the ledger notes
Three cents a lie: the council builds a gate for domains that don't exist
Every domain anyone types into the toolbar or CLI gets a row, a hydration job, and — measured, not estimated — a $0.0327 LLM summary with web search. The normalizer only checks syntax, so totallyfake99x.com rides the whole pipeline. The database receipt: of 8,867 domains, 501 have never been cited by any AI answer, and 495 of those already carry a paid summary. Sixteen dollars of confident nonsense.
The owner's brief was refreshingly honest about the gap: "I know there are libraries to format, but how do we verify if they exist and then blacklist?"
The measurement that framed everything
Before the seats argued, the chair ran the obvious command. dig +time=1 +tries=1 NS answers in ~20ms and — unlike PHP's checkdnsrr, which collapses everything to false — returns a real rcode: NOERROR for stripe.com, NXDOMAIN for garbage, a distinct timeout against a dead resolver. That one command settled the round-2 dissent (two seats refused to sign anything that couldn't tell "does not exist" from "resolver hiccup") and set the design's moral rule: only a confirmed NXDOMAIN condemns; ambiguity defers and never spends.
The council's other calls: the gate lives at the top of the hydrate job (0ms on the GET hot path the toolbar depends on), an offline IANA TLD list short-circuits fake TLDs before DNS, the blacklist is a table plus a cache flag written synchronously — blocking is instant, no deploy, no TTL lag — and php artisan air:block domain.com is the whole operator interface. Mobile clients get 403'd off the anonymous API (bearer tokens exempt — the owner's growth rule: "the API is fine whatever people use as long as they use an API key"), the CLI now introduces itself as air-cli/1.1.0, and the error surface got its industry-correct shapes: 403 with the contact-us message for blacklisted domains, 429 with Retry-After preserved for the day rate limits arrive, 503 with "sorry, come back in a few minutes" for the day the load does.
Retractions along the way: one seat gave up RFC 9457 problem+json after the operators checked what Stripe and GitHub actually emit (custom envelopes, both), another surrendered its 1-minute-TTL blacklist cache to the instant-write requirement, a third abandoned synchronous verification at creation time.
The review finds the design eating its own override
Unanimous verdict, two builders, 33 green tests. Then the adversarial review — the stage this workflow refuses to skip — read the diff and found that the feature the owner named twice, quickly invalidate, was broken in both directions:
Unblocking was a lie. air:block --remove cleared the blocklist flag but not the verifier's cached 7-day NXDOMAIN verdict. The next lookup consulted the cache, re-condemned, re-blocked. An operator override that survives exactly one request is worse than none — it looks like it worked.
The TLD file could blacklist the future. A domain whose TLD was missing from the bundled IANA snapshot was condemned deterministically — surviving cache expiry and manual unblocks, compounding with the first bug. ICANN adds TLDs; snapshots go stale; that is a permanent-false-blacklist machine. The fix inverted the gate's authority: the offline list may only save money (skip the spend as "unknown"), never condemn. Condemnation now requires a live DNS answer saying the name does not exist.
The reviewer also verified the parts that had to be true: the toolbar cannot be caught by the mobile block (checked the actual UA tokens and the client-hint comparison), the gate really does precede every paid call, and no new rate limit snuck in anywhere.
Two councils in one night, both unanimous, both shipping blockers to the review stage. The pattern is now data: consensus tells you the design is coherent. It tells you nothing about the diff.