oficina / memoria Public

Review request: move Memoria's rastrillo imports off the frozen path. Paul approved this on 2026-09-30. Polish audit r3 SUMMARY, item 1. It follows Sheets' recipe (oficina/sheets#44, main a5c17ab) and Calendar's branch (oficina/calendar#26). Memoria's differences are called out below.

Why. Memoria imported github.com/carlosframework/rastrillo, which stops at v0.23.0, so it never received tokens.css's iOS zoom-on-tap fix. On iOS, the door, the search box, Add content and the Notion token all zoomed the page on their first tap.

Live. Live is v0.1.0-28-g3203cdb, which is origin/main and an ancestor of this branch.

Pin. amadan.net/rastrillo/rastrillo at 29e4491 (v0.26.0+8). home/connect already required it, so the build has one amadan rastrillo. Rastrillo main is left for its own branch. estilo is pinned at main 530cb93.

Commits

• 8664251: TestNoZoomOnTap (browser tag). It is new along with make browser; Memoria had no browser harness, so chromedp joins go.mod. make vet now also vets -tags browser. Red on purpose: on origin/main the door was 14px, the search box 12.5px, Add content's title and body 14px, and the Notion token 14px. The door is measured signed out through the production App; everything else is measured through AppForTest.
• a1e6708: the move. - Every import is rewritten. The CLI is a go.mod tool, make migration-check runs go tool rastrillo, and make release stamps amadan.net/rastrillo/rastrillo.BuildVersion. - The native bridge differs from Sheets and Calendar. Memoria keeps the sessions handle that wireNative builds as a.sess and reads sessions through it (requireSession's signed-out redirect, admissionOf, offboard). So native.go now builds two handles over the same table, cookie and origin. a.sess uses the new package, and a second handle on the old path, presessions, is the one passed to nativeauth.New. - TestNoPreMoveRastrillo walks the repository and forbids every other old-path import. - Assets. doctor --fix re-copied tokens.css. It also wrote the old combined shim over rastrillo.js and added datetime.js and calendar.js. writeestilo restored estilo's split shim (TestBusyFilesAreEstilos). The two new scripts were deleted, and so was select.js: no page links any of the three. TestNoUnusedRastrilloScriptsOnDisk fails if one comes back, and tools/vendorassets now writes only tokens.css. - One gate change. TestEveryTemplateAttributeIsInTheDesignSystem read select.js as a source of hooks. That mention was the only reason index.html's class="rst-sr-only" passed, because the gate also reads rst- words inside class values. rst-sr-only is now in exempt by name, with the reason. Writing rst-sr-only as an attribute would also pass now, so the reviewer may prefer a different shape. - Credits are regenerated.
• f852120: nativeexchangetest.go covers all three ways Memoria reads a session: local with no Home (a new local-only fixture), local with Home configured, and a Home sign-in. - Exchange: 202 before approval, 404 for a wrong verifier, a new token under the app's cookie name, the same person (the index names alice), and no second exchange. - Expiry: an expired browser session signs nothing in, an approval that expires before the exchange gets 401, and a minted session expires. - Revocation: signing the browser out between approval and exchange gets 401, and /signout ends a minted session but leaves the browser's. - Red by mutation: an http origin on the old-path handle fails all three shapes, and sessions minted already expired fail all three. Both new guards were broken and failed. Output: polish-audit/r3/scripts/migrate-memoria-native-red.txt.
• 841a6a6: [rst-stack]'s text, email and password inputs and its textarea set font: inherit under a selector heavier than tokens.css's bare input, so they stayed 14px. They now get max(1rem, 1em) under (pointer: coarse). The red run after the move is in migrate-memoria-zoom-red.txt.

What the upgrade changes for Memoria

• Touch: text controls are 16px under (pointer: coarse), and interactive elements get touch-action: manipulation.
• Nothing else visible. Memoria's forms don't use form-foot, so the lg buttons don't reach it. It uses no date fields, meters or stat bands.
• Server side: mail honours its context (a 30s fallback when it has no deadline) and sends a Date header, and auth.Config.SubjectFor is new (unset here). The migrations agree.

Evidence

• make ci is green, with GOTOOLCHAIN go1.26.5 from the Makefile, so the credits test ran on the pinned toolchain. make browser is green.
• Old database: the old build seeded a DB (3 sealed documents) with a real DEK and instance key. On that DB, the new release binary migrated nothing (10 skipped). The old session cookie still answered 200, and the search still found and decrypted the documents ("Rua Augusta"). /api/version = v0.1.0-32-g841a6a6, and make release (linux/arm64) stamps the same.
• Screenshots are in polish-audit/r3/shots/migrate-memoria-{before,after}[-touch]-*.png, at 1440, 390 and 320. They cover the door (sent, error, signed-out), the index, results, the fact box, no results, Add content, a document and its delete page, connectors, Notion, credits, both 404s, live search as you type, the account menu, and the busy button. - With a mouse, the before and after style/geometry dumps are identical. The only difference is search.js's fingerprint, from a comment that named select.js. - On touch, small text controls went from 12 to 0. The file chooser is 12.5px, but it raises no keyboard. No page overflows.
• Shared chrome check (r2-memoria-check.config.mjs): 896 ok, 0 FAIL.
• tools/drive builds and serves (/?q=office+address renders its results).

Not in this branch: moving rastrillo/native's server, and rastrillo main.