 Sep

   Baseline before code. Agent writes tools/sql/retention-readout.sql; founder runs it in the SQL editor over Sep 1–8; the row goes into docs/RETENTION.md next to the targets. Migration 0018 (metric_snapshot) written, chain x3 with tools/pg-verify.sh. Item 0 (the mirror rule, the platform translators, the itch card converted) written and its migration 0016 verified the same way; CI green; DEPLOY 1. Migrate applies 0016 and 0018; founder inserts the baseline row from the script's last block. Founder marks @rand internal and signs in as @rand on every tour phone/browser; phone check within the hour: Deepstate silent over chess, back reloads it. Agent starts the idle policy.

2. Day 2Thu 10 Sep

   Idle policy: external cards no timer, no Paused badge for external hosts, GameMeta.source, media 'alive' keepalive, idle-policy.spec.ts green -> main. DEPLOY 2. Phone check: Deepstate untouched for 60 s shows no modal and its session does not end. Agent starts 0019's SQL (ui_event, log_ui, the three columns, ingest_batch from 0005's body, card_session, retention_daily, the stats_daily exclusions).

3. Day 3Fri 11 Sep

   09:00 GATE: select count(*) ... c.source='external' and exit_condition='IDLE_TIMEOUT' and first_ts > <Deploy 2 ts> = 0, or nothing else ships until it is. Back chevron + back-chevron.spec.ts, .nav-arrows deleted -> main. DEPLOY 3. Phone check: chevron and BLITZ do not overlap; index 1 -> 0; end card -> last card. Agent continues 0019 SQL.

4. Day 4Sat 12 Sep

   No deploy. Agent only, as a draft to be verified Monday: 0019 SQL finished, chain x3 with pg-verify.sh, the SQL checks scripted (anon log_ui inserts with the server's actor; payload ua_class ignored; invalid via null; card_rank unchanged). Founder (2 h): hunt candidates on OpenProcessing /sketch/<id>/embed and the p5 editor full-view; open each on the phone; shortlist six.

5. Day 5Sun 13 Sep

   No engineering. Founder (3 h), signed in as @rand: link three cards through the + sheet, phone-review each against the three questions, one-line verdict per card in docs/RETENTION.md, a 375x667 screenshot of each for the thumbnail. Nothing that refuses framing is mirrored.

6. Day 6Mon 14 Sep

   Founder verifies Saturday's SQL checks (20 min) and hands over the reserved-handle list. Agent: 0019's client side — captureEntry ?via=, transport stamps (entry_source, boot_ms on ordinal 1), src/api/ui.ts logUi, like/unlike/share/back/end/loop/link_open call sites, 'Play this.', admin panel link, tests/unit/share.test.ts, ui-events.spec.ts. No deploy unless everything is green by evening.

7. Day 7Tue 15 Sep

   DEPLOY 4: 0019 + client. Migrate applies; card_rank assertion (deepstate 0, chess 1); production tour via /feed?via=pilot&r=<uid> confirms entry_source, ua_class='browser', boot_ms on ordinal 1, a ui_event per tap; retention_daily(14) returns every column. Thumbnails committed and thumbnail_url updated for the linked cards. Founder: Confirm email OFF; phone check that Create account -> handle -> + is one screen; 2 h: two or three more cards plus the first HTML page through the Upload tab. Agent starts /stats.

8. Day 8Wed 16 Sep

   The longest day: /stats (item 5) and the end card's webview line + Share Blitz (item 6) -> main. DEPLOY 5. Phone check: /stats opens for @rand with the baseline beside live numbers, telemetryLog empty on it; Share Blitz works. Then the pilot-build gate: a headless tour of the live site, tools/column-check.sql returns zero missing; DEPLOY 6 only if anything changed (else Deploy 5 is the pilot build). Founder: the cold walk in a fresh profile; deck >= 6 live; pilot message and list finished. If the end card slips it ships on Day 10 before wave 2 — never on a pilot-send day.

9. Day 9Thu 17 Sep

   PILOT WAVE 1: ~50 links, /feed?via=pilot&r=<uid>. No deploy. Agent on standby watching ingest_batch accepted/rejected and retention_daily rows; the daily visitor-linked-card check starts (five minutes, every day through Day 14).

10. Day 10Fri 18 Sep

    FIRST READ: the wave-1 row (position-0 hold, reached-end, back taps per visit, share taps, external idle share, webview share, boot_ms p50, ua_class mix, n) written into docs/RETENTION.md before any fix. Fix day, P0 only -> DEPLOY 7 if needed, phone-checked within the hour; the landing (item 7, a static page that does not touch the cohort's build) ships in the same deploy if there is no P0. Wave-2 gate evaluated in the evening: external IDLE_TIMEOUT since Deploy 2 = 0, boot_ms landing, column-check clean, no open P0.

11. Day 11Sat 19 Sep

    PILOT WAVE 2: ~50 links, only if the gate passed; otherwise the sprint fails its n honestly rather than sending people into a known fault. FREEZE after the last link: no product change ships after today (a rollback excepted), so the D1 window is one build.

12. Day 12Sun 20 Sep

    Nothing ships. Founder answers pilot replies (0.5 h) and drafts the DM template + concierge.csv shape with the agent (0.5 h). D1 accrues.

13. Day 13Mon 21 Sep

    Nothing ships to the feed; docs-only commits (CONTENT.md numbers table, RANKING.md stamps, DESIGN-NOTES section 5, EMBEDDING-A-SITE.md's fair-game and takedown lines) are allowed because the client bundle is byte-identical. The Day-14 block of retention-readout.sql is rehearsed against real rows with the interval formula; anything not fixed is listed as carried to sprint 2.

14. Day 14Tue 22 Sep

    READOUT, no deploy: /stats -> retention_daily(14,'pilot') and (14,null) beside the baseline column, for arrivals through Day 12; the row is written into docs/RETENTION.md with n and the binomial interval; the kill criteria answered one by one and the next fortnight named; the review table's per-platform verdicts closed.

In this order, when the hours run out:

• The media viewer 'alive' keepalive on video timeupdate (inside item 2) — no clip card is live; carry it to the sprint that has one
• Linked-card phone screenshots as thumbnail_url (inside item 8) — the generic /cards/linked/thumb.svg stays for the pilot
• The landing rewrite (item 7) beyond the ten-minute ?via=landing tags — pilot links go straight to /feed, so it never touches the cohort
• The /stats page (item 5) — the retention_daily RPC stays and is read in the SQL editor; the page returns next sprint
• The end card's webview line and Share Blitz (item 6) — an hour, but ua_class is server-derived so the read does not depend on it
• The founder's deck shrinks from six-to-eight to four (Deepstate, chess, two platform embeds) and the HTML upload is skipped
• Wave 2 — only if wave 1 exposed a blocker not fixed by Day 10; the sprint then fails its >= 100 target honestly
• Never cut: Deploy 1 (item 0, the mirror rule and the baseline), the external no-timer policy and its Day-3 gate, the back chevron, migration 0019 with server-derived ua_class, the Day-1 baseline row, the phone review of every deploy, the column-check before the pilot build, wave 1, the Day-14 read

Day 14 (Tue 22 Sep), from /stats — retention_daily(14,'pilot') and retention_daily(14,null) beside the metric_snapshot baseline — and tools/sql/retention-readout.sql's Day-14 block, on pilot arrivals only (entry_source='pilot', ua_class='browser' as the server derived it, first session Days 9–12), written next to the Day-1 baseline row and the Day-10 wave-1 row in docs/RETENTION.md with n and a binomial interval on every rate. Read in this order: (1) IDLE_TIMEOUT share of external-card exits since Deploy 2 — must be exactly 0, it is the measurement; (2) position-0 hold (server span >= 5 s, no CRASH) on first sessions, target >= 50%; (3) share of visits reaching the end card, target >= 50%, and median depth (max visit_ordinal per visit_id) reported with n against the baseline's structural <= 2; (4) back taps per visit on touch, > 0; (5) D1 — the outcome — with its interval (about ±6 points at n≈100); (6) diagnostics, reported never targeted: share taps and share arrivals with entry_source not 'pilot', likes, loops per visit, webview share of arrivals, boot_ms p50 on ordinal 1, stats_daily DAU over the fortnight with the founder's tours excluded, card_rank(14) for the live cards (votes, hold_ucb, demotion — whether Deepstate has 20 votes yet, from data), the per-platform review verdicts, and the pilot's n by wave. Not read: D7, anything per hosted card (the founder's own uploads only), any ranking number as a verdict under 20 votes, any A/B. Demote-only stays exactly as written; the only thing this readout decides is where the next fortnight's engineering days and content hours go.

• Any external-card session since Deploy 2 ended IDLE_TIMEOUT (read Day 3, Day 10, Day 14): the policy is not reaching production and nothing else ships until it does — it is the measurement.
• The wave-2 gate fails on Day 10 (external idle share not 0, boot_ms missing on ordinal-1 rows, column-check not clean, or an open P0): wave 2 is not sent, the sprint reports n≈50 honestly, and the next fortnight fixes measurement before composition or supply.
• Fewer than 80 pilot browser actors by Day 14 even with both waves sent: the D1 number is not reported as a number; only the guard rails are read, and the next sprint starts by finding out why one hundred sends produced fewer than eighty arrivals (webview share, the message, the link).
• Position-0 hold < 40% and reached-end < 50%: the first minute is the problem, not the way back — the next fortnight goes to card 0's phone fit (Deepstate's own hold number, read from card_rank, is the ruling's 'until outvoted') and to the chrome, not to supply and not to composition.
• Reached-end >= 50% but D1 < 5%: people finish and do not return — the deck is too short; the next sprint is supply through the founder's own linking and the concierge with the bench ruling in hand (STRATEGY bet 6), not more chrome.
• D1 between 5% and 10% at n≈100 (the gray zone): one more founder-network wave after the wave-1 fixes, no seed cohort yet, and the day-21 read decides.
• D1 >= 10% at n≈100 with the guard rails met: the bar holds provisionally; the next sprint is composition rescoped for a linked-card deck plus supply (bets 4 and 6), and there is still no launch post until D1 holds on >= 200 browser arrivals at a day-21 read (STRATEGY section 7).
• Back taps per visit = 0 on touch across the pilot with the chevron live: the control is not being found — a placement fix before anything that assumes a way back is measured; a fix, not a kill.
• Webview share of pilot arrivals > 40%: the end card's browser line was needed and, if it was cut, ships before any cohort; retention is read on browser arrivals only either way.
• A card linked by a visitor during the pilot goes a day without being opened on a phone, or a removal request is not honoured the same day: the section-9 rule was broken by hand — the bench is sprint 2's first item regardless of the numbers.

• The save channel for uploaded pages (window.blitz.save/load through the html viewer's probe, the 4 KB localStorage relay) and the founder's 'page that remembers' — 1.5 engineering days plus founder hours for a card class no pilot visitor is likely to reach in three days; bet 2's mechanism returns when a hosted card in the deck needs it.
• The add-to-home-screen prompt on the end card (beforeinstallprompt, the iOS two-step line, a visits counter) — no pilot arrival reaches a second visit inside the window; a second-visit prompt is read on a day-21 cohort.
• The bench (card.status 'bench', provenance, platform, claim_token, card_status_log, card_set_status, bench_feed, card_by_slug, my_cards, card_frameable), bench-as-unlisted on the client, the /feed?bench=1 ReviewStrip — a change to the primary path (submit_link/submit_media inserting bench breaks the shipped 'Linked. It is live, and it is next.' promise and link.spec) that needs the founder's ruling first; its readers do not exist yet, and STRATEGY section 5 says the feed can judge about fifteen cards at today's traffic. Designed in sprint 2 with the ruling; the daily by-hand check covers the fortnight.
• tools/harvest.mjs (the Playwright pixel checker), harvest/candidates.txt, the 100-URL harvest, committed harvest thumbnails, bench.sql pastes — two engineering days plus eight founder hours; the pre-pilot deck is six to eight cards linked by hand through the + sheet, which also dogfoods the product's own path.
• claim_card, the ?claim= flow, removal_request, the 'yours? Claim it · Remove it' strip, ui_event kinds 'claim'/'remove_request' — at under thirty cards a text takedown line in docs/EMBEDDING-A-SITE.md and a hand-run hide is the same-day takedown; the claim flow follows the concierge.
• The concierge: 15–20 maker DMs with link-first claim tokens — STRATEGY section 5 names it the first thing to stop when hours run out, there are no host-measured numbers to show a maker yet, and for own-domain makers a link to an existing card is framing before asking. Only the two or three makers the founder knows, asked before anything is linked.
• The hosted-card 'Still there? Tap to continue' restyle of the Paused badge — the html viewer's injected probe means a touched page never idles; keeping the badge keeps telemetry.spec.ts's contract; the restyle ships with the sprint that reads hosted idle share.
• liked, reported_touches, reported_beats as card_event columns and the GameWorker/TelemetryAgent change — ui_event like/unlike covers Like; the wasm cards are hidden so the worker path reads nothing.
• growth_weekly, sprint_readout and a second readout RPC — one admin-only RPC (retention_daily) with the internal/probe/headless exclusions; the target column and card_rank chart polish on /stats.
• Replacing the landing's '<1s to first play' with a measured boot_ms p50 — there is no week of data; the fact is deleted and the number added later.
• Everything obsolete in STRATEGY.md for the product as it is: bet 5 (the factory, the 60-card probe, the family grid, the lint/smoke pipeline), 'Ripple Tap opens for everyone' and the card_editorial rewrite (the catalogue is hidden; Deepstate is card 0 until outvoted), bundled boot of card 0 from MOCK_GAMES/feed.json (card 0 is a framed third-party site), the wasm idle redesign (no wasm card is served), composition v0 and slot 2 'New today' (nothing to compose), the 200–300 seed cohort (the 100-visit pilot is the whole traffic plan), hiding '+' for anonymous visitors (uploads and links are the primary path; '+' opens the account door), the 3 s 'Nothing showing?' line (never built), 'Tip goes' (already gone), and confirm-email-off gated on concierge handles (a short reserved list ships in 0019 and the setting flips on Day 7).
• D7, any promotion on telemetry, any A/B, any change to card_rank beyond the internal-actor exclusions already in it — demote-only stays exactly as written.

Each with the default the sprint runs on if nothing is said.

• Bench or instant-live for visitor-linked cards: STRATEGY section 9 says no card goes live unreviewed on a phone, but the shipped product and the landing say 'paste a link, it's live' — default for this sprint: instant-live stays, the founder runs the daily five-minute check and hides by hand, and sprint 2 builds the bench with this ruling in hand.
• The sprint's headline number: D1 with its interval (the winner's thesis, accepted by two judges) or position-0 hold plus reached-end (readable at n≈100, preferred by the third) — default: D1 is the outcome, read only behind the four guard rails, with the 5–10% gray zone named so it cannot be spun.
• Confirm email OFF on Day 7 once 0019 has landed the reserved-handle list — default: yes, off, because an unconfirmed account is free and a handle is the only thing in it worth squatting, and the list is what protects the handles.
• The reserved-handle list itself (blitz, blitzlabs, admin, rand and its variants, the product's other names) — default: the agent proposes twenty and the founder strikes or adds by Day 6.
• The pilot link: /feed?via=pilot&r=<the founder's u_ id> (entry_surface 'share', credited to the founder, as STRATEGY section 7 writes it) or /feed?via=pilot alone (entry_surface 'direct', keeping share-to-arrival pure) — default: with r=, and the readout excludes pilot-referred arrivals from share-to-arrival.
• Platform order and the per-platform stop rule for the founder's cards — default: OpenProcessing and the p5 editor first, itch.io HTML5 second, CodePen third, Shadertoy last; stop drawing from a platform once more than half its candidates fail the three questions.
• Wave 2 on a Saturday (Day 11) with the freeze after it, versus Monday (Day 13) with no D1 window — default: Saturday, gated.
• Chevron placement: at the right end of the left column next to BLITZ with a 48 px hit area (the strategy's 'left of BLITZ') or at the far left of the bar — default: next to BLITZ, no overlap, confirmed on the founder's phone before Deploy 3.