oficina / home Public

The amendment lands, with the definition it needed and the test it claimed

`design-activity-pull` passed its review on 2026-09-05, and both binding
files said §2.2's verb changes on approval and not before. It has.

§2.2's first never-do and AGENTS.md's first of the four things now read
*never stores*, with the permitted rendering stated positively and every
limit travelling with it.

**"Retains" means holds without a bound — and a bound is a written
number, with a reason, sized to the render rather than to retention.**
Three drafts of this gloss were wrong in three different ways. The first
said "at rest, and only at rest", which would have left §0 permitting an
in-process title index for everyone held to restart. The second fixed
that and left "without a bound" satisfied by any finite number — a
thirty-day maximum over ten thousand people is bounded, and is the same
index. So the gloss now names all three bounds rather than one: an age,
a maximum number of person entries, and a maximum bytes per person. The
entry count is what actually caps the cross-person set; the age alone
does not. And at rest is defined as the case where the bound is not the
home's own to enforce, which covers swap and core dumps in the same
clause.

**The amendment also claimed a test that did not exist.** Its whole
purchase was that "never stores" has a grep behind it where "never
renders" had none — but §12 gate 1's corpus was addresses only, and gate
9 and §3.4 named addresses, team names and queue payloads. The clause
was resting on a test that never looked for what it forbids. Gates 1 and
9, §3.4's rule, §3.2's at-rest inventory and AGENTS.md's Data bullet all
grow titles, URLs and actor strings.

**And it un-anchored the support console**, which is the part worth
reading twice: "never learns" forbade an operator reading your content
and "never retains" does not, since a console that displays without
keeping passes both it and the falsifiable form. Three references
pointed at §0 — §2.2's fourth bullet, §14's last row, AGENTS.md's fourth
thing — and now point at §2.2's first bullet, each saying why.

Both files carry the reading note that "transiently and per request"
does not exclude a bounded cross-render cache, since AGENTS.md read
alone would otherwise forbid what the spec approves. §2's opening
paragraph is qualified: the boundary rule now has something to bite on,
ruling 11 survives on the leak profile and the re-check, and
carlos/pegamento #1 should see the new phrasing. §9's pepper-rotation
sentence is rewritten — an earlier insertion left it claiming every call
in the table is instance→home, which is false of four of them.

Three follow-ups recorded against the merged design: it still cites §0
for the operator view, its Scope line still says the home learns none of
it, and no gate there exercises eviction on the entry-count or
bytes-per-person bounds — gate 20 tests the age bound only.

Reviewed by Fable 5.1 across three passes; the third approved.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>