# Controlled community pilot — launch definition (P10-T09)

State: **DEFINED, NOT LAUNCHED**, 2026-10-05. Owner task P10-T09
(issue #53). This document defines the pilot; it launches nothing.
Execution stays **BLOCKED** until the entry prerequisites below are
met. No city, cohort, window or result is claimed here.

## Entry prerequisites (all unmet — none waived)

- Scoped real G09 **RELEASE_CERTIFIED** on an immutable candidate
  (record: `../release-evidence/p09-g09-scoped-release.md`; currently
  UNCERTIFIED/BLOCKED, tracker #13 OPEN).
- G24 manual/device batch closed (accepted BY USER DECISION 2026-10-02;
  batch OWED — record
  `../release-evidence/p24-g24-user-acceptance.md`).
- Separately authorized production deployment + tag; no rollout
  follows any plan merge automatically.

## Launch scope (fixed at authorization, TBD below — never invented)

- One bounded city: municipality + state, directory station list and
  survey-week cadence recorded before opening (criteria in
  `../operator/pilot-city.md`). City: **TBD**. No simulated members,
  prices or activity, ever.
- Cohort/capacity/window: agreed with the owner at authorization from
  measured staging capacity. Cohort: **TBD**. Window: **TBD**.
- Staffing: named moderation coverage with response target + triage
  cadence, staffed support route, reachable privacy operations
  (export/erase, 24-hour evidence expiry, 12-month audit purge).
  Names/targets: **TBD** (checklist in `COMMUNITY_METRICS.md`).

## Conduct and rollback (procedure, rehearsed at launch — not executed)

- Operate per `../operator/pilot-city.md`: opening checklist first,
  stop/pause triggers owned there (backlog, abuse, privacy incident).
- Rollback rehearsal at launch: pause onboarding/contribution, keep
  ANP browsing available; product changes revert only through
  versioned releases; moderation audit rows stay append-only.
- Monitor freshness/disputes/cost against the frozen definitions in
  `COMMUNITY_METRICS.md`; sparse cells show the dated ANP reference.

## Results

- Pilot report goes to `pilot-results.md` only after a real run, with
  evidence, limits and next product decisions. **No run exists:
  no results, no metrics and no launch decision are recorded here.**