Review brief: Meet design (round 2 reviews revision 2 against CODEX-FINDINGS-MEET.md)

You are GPT-6 reviewing an app design spec independently of its author. Your output is a findings report, not an edit. Do not modify any file.

What to read

1. The spec under review: docs/superpowers/specs/2026-09-07-meet-design.md.
2. The rulings it consumes, which are fixed. Report a mechanism that fails one; do not re-argue one. - The suite doctrine at revision 8: /home/paulca/amadan.net/oficina/suite/docs/superpowers/specs/2026-09-05-suite-sharing-doctrine.md, rulings 1, 3, 5, 6, 9, 15 and §8 (egress). Ruling 16 (a link token stored hashed) is on branch worktree-worktree-token-at-rest of that repo; git -C /home/paulca/amadan.net/oficina/suite show origin/worktree-worktree-token-at-rest:docs/superpowers/specs/2026-09-05-suite-sharing-doctrine.md. - oficina/suite discussion 3 (every participant signs in; guest grant at sign-in; Paul, 2026-09-06) and discussion 4 (agents as their own principal). amadan discuss show oficina/suite 3. - The CARLOS media roadmap: /home/paulca/amadan.net/carlos/platform/docs/superpowers/specs/2026-09-07-media-platform-roadmap-design.md on main, and the stage 4a relay spec, §2 in particular, on branch relay-stun-turn-spec: git -C /home/paulca/amadan.net/carlos/platform show relay-stun-turn-spec:docs/superpowers/specs/2026-09-07-relay-stun-turn-design.md. - carlos/platform discussion 113 (no upgrade over a tunnel-backed host; SSE plus POST). amadan discuss show carlos/platform 113.
3. The code the spec claims to reuse. Check every claim: - Docs sign-in: /home/paulca/amadan.net/oficina/docs/internal/docs/auth.go. - Docs live-sync transport and hibernation: /home/paulca/amadan.net/oficina/docs/internal/docs/stream.go and /home/paulca/amadan.net/oficina/docs/docs/superpowers/specs/2026-09-01-live-sync-design.md §3, §6, §8. - Sheets fan-out hub and link handler: /home/paulca/amadan.net/oficina/sheets-core/internal/sheets/live/hub.go, /home/paulca/amadan.net/oficina/sheets-core/internal/sheets/handlers_link.go. - Calendar sealing and the feed route mounted outside the session: /home/paulca/amadan.net/oficina/calendar/.claude/worktrees/reminder-wake/internal/calendar/seal/, /home/paulca/amadan.net/oficina/calendar/.claude/worktrees/reminder-wake/internal/calendar/routes.go. - Slides drive surface, which §8 adopts: /home/paulca/amadan.net/oficina/slides/.claude/worktrees/slice-1/docs/superpowers/specs/2026-09-07-slides-design.md §6, §7. - The scaffold in this repo: AGENTS.md, internal/calls/, internal/callstest/, go.mod (rastrillo v0.26.0).
4. WebRTC facts the spec relies on: host candidates only without STUN; ICE restart via setConfiguration plus restartIce; TURN REST credential shape; getDisplayMedia renegotiation.

What matters most

• §3.2, the one departure from Docs' auth.go. The allowlist gates membership, not whether a magic link is sent, so an outsider can sign in at all. What does that open: enumeration, mail volume, a non-member with a session and nothing to do? Is the return-path rule tight enough? Does a grant minted at sign-in survive the doctrine's "authorization is never cached" once the roster comes from the home?
• §4.3, the message table. For each type, who may send it, who receives it, and what the server reads. Find a message a waiting guest can get to a member other than knock, a way to exceed the cap, a way to make the server relay to a peer in another room, or a way to spoof from.
• §5, media. Is the ICE list built correctly from the relay contract's §2? Does the three-hour mint and the two-and-a-half-hour re-mint hold against a four-hour hard deadline checked on allocate and refresh? Is the floor in §5.5 stated honestly? Does §0.1's falsifiable claim survive §4.3 (the server relays SDP, which names codecs and candidate addresses) and the logs?
• §2, member derived per request. Is that the doctrine's ruling 3 or a cache in disguise? What happens to a guest grant when its person becomes a member, or a member is removed from the allowlist mid-call?
• §9, the scriptless floor. The suite's rule is that screens work with scripts off. The spec draws the line at the holding screen and the room. Is that the right line, and is the scriptless holding page described well enough to build?
• Claims about other repos. Every path, section number, ruling number, discussion number and "already does X" claim: check it. Report each one that is wrong.
• Slices in §12. Is each slice bounded, testable as described in §13, and free of a dependency on a later slice?

How to report

Write the report to standard output only. Number findings R1-1 onward. For each: severity (P1 breaks a trust guarantee or a consumed ruling; P2 a contract or claim defect to fix before the plan; P3 advisory), the section, the problem, the evidence with citations, a proposed correction. End with a verdict: accept, accept with corrections, or request changes. Do not soften, do not pad, do not restate the spec.