Pocketful Dark Factory: Proof Before Ship

Five Claude Code seats in BAND Desktop built the pocketful wallet service from one dispatched task: a coordinator that routes self-contained handoffs, an analyst that turns the spec into a coverage matrix and black-box checks before any code exists (214 requirements for stage 1, 58 not covered by the shipped tests), a builder that is the only seat writing product code, an adversary that attacks the running container, and a gate that reruns every check on the exact revision and waits for the adversary's report before ruling. All four stages claim their stage in isolated mode on a fresh clone, and every stage starts with no network. Review changed the work seven times: in stage 1 the adversary found a crash under 50 concurrent large requests; the gate reproduced it and rejected; the fix then broke import of the service's own large export, which round 2 caught. Stage 2, the browser app with holds, was accepted first time. In stage 3 the adversary's oracle fuzz found 0 ledger mismatches in 94,000 comparisons but caught a memory crash in statement snapshots; it was rejected, fixed and accepted. Stage 4 (refunds and batch corrections) was accepted first time after 0 failures in 59,610 oracle comparisons. Every seat's cost is measured from its own session log: $123.87 API-equivalent for all four stages, 96% of input tokens cached. FACTORY.md documents setup, design, every bug caught, honest lessons and all human notes, so another team can stand the factory up from FACTORY.md and the mandates alone.