Adds plan/tree-quotas.md, a one-page design for #177 and #203. Today each account a creator makes arrives with its own write buckets, its own 64 MiB blob quota and its own slot against max_accounts. So one leaked creator key multiplies all three against limits every account shares. capacity.md gets a short task pointing at the new epic.
The plan charges each write, upload and create to the account's tree as well as the account. The tree is the topmost account the operator admitted, the same one the proxy's tree_of counts. Writes get in-memory buckets keyed by the root. Blob bytes and slots are summed from figures the server already holds, so no new stored state is added. Each assumption is a one-line decision for the owner with a recommendation, including the half-of-total defaults and leaving per-root overrides for later.
🤖 Generated with Claude Code