amadan
There is a version of this that amends nothing, and it had to be weighed
The third review pressed the argument I had just rebuilt and found it was not the whole story. §2.1 said the verdict's alternative fails on the credential — Sheets fetching Docs "with the viewer's identity" would need the home to mint a cross-instance bearer — and called that "the whole of why the merge lives here". It is not. Browser-mediated composition needs no bearer and no amendment. The front door renders an iframe per instance the viewer has a row in; oficina.works is the registrable domain and the apex is not on the public suffix list, so front door and instance are same-site and the instance's own SameSite=Lax session cookie rides along. Zero JS, pull at render, nothing at rest — and the home never touches a title, so §2.2 would stand unamended. With it would go the RAM cache, §2.1's cross-person residue, the swap and core-dump questions, the one-process question, and gates 11 and 16's parsing surface. Roughly half this design's risk stops existing. Paul ruled the server-side pull anyway, and the design now records why rather than pretending the alternative was never there. What the frames cost is the feature: per-app panels instead of one ordered list; no server deadline, so a cold instance is an empty frame under a heading rather than ruling 5's named gap — the honesty mechanism replaced by a blank; a sign-in prompt where rows should be for anyone without a live session at that sibling, which is most guests and every first visit; a hostile instance drawing pixels on the suite's most public page; and §6's guest-wake billing problem surviving with no home-side throttle possible, because the home is not in the request path. Two more shapes are named and rejected on their real grounds: instance-to-instance under the caller's own consumer credential fails because it has Docs trusting Sheets for who you are, which §5.4 reserves to the credential origin, and makes acme.sheets an oracle over every person ref at acme.docs; and a redirect chain is not composition and puts titles in URLs. Fifteen corrections with it. Five places still described the fan-out in cross-team or team's-apps terms after the last commit fixed §6 and §8.1 — including §8's own rendering sentence, which is the one a builder implements. The finding-1 row still answered "the first of the two paths" in its right column while its left column and §2.1 said the second. Gate 12 did not list the case §10 said it covered: a declared participant answering 404. The two kinds of absence — never asked because unregistered, versus dropped by the budget — needed saying apart or they collapse. And the last superseded §11 quote, a call-2 citation that named a third event where there are two, calendar and mail inverted, the refresh TTL missing from both number lists, a severed antecedent, and a status block that recorded a peer pass and none of the three real ones.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
docs/superpowers/specs/2026-09-05-activity-pull-design.md+76 −22
CI passed — run details
Intent
<task-notification> <task-id>a9ff0e3b148824222</task-id> <tool-use-id>toolu_01ST9HPXMEdnuuuTvCwb8fQE</tool-use-id> <output-file>/home/paulca/.cache/tmp/claude-1001/-home-paulca-amadan-net-oficina-home/d63f5ac7-6b42-48c5-a13d-34e6faf8e44c/tasks/a9ff0e3b148824222.output</output-file> <status>completed</status> <summary>Agent "Fable review 3: activity pull" finished</summary> <note>A task-notification fires each time this agent stops with no live background children of its own. The user can send it another message and resume it, so the same task-id may notify more than once.</note> <result>**VERDICT: CHANGES NEEDED** — one real finding, in the section you asked me to press on; everything else is nits that can go in the same pass. I would approve on a fix to §2.1 alone, without another full round. File: `/home/paulca/amadan.net/oficina/home/.claude/worktrees/design-activity-pull/docs/superpowers/specs/2026-09-05-activity-pull-design.md` (HEAD `80d01f6`; `main` `84a6108` read from the trunk worktree). ## The twelve addressed items — verified 1. Fan-out set: §6 (l.504-516) states it, cites home §11's "Tiles come from the viewer's own rows" (which is on `main`, l.992-998), gate 14 has the guest case (l.737-742). Good. 2. §2 framing: finding-1 row struck (l.121), §2.1 opens on the second path (l.155-163). **But the row's right-hand column was not updated** — see B below. 3. §2.1 credential argument: rebuilt as described. **Not airtight** — see A. 4-12: gate preamble says ten/1-10 (l.702); gate 20 after 19; citations now `home spec §12, gate 1` / `gate 16` / `home spec §9's call 4b`; edge-logs leg dropped (l.431-433, matches `main` §5.3 l.405-410); one-process assumption in §5 and §12 (l.408-411, 847-849); §2.2(a) now "the selected team's hosts that the viewer has rows in"; §8 quotes ruling 17's one page; min interval starts on a completed pull plus the three-timers paragraph (l.545-553); §0 says two clauses; plan at `docs/superpowers/plans/2026-09-03-home-signin.md` (`b92c9b8`) is on `main` and its l.65 does say Paul provisions `HOME_DEK`. `5a42f2d` is on `main` and AGENTS.md there carries all three retractions. ## A. Blocking: §2.1's "fails on the credential" is false as an *only* l.183-191 says the verdict's alternative requires the home to mint an `aud=acme.docs` assertion and hand it to Sheets, and "That is the whole of why the merge lives here." There are two versions of "fetched from the sibling with the viewer's identity" that need no home-minted cross-instance bearer, and the design considers neither: - **Browser-mediated composition.** The front door (at the home, or Sheets' page) renders `<iframe src="https://acme.docs.oficina.works/activity">` for each row the viewer has. Zero JS. `acme.docs.oficina.works` and `oficina.works` are *same-site* (`oficina.works` is the eTLD+1; `.works` is a TLD and the apex is not on the public-suffix list), so the instance's own `SameSite=Lax` session cookie is sent. No credential is minted per render, no home→instance call exists, and the home never touches a title — which means §2.2's "never renders" stands **unamended**, and the RAM cache, the cross-person residue, the swap/core-dump question, the one-process question, gate 11's failure-path parsing, gate 16's hostile-JSON surface, and §2.2(b)'s lost detection property all disappear. Its real costs: the viewer needs a live session at each sibling (a first-time viewer or guest gets a sign-in link in the frame, not rows); no ordered merge across apps; no server-side deadline, so "waking" is an empty frame under a heading rather than a word; instances must send `frame-ancestors https://oficina.works` on that route; a hostile instance controls pixels on the most public page; and the guest-wake billing problem (§6) survives with no home-side throttle possible. Those may well lose — but the design amends a binding never-do without having weighed the one shape that does not require the amendment. Nothing in rulings 2 or 18 excludes it ("pulled at render, holds none at rest" both hold). - **Instance→instance under the caller's consumer credential, carrying `sub`.** Fails — Docs would be trusting Sheets for identity, which only the credential origin may supply (home §5.4's "signed identity claims"), and it makes `acme.sheets` an oracle over every person ref at `acme.docs` — but on a different ground than the one §2.1 gives. - A **redirect**, as you suggested, cannot compose a page; a data-carrying redirect chain puts titles in URLs (history, referrers), refused for the same reason §5.3 keeps assertions out of query strings. Worth one line so nobody reaches for it. Fix: retract "the whole of why"; name both variants and reject them on their actual grounds. Because the framed variant is the only one that leaves §2.2 as written, I'd put it to Paul as a one-line question rather than settle it in the section — a doctrine clause is what is being amended. ## B-P. Corrections and nits (one pass) - **B.** Finding-1 row (l.121): the right column still says "the first of the two paths the verdict named"; the struck left column and §2.1 say *second*. One row, two answers. Also "the ruling was reopened" now means §2.2's verb, not §5.4 — say so. - **C. Fan-out phrasing still leaks in five places** — the exact reading §6 calls a leak: l.27-28 Scope "across that team's apps"; l.42 "each of a person's instances" (that is *cross-team* wording); l.48 "merged across that team's apps"; l.540 "warms the selected team's instances"; **l.638 (§8) "Merged across the selected team's instances"** — the rendering sentence you asked about. Gate 12 is fine; §8.1 and gate 14 are right. - **D.** l.283 still quotes "your teams grouped by app, and a New button" as §11's front door. That phrase is no longer anywhere on `main` (grep confirms). The §8 quote was fixed; this one was missed. - **E.** l.687 "§9's call 2, third event" — `main` §9 l.727-733: call 2 drives *two* events, and the second is an *instance* deletion, not a team's. Wrong citation. - **F.** §11 l.822 "Calendar and mail … no repo and no spec respectively" is inverted. `oficina/calendar` exists with code and no `docs/`; `oficina/mail` does not exist. The verdict's finding 8 says exactly that. - **G.** l.80-81 "flagged as such when the design was approved" — it is not approved by its own status line. And ruling 7 is also "This session" but is not in the "3, 4 and 5" list. - **H.** Clause count fixed in §0 only: l.33 "one clause of it changes" and §3's title "The one clause that changes" still say one. - **I.** §10 l.807 says gate 12 covers a declared-participant answering `404`; gate 12's text lists only timeout and empty, and gate 16 does not list `404` either. Add it to one. - **J.** §6 l.563-566 "an un-asked instance must render as its own kind of gap" vs §10 l.805-806 "an app that does not declare it is never asked". A builder needs one sentence: registry-excluded renders nothing; budget-excluded renders the distinct gap. - **K.** l.555 "Neither is fixed here. Both are…" — the antecedent (the two cost bullets) is now severed by the inserted three-timers paragraph. Move it below the bullets. - **L.** §12 numbers: the refresh TTL is listed neither as tunable nor as must-settle (home §15 l.1129-1131 names "the RAM cache TTL" as open here). And l.853 "They want measurement against a real canary" is attached to the swap/core-dump bullet, where it belongs to the deadline/body-cap bullet. - **M.** Status block (l.3-25) and §12 first bullet ("Not run") do not record the second review pass (Fable 5.1, CHANGES NEEDED, 3 blocking + 9). AGENTS.md's review rule requires it in the status line; "revised the same day after a peer pass" is stale. - **N.** §3 l.290-292 and l.295-296 are the same sentence twice. - **O.** l.430-431 "the same three things … with one leg removed", then lists two. Say two. - **P.** Formatting: no blank line before `**Scope:**` (l.26) or before `**Two ages` (l.611); l.264 needs a comma after "included". ## What I found no problem with Every verdict quote checked verbatim against `docs/superpowers/reviews/2026-09-02-escritorio-fable-verdict.md`, with confidence markings matching; assertion claims, gate numbering, the 404-not-403 pattern, the edge-cache description, the `jti`-store citation, the sqid/registry references, Sheets §10.2 ("Home is your sheets by recency", sheets-design l.781) and §13 step 10's wording all agree with `main`. Gate 12's silent-instance case is consistent with the viewer-rows set. No contradiction with ruling 18 or 22.</result> <usage><subagent_tokens>125796</subagent_tokens><tool_uses>14</tool_uses><duration_ms>349536</duration_ms></usage> </task-notification>
Attributed to this commit: 55.8 g CO₂e (7109065 tokens). This is an attribution, not a measurement — usage counted from this commit's own marker forward to the next one on design-activity-pull, never backward from it. A turn that produced more than one commit books all of its tokens to the last one, and a concurrent session on this branch can add to the same figure. Some of it was priced using the shared default rate, because no model-specific factor row exists yet for at least one model involved. The Carbon view has the repo total, which is never derived from this attribution.
diff --git a/docs/superpowers/specs/2026-09-05-activity-pull-design.md b/docs/superpowers/specs/2026-09-05-activity-pull-design.md| index 522c22c..1d0b460 100644 |
| --- a/docs/superpowers/specs/2026-09-05-activity-pull-design.md |
| +++ b/docs/superpowers/specs/2026-09-05-activity-pull-design.md |
| @@ -1,7 +1,18 @@ |
| # 🤖 Activity on the front door — design |
| -**Status:** design, 2026-09-05, revised the same day after a peer pass. |
| +**Status:** design, 2026-09-05, revised three times the same day. |
| Drafted by the activity-stream session (`claude-opus-5`). |
| + |
| +**Review passes: three, all by Fable 5.1, all returning CHANGES NEEDED.** |
| +The first found six blocking (a superseded §11, §7 contradicting itself on |
| +stale rows, §10's 404 rule inverting ruling 5, the shared platform edge cache |
| +upstream of both ends, the RAM cache understated as one person's, and two |
| +"open numbers" that were load-bearing). The second found three (the fan-out |
| +set stated two ways, one of which disclosed a guest's sibling apps; §2's |
| +framing backwards after the rescope; §2.1 answering an alternative nobody |
| +proposed). The third found that §2.1's credential argument was not the whole |
| +story — browser-mediated composition needs no amendment at all — which Paul |
| +then ruled on. **This revision has not been re-reviewed.** |
| **Review pass: run 2026-09-05 by Fable 5.1**, which returned CHANGES NEEDED |
| with six blocking findings and eight required corrections. All are applied in |
| this revision, and the revision has not yet been re-reviewed — so this is |
| @@ -23,14 +34,15 @@ binding and needed a written "never" against the obvious optimisation (§11); |
| and one claim in §5 was falsified by §5.3's own last line. That session |
| wrote enough of the resulting argument to no longer be independent, and it |
| says so itself. **A fresh reviewer is still required.** |
| + |
| **Scope:** how the home's front door (§11 of the home design) shows a person |
| what has been happening in the team they are looking at, across that |
| -team's apps, without the home |
| +team's apps that they personally have rows in, without the home |
| learning or holding any of it. |
| **Reads on top of** `docs/superpowers/specs/2026-08-30-home-design.md`. Every |
| `§n` below refers to that spec unless it says otherwise. Nothing here |
| -replaces it; one clause of it changes, and §3 says which. |
| +replaces it; two clauses of it change, and §3 says which. |
| --- |
| @@ -39,13 +51,13 @@ replaces it; one clause of it changes, and §3 says which. |
| The ask was "an activity stream API the other apps post to, so home shows a |
| feed on sign-in." **The direction inverted during design, and the API is |
| therefore not the one that was asked for.** Instances do not post. The home |
| -asks each of a person's instances "what's theirs, recently?" when it renders |
| +asks each of the viewer's own instances in the selected team "what's theirs, recently?" when it renders |
| their front door, merges the answers, and holds them nowhere but memory (§7). |
| **Scoped to the selected team — RULED 2026-09-05 by Paul**, and recorded in |
| the home spec as ruling 18. The front door is one team's page (ruling 17, |
| `?team=<sqid>` per ruling 22), so the feed under it is that team's, merged |
| -across that team's apps. An earlier draft of this design specified a |
| +across the viewer's own rows in that team. An earlier draft specified a |
| cross-team merged list and argued for it; that argument is retired in §2.1 |
| rather than deleted. |
| @@ -77,8 +89,8 @@ What it costs is latency, honestly rendered. §6 and §7. |
| | 6 | **Scoped to the selected team, following `?team=<sqid>`** — home spec ruling 18 | A cross-team merged list, which this design specified and argued for until 2026-09-05; the argument is retired in §2.1 rather than deleted | Paul, 2026-09-05 | |
| | 7 | **Participation is a registry flag, never inferred from a `404`** — §10 | Treating a 404 as "does not participate", which makes a broken or hostile instance vanish silently and inverts ruling 5 | This session, 2026-09-05 | |
| -Rulings 3, 4 and 5 are this session's and were flagged as such when the |
| -design was approved. Ruling 5 is not a courtesy: §2 explains why it is the |
| +Rulings 3, 4, 5 and 7 are this session's and were flagged as such. This design is not |
| +approved — see the status block. Ruling 5 is not a courtesy: §2 explains why it is the |
| load-bearing test in the document. |
| --- |
| @@ -118,7 +130,7 @@ The findings that bear on this design, and what happens to each: |
| | # | The finding | What happens to it here | |
| |---|---|---| |
| -| 1 | ~~**It answered a different question.**~~ **Overtaken by ruling 6: per team is now the shape.** Per-team aggregation gives a person in three teams three lists, which the verdict called the wrong answer and Paul has since ruled the right one — the verdict's second path, not its first. The §5.4 argument below stands on its own and is what still matters. The cross-team list is forbidden at the only place that could hold it — §5.4, *"'Which documents you can see' passes (a) and fails (b), handing the home a document-level graph it has no business holding."* The verdict's own resolution: *"either that ruling is reopened deliberately or the want is declined."* | **The ruling was reopened deliberately** (rulings 1 and 2, Paul, 2026-09-05) — the first of the two paths the verdict named, taken with the sentence quoted in front of us. §2.1 argues why a rendered page is not a held graph. | |
| +| 1 | ~~**It answered a different question.**~~ **Overtaken by ruling 6: per team is now the shape.** Per-team aggregation gives a person in three teams three lists, which the verdict called the wrong answer and Paul has since ruled the right one — the verdict's second path, not its first. The §5.4 argument below stands on its own and is what still matters. The cross-team list is forbidden at the only place that could hold it — §5.4, *"'Which documents you can see' passes (a) and fails (b), handing the home a document-level graph it has no business holding."* **Ruling 6 took the verdict's SECOND path** — three lists, per team — so what was reopened is §2.2's verb, not §5.4. The verdict's own resolution: *"either that ruling is reopened deliberately or the want is declined."* | **The ruling was reopened deliberately** (rulings 1 and 2, Paul, 2026-09-05) — the first of the two paths the verdict named, taken with the sentence quoted in front of us. §2.1 argues why a rendered page is not a held graph. | |
| | 2 | **Titles are first-class sealed content, not cheap pointers.** Sheets §2.1 seals titles under its DEK; a mail "title" is a subject line — *"Re: your termination"*. Any indexer needs Sheets-grade custody. | **Survives, and is ruled through** (ruling 1). The instance decrypts under its own DEK and hands the title over for one render. The home stores nothing, so it never acquires the custody obligation — §3. **Also kills the stale-title leak** the verdict names ("Project Blue" still listed under its old name), which no cached copy can avoid and a pull cannot produce. | |
| | 3 | **`visible_to` is not a list, it is the grants join** — team rows plus individual grants minus removals. Either the app fans out one membership change to N item pushes, or the indexer re-implements the rule and drifts, failing as *a plausible empty list, not an error*. | **Dissolved by the inversion.** Nobody posts an ACL because nobody posts. The instance evaluates its own join at read time for the person in the assertion. There is no second evaluator and no copy to drift from. | |
| | 4 | **"Seconds" for a revoke is a median with an unbounded tail.** The carrier is *Sheets'* outbox, and Sheets §9.1.1 says *"for a quiet team a failed upsert may wait weeks for an organic wake, which is acceptable precisely because the directory is a hint"* — an argument that does not transfer to a rendered list. | **Dissolved by the inversion.** Revoke is instant because the answer is computed after it, every time. The only residue is the RAM cache TTL — §7. | |
| @@ -187,8 +199,41 @@ Sheets. §11's first row names that exactly: a cross-instance bearer is full |
| impersonation, and it is the one thing this design refuses to build. Only |
| the credential origin mints, so only a page at the home can hold a |
| viewer-bound assertion per sibling without any instance ever holding one for |
| -another. That is the whole of why the merge lives here, and it survives the |
| -rescope untouched — it was never an argument about scope. |
| +another. |
| + |
| +**That is not the whole story, and an earlier draft said it was.** There are |
| +three shapes of "fetched from the sibling with the viewer's identity", and |
| +only one of them needs a cross-instance bearer. All three are named here, |
| +because §2.2 is a doctrine clause and amending it without weighing the |
| +alternative that needs no amendment would be the wrong way to get there. |
| + |
| +- **Browser-mediated composition.** The front door renders an |
| + `<iframe src="https://acme.docs.oficina.works/activity">` per row the |
| + viewer has. `oficina.works` is the registrable domain and the apex is not |
| + on the public suffix list, so instance and front door are **same-site** and |
| + the instance's own `SameSite=Lax` session cookie rides along. Zero JS, pull |
| + at render, nothing at rest — **and the home never touches a title, so |
| + §2.2 would stand unamended.** With it would go the RAM cache, §2.1's |
| + cross-person residue, the swap and core-dump questions, the one-process |
| + question, and gates 11 and 16's parsing surface. **RULED 2026-09-05 by |
| + Paul: server-side pull, and amend §2.2.** What the frames cost is the |
| + feature: no ordered merge across apps, only per-app panels; no server-side |
| + deadline, so a cold instance is an empty frame under a heading rather than |
| + ruling 5's named gap — the honesty mechanism replaced by a blank; a viewer |
| + without a live session at that sibling gets a sign-in prompt where rows |
| + should be, which is most guests and every first visit; a hostile instance |
| + draws pixels on the suite's most public page; and §6's guest-wake billing |
| + problem survives with **no home-side throttle possible**, because the home |
| + is not in the request path. Recorded as considered and costed, not as |
| + overlooked. |
| +- **Instance → instance under the caller's own consumer credential**, passing |
| + `sub`. Fails, but not on the bearer: it would have `acme.docs` trusting |
| + `acme.sheets` for *who you are*, and home spec §5.4 reserves signed |
| + identity claims to the credential origin. It also makes `acme.sheets` an |
| + oracle over every person ref at `acme.docs`. |
| +- **A redirect chain** carrying rows. Not composition at all, and it puts |
| + titles in URLs — history and referrers — which is exactly why §5.3 keeps |
| + assertions out of query strings. |
| **Per-team is also cheaper on every axis this design worries about.** §6's |
| fan-out drops from every instance a person can reach to the apps in one |
| @@ -280,12 +325,12 @@ reasons the review pass (§12) should be run by someone who has read this |
| section. |
| **This is not escritorio revived.** No new app, no new process, no new store, |
| -no new repo. It is §11's front door — *"your teams grouped by app, and a New |
| -button"* — growing a recency section. |
| +no new repo. It is §11's front door — *"one page: a grid of apps, with a team switcher as |
| +a dropdown in the header"* (ruling 17) — growing a recency section. |
| --- |
| -## 3. The one clause that changes |
| +## 3. The two clauses that change |
| Nothing new goes at rest, so §0's **falsifiable** form is unamended — |
| publish the database and you still learn only counts, team names, |
| @@ -427,8 +472,8 @@ travelled." **That is false, and §5.3's own last line is the counter-example:** |
| "Delivery is an auto-POST, not a query string, so assertions stay out of edge |
| logs, browser history and referrers" — a property of travel, not of the |
| token. The conclusion survives on the specific argument rather than the |
| -general one: an `Authorization` header achieves the same three things an |
| -auto-POST does — with one leg removed: §5.3's "edge logs" reason was |
| +general one: an `Authorization` header achieves the same two things an |
| +auto-POST still claims — its third leg, edge logs, having been removed: §5.3's "edge logs" reason was |
| retracted on main on 2026-09-05, since no platform request log carrying |
| paths was found. There is no browser involved so there is no history, and there |
| is no `Referer` on a server-to-server call. **What must never happen is the |
| @@ -537,7 +582,7 @@ a few seconds". So: |
| - **The first front-door load of the day will mostly miss its deadline.** Not |
| an edge case — the normal morning. |
| -- **Every load warms the selected team's instances**, which changes the |
| +- **Every load warms the instances the viewer has rows in**, which changes the |
| hibernation economics the platform assumes — and **instance-hours are |
| billed to the instance's account, not to the person opening the door**. A |
| guest with one row in `acme.docs` would otherwise wake Acme's instance on |
| @@ -552,7 +597,7 @@ whether a pull may be attempted at all. Within that, the **refresh TTL** |
| decides whether the home bothers. The **hard maximum age** (§7) overrides |
| both: past it the rows go, whatever the other two say. |
| -Neither is fixed here. Both are **mitigated and disclosed**: |
| +Neither the cold-wake latency nor the wake economics is fixed here. Both are **mitigated and disclosed**: |
| - The RAM cache (§7) makes every load after the first instant. |
| - The waking state is rendered honestly (§8), so a slow first load is legible |
| @@ -565,6 +610,12 @@ ruling 5 is breached silently — the person cannot tell "nothing to say" from |
| "never asked". Un-asked instances render as a distinct gap with a refresh |
| affordance, and the budget is per render, not per person. |
| +**Two absences, and they are not the same.** An app the registry does not |
| +mark as participating (§10) is **never asked and renders nothing at all** — |
| +it is not part of this feature. An instance dropped by the budget **would** |
| +have been asked and renders the distinct gap. A builder needs both sentences |
| +or they will collapse into one. |
| + |
| **The named escape hatch**, if the morning experience proves miserable in |
| use: the rejected hybrid — instances push a *contentless* ping (person ref, |
| app, team, coarse timestamp, no title, no object ref) so the home knows which |
| @@ -608,6 +659,7 @@ in process memory, with a short TTL. |
| - **Keyed by person ref and instance host**, so one person's cache can never |
| render on another's page — the same isolation gate 4 already asserts for |
| the directory. |
| + |
| **Two ages, not one, because an earlier draft contradicted itself.** It said |
| the TTL bounds staleness "by a number we choose, not by a hibernating fleet's |
| wake schedule", and then said a failed pull never evicts a good cached |
| @@ -635,7 +687,7 @@ section above or beside it — **layout is the front-door session's call, not |
| this spec's.** |
| Every row: title, app, team, verb, actor if known, relative time, linking to |
| -the instance's own URL. Merged across the selected team's instances, |
| +the instance's own URL. Merged across the viewer's own instances in the selected team, |
| ordered by `at` descending, |
| capped. |
| @@ -684,7 +736,7 @@ front door is *for*. |
| **One consequence to expect rather than fix.** The directory is a hint with a |
| drain lag (§6), so the home will sometimes call an instance the person was |
| -removed from weeks ago, or one whose team was deleted (§9's call 2, third |
| +removed from weeks ago, or one whose team was deleted (home spec §9's call 2, whose second |
| event). §5.5 makes that safe — the answer is an empty list, or a 404 — but |
| ruling 5 then renders a named gap for a team they have left, or an |
| "unavailable" for a host that no longer exists. |
| @@ -723,7 +775,7 @@ being no-store (ruling 22), so these start at 11. |
| canary must appear in none of the places above. This is the class gate |
| 9's own review turned up three of, and each one was a guard that looked |
| complete. |
| -12. **A silent instance is a visible gap.** With one instance timing out and |
| +12. **A silent instance is a visible gap** — timeout, empty body, **and a `404` from an app that DECLARED participation** (§10's registry flag), which must render as a gap rather than as nothing. With one instance timing out and |
| one returning empty, the render distinguishes them. This gate fails if |
| both produce the same output. **The most important test in this |
| document.** |
| @@ -819,7 +871,7 @@ is **a gap**, rendered as one, and gate 12 covers that case. |
| | Search across the feed | Never at the home. `memoria` is where cross-corpus search lives, and it has its own custody story. | |
| | Filtering by app, team, person, or date | Someone asks. It is rendering, not custody, so it is cheap — but the front door is a front door. | |
| | Notifications, unread counts, marking read | Any of these needs per-person read state at the home, which is new custody. Argue it separately. | |
| -| Calendar and mail as sources | They have no repo and no spec respectively. | |
| +| Calendar and mail as sources | `oficina/calendar` has a repo and no spec; `oficina/mail` has neither. | |
| | An operator view of anyone's feed | Never (§2.2, §0). | |
| --- |
| @@ -840,7 +892,9 @@ is **a gap**, rendered as one, and gate 12 covers that case. |
| - the **cache bounds** (§2.1): maximum person entries and maximum bytes per |
| person, since the cache is cross-person; |
| - the **minimum pull interval** per (person, instance) (§6), which is what |
| - stops a guest's front door billing someone else's account. |
| + stops a guest's front door billing someone else's account; |
| + - the **refresh TTL** (§7), which home spec §15 lists as open here and |
| + which the earlier draft of this bullet dropped from both lists. |
| The fan-out budget's *number* can wait; its behaviour at the limit is |
| specified in §6 and is not open. |