SPEC v0.3: orchestrator resolutions of the plans' open points

Records D-004 and D-015 to D-025: shells and ownership, server seams
(router middleware, rate_limit layer, tasks::start, AuditWriter and PushQueue
traits, next_occurrence_date in kvitt-domain, M3 owns recurring generation,
M4 lands after M3), OpenAPI parsed-value equality, feature convention and
strings, empty fake scenario and resolveRange exception, shared ledger rows and
editor fields in :core:design, no bundled font, pruning at 04:00, development
infrastructure as M2c-dev built it, M2c-pi allowances, release keystore,
production import procedure. Plans and prompts close their open points;
HANDOFF rewritten to the real state; CLAUDE.md: implementation agents never
edit SPEC.md or docs/decisions.md.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

PLAN-M10.md

@@ -13,7 +13,7 @@ Ship the first signed release to both phones from the production server on the P
 
 ## 3. Already established
 - `version_code` = `git rev-list --count HEAD` of the released commit; `version_name` = `YYYY.MM.DD-<short sha>`; passed as `kvitt.versionCode`/`kvitt.versionName` by the release script (§10.6).
-- Release keystore at `android/keystore/release.jks` (git-ignored), created once by the owner; passwords and alias in `android/local.properties` keys `kvitt.release.storeFile`, `kvitt.release.storePassword`, `kvitt.release.keyAlias`, `kvitt.release.keyPassword`; the owner keeps a copy in a password manager; losing it means reinstalling (§10.6).
+- Release keystore `kvitt-release.jks`, alias `kvitt`, RSA 4096, validity 10000 days, created once by the owner with the `keytool` command of §10.6 in a directory outside the repository (D-024); `android/local.properties` holds its absolute path and the secrets in `kvitt.release.storeFile`, `kvitt.release.storePassword`, `kvitt.release.keyAlias`, `kvitt.release.keyPassword`; the owner keeps a copy in a password manager; losing it means reinstalling (§10.6).
 - `infra/publish-apk.sh` builds `:app:assembleRelease` through `tools/gradle-serial.sh`, writes `apk/kvitt-<version_code>.apk` and an atomic `apk/latest.json`, keeps the newest 5 (§10.6).
 - The landing page links "Download Kvitt" to the latest APK; the first install asks to allow "Install unknown apps" (AC-2.5, AC-16.3).
 - Pairing: `kvitt-server bootstrap` on the Pi prints the admin code (FR-1); the admin creates the partner invite in Settings and shares it (AC-2.1); after pairing the app syncs and asks for notifications (AC-2.9).
@@ -35,7 +35,7 @@ Edit nothing outside these paths; a needed change elsewhere is a contract reques
 - On the Pi (not in git): published `apk/kvitt-<version_code>.apk` and `apk/latest.json`; a production household with both users.
 
 ## 6. Steps
-1. Worktree. From the main checkout `/Users/jhag/projects/kvitt`: `git worktree add .claude/worktrees/agent-m10 -b agent-m10 main`, then in `.claude/worktrees/agent-m10`: `git reset --hard main`. Copy `android/local.properties`, `android/app/google-services.json` and `infra/secrets/` from the main checkout; the keystore stays in the main checkout's `android/keystore/` and is referenced by absolute path from `local.properties` (never copied into git). Run `tools/install-git-hooks.sh`.
+1. Worktree. From the main checkout `/Users/jhag/projects/kvitt`: `git worktree add .claude/worktrees/agent-m10 -b agent-m10 main`, then in `.claude/worktrees/agent-m10`: `git reset --hard main`. Copy `android/local.properties`, `android/app/google-services.json` and `infra/secrets/` from the main checkout; the keystore stays outside the repository and is referenced by absolute path from `local.properties` (never copied into a checkout or git). Run `tools/install-git-hooks.sh`.
 2. Read §2 in order. Confirm M2c-pi, M3, M4 and M8 have landed and the Pi stack is healthy (`infra/deploy.sh` output, `/health`); if not, stop and report.
 3. Keystore (H-1). After the owner created it, add the four `kvitt.release.*` keys to the main checkout's `android/local.properties` (never overwrite other lines).
 4. Deploy the current `main` image to the Pi with `infra/deploy.sh <tag>`; publish the APK with `infra/publish-apk.sh`; check `GET /apk/latest` returns the new `version_code`.
@@ -54,7 +54,7 @@ Green means: both files exist with every section filled (no `TODO` other than a
 
 ## 8. HUMAN steps
 From SPEC §11.2, verbatim: "Create the release keystore; install the APK on both phones from the landing page; allow "Install unknown apps"; partner pairs with the invite; confirm notifications arrive".
-- H-1, step 3, on the owner's Mac in the main checkout: `keytool -genkeypair -v -keystore android/keystore/release.jks -alias <alias>` with key algorithm, size and validity as the start prompt states (`TODO(spec)`: §10.6 does not fix them); choose the passwords, store them in the password manager, and tell the agent the alias and where the passwords are entered (the agent never echoes them).
+- H-1, step 3, on the owner's Mac, in a directory outside the repository (D-024): `keytool -genkeypair -v -keystore kvitt-release.jks -alias kvitt -keyalg RSA -keysize 4096 -validity 10000`; choose the passwords, store them in the password manager, and tell the agent the keystore's absolute path and where the passwords are entered (the agent never echoes them).
 - H-2, step 6, on the owner's phone: open the invite link or `https://icehack.asuscomm.com:8443/i/<code>`, tap "Download Kvitt", open the download.
 - H-3, step 6: when Android asks, allow "Install unknown apps" for the browser, install, open Kvitt, pair with the code, allow notifications.
 - H-4, step 6 and later updates: allow "Install unknown apps" for Kvitt itself when the in-app update first asks (AC-16.3).
@@ -73,7 +73,7 @@ From SPEC §11.2, verbatim: "Create the release keystore; install the APK on bot
 - Gate: the two files' section list and the `docker stats` server line.
 - Restore drill result in one line; runbook corrections.
 - Versions: none expected beyond what landed; state any tool used (keytool, rclone) and its version.
-- Numbering used or `TODO(spec)` occurrences.
+- Proposed decision entries (never written to `SPEC.md` or `docs/decisions.md` by this agent) or `TODO(spec)` occurrences.
 - HUMAN steps done and outstanding, worded for relay.
 - Contract requests, open questions, spec gaps (with section numbers).